Cookie Policy

Alva Intelligence LLC
Effective Date: Nov, 2025
Version: 1.0

We operate the websites A-Leads.co & joinalva.ai (the “Site”), as well as any other related products and services that refer or link to these legal terms (the “Legal Terms”) (collectively, the “Services”).

1. Introduction

This Cookie Policy explains how Alva Intelligence LLC, a Wyoming limited liability company with principal offices at 30 N Gould Street, Suite R, Sheridan, WY 82801, uses cookies and similar technologies on our websites, web applications, mobile applications, and other online properties (collectively the Sites). The purpose of this document is to provide transparent, practical information so that visitors and users understand what tracking technologies we use, why we use them, and how a user may exercise choices regarding cookies. This Cookie Policy supplements the Alva Intelligence Privacy Policy and the Do Not Sell or Share My Personal Information Notice. Where there is any inconsistency between those instruments and this Cookie Policy, this Cookie Policy governs with respect to cookie use and choices.

Alva Intelligence provides artificial intelligence enabled analytics, lead generation, and related business tools for enterprise customers and business users. Our platforms and services depend on accurate measurement of usage, performance, and interactions. Cookies and similar technologies allow us to provide secure, stable, and personalized services. At the same time we recognize that the use of cookies implicates individual privacy. We therefore adopt a consent and transparency forward approach to cookie deployment and management. This policy describes the types of cookies we use, the purpose of each category, the third parties that may install cookies on our Sites, retention periods, mechanisms for consent and withdrawal, and the technical and organizational measures we employ to protect cookie data.

We implement cookies only where there is a lawful basis to do so. For European Union data subjects this includes consent where required under the ePrivacy Directive and the General Data Protection Regulation. For California residents we treat certain cookie-based activities as sharing under the California Privacy Rights Act and we provide opt-out mechanisms consistent with that law. Where cookies support strictly necessary service functions we deploy those cookies subject to minimal data collection and robust security.

This Cookie Policy addresses both browser level controls and in product consent management tools. It explains how consent is recorded, how consent records are retained for audit purposes, and how cookie settings are synchronized across our systems and with third-party processors. It also sets out the circumstances in which cookies will not be used or will be restricted, such as tracking minors or processing sensitive personal information.

The sections that follow provide definitions, legal bases for processing, scope, and a full explanation of cookie categories and user controls. If you have any questions about this Cookie Policy or wish to exercise a privacy preference, contact our Data Protection Officer at dpo@joinalva.ai or privacy@joinalva.ai

2. Purpose, Legal Basis, and Scope

2.1 Purpose of the Cookie Policy

The central purpose of this Cookie Policy is to:

1. Describe the categories of cookies and similar tracking technologies used on the Sites.
2. Explain the lawful basis and business justification for each category of cookie.
3. Provide clear instructions for how users can give, withdraw, or manage consent.
4. Describe how cookie data is secured, retained, and, where applicable, de-identified.
5. Explain how cookie practices relate to other privacy instruments applicable to Alva Intelligence, including the Privacy Policy and the Do Not Sell or Share My Personal Information Notice.

This policy enables Alva Intelligence to meet legal obligations arising from international privacy laws including the General Data Protection Regulation, the ePrivacy Directive, the California Privacy Rights Act, and other applicable national or state laws. It also supports our contractual obligations to enterprise clients who require evidence of privacy by design, documented consent records, and integration with Data Processing Agreements.

