Cookie Policy

Definition and Technical Foundations

Cookies are small text files or code fragments that are stored on your device (computer, smartphone, tablet) by our web server or by third parties when you visit our website. These files contain information about your use of the website and can be read when you visit the website again. In addition to traditional HTTP cookies, cookie technology includes modern storage technologies such as Local Storage, Session Storage, IndexedDB, Web Beacons, Pixel Tags, Web Bugs, Clear GIFs, E-Tags, Flash Cookies (Local Shared Objects), HTML5 Storage, Silverlight Application Storage, and similar technologies.

Legal Foundations and Compliance

This Cookie Policy is based on the EU General Data Protection Regulation (GDPR), the ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC), the Telecommunications-Telemedia Data Protection Act (TTDSG), the Federal Data Protection Act (BDSG), the Telemedia Act (TMG), and international data protection provisions such as the California Consumer Privacy Act (CCPA), the Personal Information Protection and Electronic Documents Act (PIPEDA), the Lei Geral de Proteção de Dados (LGPD), and other applicable data protection laws in the jurisdictions in which we operate.

Scope and Applicability

This Cookie Policy applies to all websites, subdomains, mobile apps, API endpoints, integrations, and digital services of Workbase Platforms Sp. z o.o. operated under the "Leadbase" brand. This Policy covers all cookies and similar technologies controlled by us or originating from third parties that are used on our platforms.

International Applicability and Cross-Border Transfers

Because Leadbase operates globally and offers B2B data services in Germany, Austria, Switzerland, the USA, Canada, the United Kingdom, France, the Netherlands, Belgium, Italy, the Nordic countries, and other international markets, this Cookie Policy takes into account the different legal requirements in all operating jurisdictions and ensures that cookie-based data transfers comply with the applicable local laws.

Strictly Necessary Cookies (Strictly Necessary)

Authentication and Session Management

Firebase Auth Tokens: Secure user login and session management (validity period: Session/30 days)
CSRF-Protection Tokens: Protection against Cross-Site-Request-Forgery attacks
Session-Cookies: Maintaining the user session while navigating
Login-State Cookies: Storing login status for a seamless user experience
Multi-Factor-Authentication Cookies: Temporary storage of MFA states for security purposes

Website Functionality and Security

Load-Balancing Cookies: Optimal server distribution for performance and availability
CDN-Routing Cookies: Efficient content delivery through geographically distributed servers
API-Rate-Limiting Cookies: Protection against abuse through request limiting
Security-Header Cookies: Implementation of Content Security Policy and other security measures
Form-State Cookies: Temporary storage of form data to prevent data loss

Cookie-Consent-Status: Storage of your cookie preferences and consent decisions
GDPR-Compliance Flags: Documentation of the legal bases for consent for various processing purposes
Privacy-Settings Cookies: Your individual data protection and privacy settings

Functional Cookies (Functional/Preference)

User Interface and Experience

Theme Preferences: Dark/light mode settings and UI adjustments
Language Settings: Preferred language for the interface and content
Layout Preferences: Dashboard configurations, sidebar settings, and table views
Notification-Settings: Preferences for push notifications and email alerts
Timezone-Settings: Automatic adjustment to local time zones

Extended Functionality

CRM-Integration Preferences: Saved connection settings for external CRM systems
Search-History Cookies: Search query history for improved search suggestions
Filter-Settings: Saved filter and sort settings for lists and tables
Workflow-Preferences: Customized automation settings and workflow configurations
Export-Format Preferences: Preferred data export formats and settings

Performance and Analytics Cookies

Website Performance Monitoring

Google Analytics: Comprehensive website usage analysis with IP anonymization and enhanced privacy settings
Google Tag Manager: Centralized management of analytics and marketing tags
Core Web Vitals Tracking: Measuring loading speed, interactivity, and visual stability
Real User Monitoring (RUM): Real-time capture of the actual user experience
Error-Tracking Cookies: Identification and logging of JavaScript errors and performance problems