2.2 Definitions and Key Concepts

For clarity and legal precision the principal terms used in this policy are defined as follows:

• Cookie. A small text file placed on a user’s device by a web server. Cookies store information that may be retrieved by the server on subsequent visits. Cookies may be session or persistent.
• Web beacon. A small, often transparent graphic used to monitor activity on a web page or email.
• Pixel. A tracking mechanism commonly used by advertising and analytics providers to measure conversions and audience behavior.
• Local storage. Browser based storage mechanisms such as localStorage that allow data to be retained across sessions without use of traditional cookies.
• First party cookie. A cookie set and read by the domain the user is visiting.
• Third party cookie. A cookie set or accessed by a domain other than the one the user is visiting, often used by analytics, advertising, or social media providers.
• Consent. A freely given, specific, informed, and unambiguous indication of the user’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data. Where applicable, consent is necessary before non-essential cookies are placed.
• Sharing. For purposes of California law, certain transfers of cookie-based identifiers and cross context tracking may constitute sharing and therefore must be disclosed and subject to opt-out.
• Strictly necessary cookie. A cookie that is essential to provide a service expressly requested by the user, for example maintaining a user session during login. Such cookies generally do not require consent.
• Consent preference center. An interface that permits users to accept, reject, or customize cookie categories and to view the consent audit trail.

These definitions are used throughout this Cookie Policy to ensure consistent interpretation.

2.3 Legal Bases for Cookie Processing

Alva Intelligence relies on one or more lawful bases to set and read cookies, depending on the cookie category, the user’s jurisdiction, and the sensitivity of the data involved. The principal legal bases include:

• Consent. For cookies used for advertising, targeting, or other non-essential purposes, we rely on prior user consent where required by law. Consent is recorded and logged and may be withdrawn at any time.
• Legitimate interest. In limited circumstances we rely on legitimate business interests for use of analytics or performance cookies where we have performed and documented a legitimate interest assessment and where the user’s interests do not override our purposes. Legitimate interest is not used for behavioural advertising that constitutes sharing under CPRA.
• Contract performance. Where cookies are necessary to enable or perform a user requested service, such as ensuring secure login or session continuity, we rely on contract necessity.
• Legal compliance. Where cookies facilitate legally mandated functions or enable compliance with audit or record keeping obligations, processing occurs for compliance reasons.

For European users we follow the requirements of the ePrivacy Directive and implement a prior consent regime for non essential cookies. For California residents we treat cookie driven cross context behavioural advertising as sharing and provide opt-out pathways consistent with the Do Not Sell or Share My Personal Information Notice.

Where consent is the lawful basis we will present an affirmative request to the user prior to placing the cookie. Consent is granular across categories and recorded in a consent ledger. We will not use pre toggled consents or implicit consent models.

2.4 Scope and Applicability

This Cookie Policy applies to:

1. All visitors to the Alva Intelligence corporate website and product sites.
2. Users of Alva Intelligence hosted web applications and portals.
3. Users of Alva Intelligence mobile applications where device level tracking technologies are employed.
4. Third party content integrated into our Sites, including embedded videos, social widgets, and marketing tags, to the extent that those third parties set cookies.

The policy is global in scope. Where local law imposes stricter requirements for particular jurisdictions we will comply with the highest standard. For example European visitors receive a privacy banner requiring active consent for analytics and advertising cookies. California residents are provided explicit mechanisms to opt out of sharing and to review the Notice of Financial Incentive where applicable.

This policy does not govern cookies set by third parties outside our control. We provide details of common third party cookies and links to third party privacy resources; however the third party’s own privacy policy governs their use. Where we use third parties we require contractual commitments to limit use, prevent resale, and to implement appropriate technical and organizational measures consistent with our Data Processing Agreements and vendor security standards.

2.5 Interaction with the Privacy Policy and Other Notices

This Cookie Policy is intended to be read alongside the Alva Intelligence Privacy Policy and the Do Not Sell or Share My Personal Information Notice.

The Privacy Policy explains broader data collection, use, retention, international transfers, and individual rights. The Cookie Policy focuses specifically on browser and client side tracking technologies and their management. Where cookie data is combined with other identifiers in a manner that results in personal data as defined by law the combined processing is described in the Privacy Policy and, where applicable, the Data Processing Agreement.

If a user elects to participate in the Leads-for-Data Program the interplay between cookie usage and that program will be governed by the financial-incentive notice and by the opt-in consent the participant provides. Where cookie data contributes to program eligibility or processing we will make that clear at the time of opt-in.

2.6 Responsibilities and Accountability

Alva Intelligence’s Data Protection Officer is responsible for the governance of this Cookie Policy, including the maintenance of the consent ledger, vendor assessments, and annual review of cookie inventories. The Security team implements technical controls to enforce cookie preferences across systems and data flows. The Product team ensures that no cookies are placed without integration through the consent management framework.

We maintain a Cookie Inventory and a Consent Audit Log that records the cookie name, purpose, category, retention period, third party recipient, legal basis, and the timestamped consent decision. These records are retained for audit purposes in accordance with our retention schedule. The Cookie Inventory is reviewed quarterly and updated whenever new tags are added or removed.

2.7 How This Policy Will Be Updated

Changes to cookie technology, regulatory developments, or business decisions may require amendment of this Cookie Policy. Material changes will be published on the Sites with an updated effective date and a summary of key changes. Users will be offered the opportunity to review and, where required by law, re-consent to changes that alter the scope of non-essential cookie processing.

3. Scope of Application

3.1 General Applicability

This Cookie Policy applies to every website, platform, product, or digital environment operated or controlled by Alva Intelligence LLC (“Alva Intelligence,” “we,” “our,” or “us”) where cookies, web beacons, pixels, or comparable tracking technologies are used.
It covers all forms of access including desktop, mobile, tablet, and connected devices whether accessed directly by an end user or indirectly through integrated systems, application programming interfaces (APIs), or third-party service providers.

The scope of this policy extends to the collection, storage, retrieval, and transfer of information obtained through cookies, regardless of whether such information is personally identifiable. This includes pseudonymous identifiers, device IDs, session keys, preference settings, and aggregated analytics data that, when combined with other datasets, may constitute personal information under applicable law.

The purpose of this broad applicability is to ensure consistent treatment of all cookie-related data, whether it is processed by Alva Intelligence directly or on its behalf by authorized vendors.

3.2 Covered Properties and Services

This policy governs all online assets and technology environments operated or controlled by Alva Intelligence, including but not limited to:

1. Corporate Website: all pages and subdomains of www.joinalva.ai, including resource centers, blogs, documentation, and customer portals.
2. Web Applications: any hosted SaaS platform or dashboard provided by Alva Intelligence for client access, analytics, lead generation, or account management.
3. Mobile Applications: Alva Intelligence mobile apps distributed through official application stores and connected web-based environments.
4. Support and Knowledge Base: online help centers, chat interfaces, and support ticket systems that use cookies to maintain session continuity or authenticate returning users.
5. Marketing and Campaign Landing Pages: promotional or advertising microsites used to inform prospective clients, collect business inquiries, or demonstrate product functionality.
6. Affiliate and Partner Portals: systems operated jointly with authorized business partners that rely on shared cookies for referral tracking and reporting.

This policy also applies to any new website, application, or online service that Alva Intelligence may introduce in the future, unless superseded by a more specific notice or contract provision.

3.3 Data and User Categories Covered

This Cookie Policy applies to all individuals who access or interact with our Sites, including but not limited to:

• Website Visitors: Individuals who browse or explore our website content without registering or logging in.
• Registered Users: Account holders or authorized representatives of business clients who log in to Alva Intelligence services.
• Prospective Clients: Individuals who engage with marketing materials, sign up for newsletters, or request product demonstrations.
• Business Clients and Partners: Enterprise customers and their authorized users whose systems may interact with our Sites through API calls or embedded services.
• Vendors and Contractors: Authorized third parties who access the Sites for operational or maintenance purposes.

For all these categories, cookies may collect data such as device type, browser settings, IP address, referrer URL, session duration, and activity logs. When combined with other identifiers, this data may constitute personal information. Alva Intelligence treats all such data with the same level of confidentiality and protection as personal data under applicable privacy laws.