Business Intelligence and Usage Optimization

User-Journey-Tracking: Analysis of user interactions and conversion paths
Feature-Usage Analytics: Measuring the use of specific Leadbase features and functions
A/B-Test Cookies: Segmentation for feature testing and UX optimization
Cohort-Analysis Cookies: Grouping users for long-term behavioral analysis
Retention-Tracking: Measuring user engagement and platform loyalty

Marketing and Targeting Cookies

B2B Marketing and Lead Generation

LinkedIn Insight Tag: B2B-specific tracking for professional audience segmentation
Google Ads Conversion Tracking: Measuring marketing campaign effectiveness
Retargeting-Pixel: Personalized advertising for website visitors on other platforms
Lead-Scoring Cookies: Evaluating prospects based on website behavior
Attribution-Tracking: Assigning conversions to marketing channels and campaigns

Content Personalization

Dynamic-Content Cookies: Adapting content based on user behavior and preferences
Recommendation-Engine Cookies: Personalized recommendations for features and services
Behavioral-Targeting: Segmentation based on website interactions
Geographic-Targeting: Location-based content customization and services

Third-Party Cookies and External Integrations

Google Services Integration

Google Analytics 4 (GA4)

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Purpose: Website analysis, user behavior, conversion tracking, audience insights
Cookies: ga, _ga__, gid, _gat, _gtag_UA
Retention period: 2 years (persistent cookies), 24 hours (session cookies)
Data protection: IP anonymization enabled, advertising features optional
Opt-Out: Browser Add-On available at tools.google.com/dlpage/gaoptout

Google Tag Manager

Container-ID: GTM-TZKFGNCT
Purpose: Centralized management of analytics, marketing, and conversion tags
Functionality: Dynamic loading of tracking codes without code changes
Consent-Management: Integration with the cookie consent banner for compliant tag management

Google Ads and Conversion Tracking

Conversion-Linker: Linking website actions to advertising campaigns
Enhanced Conversions: Improved conversion measurement using hashed first-party data
Remarketing-Lists: Creating audiences for personalized advertising

Business Tools and CRM Integrations

CRM System Cookies

HubSpot Tracking: Lead capture and marketing automation (hubspotutk, **hstc, **hssrc, __hssc)
Salesforce-Integration: Synchronization of lead data and contact records
Pipedrive-Tracking: Pipeline management and sales analytics
Zoho-Integration: CRM data synchronization and workflow automation
Close.com-API: Sales communication tracking and lead scoring

Payment Processing Cookies

Autumn: Subscription management, billing, and payment processing
Fraud-Prevention: Detection of suspicious transactions and payment protection
PCI-Compliance: Secure credit card processing under Payment Card Industry standards

LinkedIn Business Solutions

LinkedIn Insight Tag: B2B audience targeting and campaign optimization
LinkedIn Sales Navigator: Professional contact discovery and lead research
Company-Page Analytics: Engagement tracking for corporate content

Facebook Business Tools: B2B marketing and lookalike audiences
Twitter-Conversion-Tracking: Social media ROI and engagement measurement
XING-Business-Integration: DACH-specific professional networking

Categorization by Retention Period

Session Cookies (Temporary Cookies)

Functionality: Automatically deleted when the browser is closed
Areas of application: Shopping carts, form data, temporary authentication
Security: Minimal data protection risk due to the short lifespan
Examples: SessionID, CSRF tokens, shopping cart state

Persistent Cookies (Permanent Cookies)

Short-term cookies (1-7 days): Short-lived preferences and temporary settings
Medium-term cookies (1-12 months): User settings, language preferences, and analytics data
Long-term cookies (1-2 years): Recognition, marketing attribution, and conversion tracking

Automatic Deletion and Data Minimization

Lifecycle Management

Automatic Cleanup: Regular deletion of expired cookies and orphaned data
Rolling-Expiration: Renewal of the expiration period during active use, deletion during inactivity
Privacy-by-Design: The shortest possible retention period by default for the respective purpose
Consent-Withdrawal-Processing: Immediate deletion when consent is withdrawn