3.4 Jurisdictional Coverage

Because Alva Intelligence serves users globally, this Cookie Policy incorporates multi-jurisdictional compliance standards. Specifically, it applies to:

1. United States:
   • Complying with the California Privacy Rights Act (CPRA) and similar state privacy statutes (e.g., Colorado, Virginia, Connecticut, Utah).
   • Providing users with clear opt-out mechanisms for cookie-based data sharing or cross-context behavioral advertising.
   • Implementing Global Privacy Control (GPC) signals as a recognized method of communicating privacy preferences.
2. European Economic Area (EEA), United Kingdom, and Switzerland:
   • Aligning with the General Data Protection Regulation (GDPR) and ePrivacy Directive.
   • Using explicit prior consent for any non-essential cookies and ensuring proof of consent is retained in compliance with Article 7 of the GDPR.
   • Providing a lawful basis mapping for each cookie type (consent, legitimate interest, or contract necessity).
3. Canada and Other Jurisdictions:
   • Adhering to Personal Information Protection and Electronic Documents Act (PIPEDA) requirements for meaningful consent.
   • Incorporating privacy-by-design principles consistent with emerging international frameworks such as the OECD Privacy Guidelines.

Where different jurisdictions impose conflicting standards, Alva Intelligence applies the most privacy-protective standard reasonably achievable across its digital assets.

3.5 Relationship with Third-Party Services and Integrations

The Sites may integrate third-party tools or content, such as analytics services, advertising networks, video-hosting platforms, or social-media widgets. These integrations may allow third parties to set or access cookies on the user’s device.

To mitigate risk and preserve user choice, Alva Intelligence:

• conducts due diligence on each third-party provider’s privacy and security posture prior to integration;
• requires contractual commitments to restrict data use to purposes necessary for service delivery;
• audits active cookies quarterly to identify unauthorized or outdated third-party trackers; and
• provides users with visibility into third-party cookies via the Cookie Inventory (Exhibit A) and direct links to third-party privacy statements.

Third-party cookies are subject to the user’s consent preferences. Where consent is withheld or withdrawn, Alva Intelligence enforces that choice using a consent-management platform (CMP) that blocks non-approved cookies from loading.

3.6 Operational Boundaries

This policy applies to all data processing activities involving cookies under Alva Intelligence’s control. It does not apply to:

1. Offline Data Collection: Information gathered through offline interactions such as trade shows or direct contracts.
2. Third-Party Independent Websites: Sites that link to or from Alva Intelligence but are operated independently.
3. Internal Employee Systems: Internal corporate systems, intranets, or human-resources applications that are covered by separate internal privacy notices.

However, to the extent cookies or similar identifiers from the Sites are accessible to or integrated with such environments, those data flows remain within this policy’s scope.

3.7 Technical Scope of Cookie Operations

Cookies covered under this policy include:

• HTTP Cookies stored through browsers and read by our servers;
• HTML5 Local Storage and Session Storage data used for performance enhancement;
• IndexedDB storage used by modern browsers for caching application data;
• Software Development Kit (SDK) identifiers in mobile applications used for telemetry and error reporting; and
• Tracking pixels embedded in emails or web content for engagement measurement.

The same governance principles apply to all these technologies. They are treated collectively as “cookies” for policy purposes even where the technical implementation differs.

3.8 Data Scope and Limitations

Alva Intelligence limits cookie data collection to the minimal scope necessary for legitimate business and operational purposes. We do not use cookies to capture sensitive categories of personal data such as health, biometric, racial, or financial information. Cookie identifiers are never used for automated decision-making that produces legal or similarly significant effects on individuals.

Analytics cookies are configured to truncate or anonymize IP addresses wherever feasible, and geolocation data derived from cookies is generalized to regional levels. Access to raw cookie logs is strictly limited to authorized personnel under confidentiality agreements.

3.9 Cross-Device and Cross-Context Scope

Cookies set by Alva Intelligence may operate across multiple devices or sessions associated with the same user or organization. This occurs only when a registered user logs in using identical credentials across devices or when an enterprise client enables analytics integrations that span multiple domains. Cross-device tracking is designed to enhance legitimate functions such as security verification, fraud prevention, and analytics consistency, and never to expand advertising reach without consent.

Where cookie data may qualify as “cross-context behavioral advertising” under CPRA definitions, users are clearly informed and may exercise the right to opt out through the Do Not Sell or Share My Information link available on every page.

3.10 Duration and Temporal Scope

This Cookie Policy remains effective for as long as the Sites are operational and cookies are deployed. Users’ cookie preferences remain in force until they are modified or withdrawn.
When material updates are made to cookie functionality or categories, users are prompted to review new disclosures and, where applicable, to provide updated consent.

Each version of the Cookie Policy includes its effective date and version number. Older versions remain archived for a minimum of five years for compliance verification and recordkeeping.

3.11 Assurance of Comprehensive Coverage

By defining a clear scope that includes digital assets, user categories, jurisdictions, and third-party integrations, Alva Intelligence ensures that this Cookie Policy covers every conceivable use of tracking technologies under its control. This comprehensive approach reflects our commitment to transparency, accountability, and consistent protection of personal information regardless of where or how it is processed.

4. Categories of Cookies Used

4.1 Overview

Alva Intelligence LLC (“Alva Intelligence,” “we,” “our,” or “us”) uses a structured and standardized classification of cookies and tracking technologies to ensure transparency, user control, and compliance with applicable data-protection laws. Cookies serve various purposes ranging from security and essential service delivery to advanced analytics, functional personalization, and limited marketing integrations.

Each category described below has been assessed for necessity, proportionality, and legal justification. The classification enables users to make informed consent decisions using our Cookie Preference Center and ensures that non-essential cookies are deployed only after consent has been explicitly granted where required.

4.2 Strictly Necessary Cookies

4.2.1 Purpose

Strictly necessary cookies enable the core functionality of Alva Intelligence websites and applications. Without these cookies, essential services such as account login, secure session maintenance, shopping cart functionality (where applicable), and preference retention cannot function properly.

These cookies also assist in fraud prevention, network security, and load balancing, ensuring stable service delivery across distributed systems.

4.2.2 Typical Data Collected

• Session identifiers
• Authentication tokens
• Security keys and CSRF validation values
• Server affinity identifiers
• Consent record storage

Strictly necessary cookies do not store personally identifiable information beyond what is required for the operation of the site or application session.

4.2.3 Examples

• auth_session_id: Maintains active user login.
• csrftoken: Protects forms from cross-site request forgery.
• cookieConsentStatus: Stores user consent settings.

4.2.4 Legal Basis

Processing of strictly necessary cookies is based on contract performance (where they are required to deliver a user-requested service) or legitimate interest in ensuring platform security and stability. Consent is not required for these cookies, though their existence is disclosed for transparency.

4.2.5 Retention

Most strictly necessary cookies expire when the session ends or after a short duration (usually 24 hours). Some preference cookies may persist longer solely to record compliance preferences.

4.3 Performance and Analytics Cookies

4.3.1 Purpose

Performance and analytics cookies collect aggregated, pseudonymized information about how users interact with the Sites. The purpose is to understand usage trends, identify performance bottlenecks, measure content effectiveness, and optimize design and navigation.

These cookies support business operations by providing statistical insight rather than personal profiling.

4.3.2 Typical Data Collected

• Pages visited and time spent per page
• Click paths, scrolling behavior, and interactions
• Error logs and crash reports
• Browser type, operating system, and device identifiers (pseudonymized)
• Approximate geolocation (city or region level only)

No precise geolocation, personal identifiers, or behavioral profiles are created from this data.

4.3.3 Examples

• _ga (Google Analytics) – Measures website performance and usage.
• _gid (Google Analytics) – Distinguishes users across sessions.
• ahoy_visit / ahoy_visitor – Used by internal analytics tools to identify repeat visits anonymously.