Technical Implementation

Secure-Flag: Transmission only over encrypted HTTPS connections
HttpOnly-Flag: Protection against JavaScript access for security-critical cookies
SameSite-Attribute: Protection against Cross-Site-Request-Forgery attacks
Domain-Scope-Limitation: Restriction to necessary subdomains and paths

Essential Cookies: Automatically enabled, no consent required (legal basis: Art. 6(1)(f) GDPR)
Functional Cookies: Opt-in required for extended functionality
Analytics Cookies: Separate consent for usage statistics and performance monitoring
Marketing Cookies: Explicit consent for advertising and personalization
Third-Party Cookies: Specific consent for external services and integrations

Transparency Requirement: Complete list of all cookie categories and purposes
Genuine Choice: Equivalent design for accept/reject options
Granular Controls: Individual activation/deactivation for each cookie category
Settings Persistence: Storage of user decisions for future visits
Re-consent Mechanism: Periodic reassessment and confirmation of consent

User Rights and Self-Determination

Right to Information (Articles 13, 14 GDPR): Full transparency about cookie use and data processing
Right of Access (Article 15 GDPR): Overview of all stored cookie data and its purposes
Right to Rectification (Article 16 GDPR): Correction of inaccurate cookie-based preferences and profiles
Right to Erasure (Article 17 GDPR): Complete removal of all cookie data and tracking information
Right to Restriction (Article 18 GDPR): Temporary suspension of cookie processing
Right to Data Portability (Article 20 GDPR): Export of cookie-based preferences and settings
Right to Object (Article 21 GDPR): Stopping cookie processing based on legitimate interests

Extended Control Options

Cookie Dashboard: Personal control center for all cookie settings
Granular Toggles: Individual control for each cookie type and third party
Consent History: Record of all consents granted and withdrawn
Bulk Actions: Bulk activation/deactivation of cookie categories
Export Functions: Download of cookie settings for personal records

Desktop Browser Configuration

Google Chrome (Desktop)

Cookie Settings:{" "} chrome:
Delete All Cookies: Settings > Privacy and security > Clear browsing data
Site-Specific Control: Lock icon in address bar > Cookies
Block Third-Party Cookies: Settings > Privacy and security > Cookies and other site data
Incognito Mode: Ctrl+Shift+N for cookie-free browsing

Mozilla Firefox (Desktop)

Cookie Management: about:preferences#privacy
Enhanced Tracking Protection: Strict mode for maximum cookie protection
Cookie Exceptions: Define individual website rules
Automatic Deletion: Configure cleanup at the end of a session
Private Mode: Ctrl+Shift+P for temporary browsing

Safari (macOS)

Intelligent Tracking Prevention (ITP):{" "} Automatic cross-site tracking protection
Cookie Settings: Safari > Settings > Privacy
Manage Website Data: Detailed view by domain
Private Browsing: Cmd+Shift+N for tracking-free sessions

Microsoft Edge (Desktop)

Tracking Prevention: Three protection levels (Basic, Balanced, Strict)
Cookie Controls: edge:
InPrivate Browsing: Ctrl+Shift+N for cookie-isolated sessions

Mobile Browsers and Apps

iOS Safari

Settings: Settings > Safari > Privacy & Security
Prevent Cross-Site Tracking: Enabled by default for better privacy
Clear Website Data: Remove all Safari data and cookies

Android Chrome

Cookie Settings: Menu > Settings > Site settings > Cookies
Incognito Mode: Private browsing without cookie storage
Clear Website Data: Selectively or completely remove browser data

Advanced Browser Tools and Add-Ons

Privacy-Focused Browser Extensions

uBlock Origin: Comprehensive ad and tracker blocker
Privacy Badger: Automatic tracking-cookie detection and blocking
Ghostery: Detailed tracker analysis and granular control
DuckDuckGo Privacy Essentials: Comprehensive privacy protection

Browser DevTools: F12 > Application/Storage tab for cookie inspection
Cookie-Viewer Extensions: Detailed cookie properties and values
Network Monitoring: Tracking cookie setting and transmission

International Compliance and Multi-Jurisdictional Requirements

European Union (EU/EEA)

Lawfulness of Processing: Article 6 GDPR: consent, legitimate interests, performance of a contract
Special Categories: Article 9 GDPR: no processing of sensitive data without explicit consent
Transparency Obligations: Articles 12-14 GDPR: understandable information about cookie use
Data Subject Rights: Articles 15-22 GDPR: full implementation of all data protection rights
Data Protection Impact Assessment: Article 35 GDPR: for high-risk cookie processing

ePrivacy Directive (Directive 2002/58/EC)

Cookie Consent: Article 5(3): prior consent for non-technical cookies
Exceptions: Strictly necessary cookies for requested services
Information and Consent: Clear and comprehensive information before cookies are set

German Implementation (TTDSG)

Section 25 TTDSG: Protection of privacy in terminal equipment
Consent Requirement: Explicit consent for storing/accessing information
Exceptions: Technical necessity and user request

United States

California Consumer Privacy Act (CCPA/CPRA)

Right to Know: Disclosure of cookie categories and purposes of use
Right to Delete: Deletion of personal information from cookies
Right to Opt-Out: Objection to the sale of personal information
Do Not Sell: Respect for "Do Not Sell My Personal Information" requests
Sensitive Personal Information: Enhanced safeguards for sensitive data

Other US States

Virginia Consumer Data Protection Act (VCDPA): Rights similar to the CCPA with local specificities
Colorado Privacy Act (CPA): Comprehensive privacy rights and cookie control
Connecticut Data Privacy Act (CTDPA): Additional safeguards for minors

Canada (PIPEDA)

Meaningful Consent: Understandable and specific cookie consent
Purpose Limitation: Cookie use only for stated purposes
Individual Access: Right of access to cookie-based data collection
Privacy Breach Notification: Notification obligation for cookie-related data breaches

Other International Jurisdictions

Post-Brexit Continuity: Largely identical requirements to the EU GDPR
ICO Guidance: Specific guidance from the Information Commissioner's Office
PECR Compliance: Privacy and Electronic Communications Regulations

Brazil (LGPD)

Lei Geral de Proteção de Dados: Comprehensive data protection rights similar to the GDPR
Consent Requirements: Explicit consent for cookie processing
Data Subject Rights: Full data subject rights including portability

Australia (Privacy Act 1988)

Australian Privacy Principles: 13 principles for cookie-based data processing
Notifiable Data Breach Scheme: Notification obligation for relevant data breaches

Account-Based Marketing (ABM) Cookies

Company-Identification: Recognition of company IP ranges and company affiliation
Decision-Maker Tracking: Identification of C-level executives and decision-makers
Industry-Specific Targeting: Industry-specific content personalization
Sales-Cycle Analytics: Tracking long B2B buying cycles across multiple touchpoints
Multi-Stakeholder Tracking: Tracking complex B2B decision-making processes

CRM Integration Cookies

Lead-Scoring Enhancement: Website behavior for lead evaluation in CRM systems
Sales-Attribution: Assigning website actions to sales opportunities
Account-History Tracking: Cumulative engagement history for each target account
Cross-Platform Synchronization: Unified customer view across all touchpoints

Advanced Tracking Technologies

Server-Side Tracking

First-Party Data Enhancement: Enriching server logs with cookie information
Cookieless Tracking Preparation: Preparing for the post-cookie era with alternative identifiers
Privacy-Enhanced Analytics: Privacy-friendly analytics with minimal client-side data collection

Progressive Web App (PWA) Cookies

Service Worker Integration: Offline-capable cookie processing
App-Shell Caching: Persistent storage of app states
Background Sync: Data synchronization when an internet connection is available
Push Notification Preferences: Personalized notification settings

Predictive Analytics

Behavior Prediction: Predicting user interactions based on cookie data
Churn Prevention: Detecting churn risk through behavioral analysis
Next-Best-Action: Optimal next steps for individual users
Lifetime Value Prediction: Forecasting customer value based on early behavior

Personalization Engines

Dynamic Content Optimization: Real-time adaptation of content based on cookie profiles
Recommendation Systems: Personalized feature recommendations and workflow suggestions
Adaptive UI/UX: Adapting the interface to user preferences and behavior

Technical Security Measures

Encryption and Secure Transmission

HTTPS-Enforcement: Exclusive transmission over encrypted connections (TLS 1.3)
Secure-Flag Implementation: Prevents transmission over unencrypted HTTP connections
Cookie-Encryption: Encryption of sensitive cookie content with AES-256
Integrity-Protection: HMAC signing to protect against tampering
Perfect Forward Secrecy: Use of temporary keys for maximum security

Access Control and Authorization

HttpOnly-Attributes: Protection against JavaScript access for security-critical cookies
SameSite-Controls: Strict/Lax policies for CSRF prevention
Domain-Restrictions: Strict limitation to authorized domains and subdomains
Path-Limitations: Minimum required path ranges for cookie access
Role-Based Cookie Access: Different cookie sets based on user roles

Privacy-by-Design Implementation

Data Minimization Strategies

Purpose Limitation: Strict purpose limitation for each cookie type
Storage Minimization: Minimal necessary amount of data per cookie
Retention Limitations: Automatic deletion after the shortest possible period
Anonymization Techniques: Pseudonymization and anonymization of sensitive data

Advanced Privacy Technologies

Differential Privacy: Mathematical privacy guarantees for analytics
Homomorphic Encryption: Computations on encrypted cookie data
Secure Multi-Party Computation: Collaborative analytics without data exchange
Zero-Knowledge Proofs: Verification without revealing sensitive information

Incident Response and Security Monitoring

Continuous Monitoring

Cookie-Anomaly Detection: Automatic detection of unusual cookie activity
Unauthorized Access Monitoring: Real-time monitoring of suspicious cookie access
Data Exfiltration Prevention: Protection against unauthorized cookie data exfiltration
Compliance Monitoring: Continuous monitoring of cookie compliance

Incident Response Procedures

Breach Detection: Immediate detection of cookie-related data protection breaches
Containment Strategies: Rapid containment and damage limitation
Notification Procedures: Timely notification of supervisory authorities and data subjects
Forensic Analysis: Detailed investigation of cookie security incidents
Recovery Planning: Systematic recovery and improvement of cookie security

Cookieless Future Preparation

First-Party Data Strategies

Customer Data Platforms (CDP): Central collection and management of first-party data
Progressive Profiling: Gradual collection of user data with explicit consent
Zero-Party Data Collection: Direct collection of preferences through surveys and settings
Behavioral Analytics without Cookies: Server-side tracking and session-based analytics

Alternative Identifier Technologies

Privacy-Preserving Identifiers: Anonymous but consistent user identification
Contextual Targeting: Content-based rather than user-based personalization
Cohort-Based Analytics: Grouped tracking for privacy-compliant insights
Device Fingerprinting Alternatives: Privacy-friendly device recognition

Emerging Technologies and Standards

Privacy Sandbox and Web Standards

Topics API: Interest-based advertising without cross-site tracking
FLEDGE/Protected Audience: Remarketing without third-party cookies
Attribution Reporting API: Conversion measurement with privacy protection
Trust Tokens: Anti-fraud without user tracking

Blockchain and Decentralized Identity

Self-Sovereign Identity: User-controlled identity management
Decentralized Consent Management: Blockchain-based consent management
Privacy-Preserving Analytics: Verifiable analytics without data exchange

Adaptive Compliance Framework

Regulatory Future-Proofing

Continuous Compliance Monitoring: Automatic adaptation to new legal requirements
Global Privacy Framework: Consistent data protection standards across all jurisdictions
Regulatory Technology (RegTech): AI-supported compliance monitoring and adaptation

Technology Evolution Readiness

API-First Architecture: Flexible integration of new privacy technologies
Modular Consent Systems: Extensible consent platforms
Cross-Platform Compatibility: Consistent privacy experience across all devices and browsers

Contact, Support, and Complaint Management

Privacy Support and Requests

Direct Contact Options

Data Protection Officer: privacy@leadbase.io (response time: 48 hours on business days)
Cookie Support: cookies@leadbase.io for specific cookie questions
GDPR Requests: gdpr@leadbase.io for all data subject rights
Technical Support: support@leadbase.io for technical cookie problems
Compliance Hotline: compliance@leadbase.io for legal questions

International Support Channels

EU/DACH Support: German-language support for European customers
North America Support: English-language support for the USA/Canada
Global Privacy Office: Central contact point for international data protection matters

Complaint Procedures and Supervisory Authorities

Internal Complaint Office

First Level: Direct resolution through privacy support
Escalation: Referral to the Data Protection Officer if the resolution is unsatisfactory
Management Review: Highest escalation level to management
Documentation: Complete record of all complaint steps

External Supervisory Authorities

Primary Supervisory Authority (Lead Authority):

Germany: Bavarian State Office for Data Protection Supervision (BayLDA)
Address: Promenade 18, 91522 Ansbach
Website: www.lda.bayern.de
Email: poststelle@lda.bayern.de Other relevant supervisory authorities:
Austria: Data Protection Authority (DSB): www.dsb.gv.at
Switzerland: Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch
EU level: European Data Protection Board (EDPB)
edpb.europa.eu

Self-Help Resources and Documentation

Online Help Center

Cookie FAQ: Frequently asked questions and answers about cookie use
Video Tutorials: Step-by-step instructions for cookie settings
Browser Guides: Specific guidance for all common browsers
Troubleshooting: Solutions for common cookie problems

Educational Resources

Cookie Glossary: Plain-language explanation of all cookie terms
Privacy Best Practices: Recommendations for optimal cookie settings
Legal Updates: Current information about cookie laws
Technology Roadmap: Future of cookie technology and privacy tools

Regular Updates and Version Control

Change Management and Versioning

Systematic Updates

Quarterly Reviews: Regular review and update of the Cookie Policy
Regulatory Updates: Immediate adjustment to new legal requirements
Technology Evolution: Integration of new cookie technologies and privacy tools
User Feedback Integration: Consideration of user feedback and improvement suggestions

Notification and Communication

Change Notifications: Proactive information about material changes
Grace Periods: Sufficient lead time to adapt to new Cookie Policies
Multi-Channel Communication: Information via email, website banners, and in-app notifications
Rollback Procedures: Possibility of reversal in the event of critical problems

Continuous Improvement

Performance Monitoring

Cookie Performance Analytics: Measuring the impact of Cookie Policies on website performance
User Experience Metrics: Analysis of the usability of cookie banners and settings
Conversion Impact Analysis: Evaluation of the impact of Cookie Policies on business metrics
Privacy-UX Balance: Optimization between privacy and user experience

Stakeholder Feedback Integration

Customer Advisory Board: Regular consultation with key customers about Cookie Policies
Legal Expert Review: External legal review of Cookie Policies
Technical Expert Input: Advice from privacy engineering experts
Industry Best Practice Analysis: Benchmarking against leading B2B SaaS providers

Future-Proofing and Innovation

Technology Roadmap

Privacy-Enhancing Technologies: Proactive integration of new privacy tools
Standards Compliance: Early adoption of new web standards and browser APIs
Cross-Platform Harmonization: Consistent Cookie Policies across all Leadbase platforms
API-First Approach: Programmatic cookie management for enterprise customers

Innovation Pipeline

Research Partnerships: Collaboration with universities and privacy research institutes
Open Source Contributions: Contribution to privacy tools and standards development
Industry Collaboration: Active participation in privacy initiatives and standards bodies
Ethical AI Implementation: Responsible use of AI for cookie management and privacy enhancement ** This comprehensive Cookie Policy is regularly reviewed and updated to meet the highest standards of data protection, transparency, and legal compliance. If you have any questions or suggestions, please feel free to contact us at any time. **

Comprehensive Cookie Definition and Legal Foundations