4.3.4 Legal Basis

In jurisdictions governed by GDPR or the ePrivacy Directive, processing of analytics cookies is based on consent obtained through the Cookie Preference Center.
In jurisdictions applying CPRA or equivalent frameworks, analytics cookies that do not constitute “sharing” may be used under legitimate interest, provided users have an opportunity to opt out.

4.3.5 Retention

Analytics cookies typically persist for 12–24 months, depending on configuration. Data collected is anonymized and aggregated within 90 days. All analytics logs are subject to strict access control and audit trails.

4.4 Functional Cookies

4.4.1 Purpose

Functional cookies enhance user experience by remembering preferences, such as selected language, region, display settings, and customized dashboards. They allow personalization that improves usability but are not strictly required for the system to operate.

Where personalization involves user behavior or inferred preferences, consent will be required before activation.

4.4.2 Typical Data Collected

• Language selection and locale identifiers
• Display and layout preferences
• Saved form field entries or drafts
• Recently viewed content lists
• UI theme selections

4.4.3 Examples

• lang_pref – Stores user’s preferred language.
• ui_theme_mode – Saves light/dark display mode preferences.
• user_region – Retains selected geographic location for content relevance.

4.4.4 Legal Basis

Processing of functional cookies may rely on consent or legitimate interest depending on the jurisdiction and whether the data creates identifiable behavioral patterns. For European users, explicit consent is generally required before setting such cookies.

4.4.5 Retention

Functional cookies are persistent for a defined duration, typically six to twelve months, or until the user deletes them manually. Retention ensures that returning visitors enjoy consistent and customized interactions without reconfiguration.

4.5 Advertising and Targeting Cookies

4.5.1 Purpose

Advertising and targeting cookies are used to deliver relevant marketing content, limit repetitive advertising, and measure campaign effectiveness. They help Alva Intelligence understand which promotions and product offerings are of interest to users and provide metrics to improve advertising strategy.

Where these cookies are placed by third-party advertising networks, they may track user activity across different websites. Such practices qualify as “sharing” under the California Privacy Rights Act and require clear opt-out options.

4.5.2 Typical Data Collected

• Pseudonymous advertising identifiers (cookie ID or ad ID)
• Browsing behavior across domains
• Ad impressions, clicks, and conversions
• Device type, approximate location, and browser version
• Campaign or referral source data

No sensitive data categories (such as health, financial, or biometric data) are collected through advertising cookies.

4.5.3 Examples

• _fbp (Meta Pixel) – Measures advertising performance on Facebook platforms.
• _gcl_au (Google Ads Conversion Linker) – Tracks conversions from ad campaigns.
• hubspotutk (HubSpot) – Tracks engagement with marketing emails or landing pages.

4.5.4 Legal Basis

Advertising and targeting cookies are set only with explicit, opt-in consent under GDPR, ePrivacy Directive, and similar frameworks.
Under CPRA, these cookies fall under the definition of “sale” or “sharing” of personal information for cross-context behavioral advertising. Users have the right to opt out of such practices via the Do Not Sell or Share My Information link or by adjusting their cookie preferences.

4.5.5 Retention

Advertising cookies typically persist from 30 days to one year, depending on campaign duration. Data is periodically purged or re-anonymized once it is no longer required for the stated purpose.

4.6 Social Media Cookies

4.6.1 Purpose

Social media cookies facilitate interaction with third-party platforms, such as enabling content sharing, embedding social feeds, or supporting single sign-on (SSO) login through platforms like LinkedIn, Google, or Facebook. These cookies are primarily controlled by the respective third parties and are subject to their own privacy and cookie policies.

4.6.2 Typical Data Collected

• Social network user ID or authentication token
• Profile picture or username (for display purposes)
• Content engagement metrics such as likes, shares, or comments
• Metadata linking user accounts between Alva Intelligence and third-party platforms

4.6.3 Examples

• linkedin_oauth_ – Used for LinkedIn login verification.
• _twitter_sess – Manages Twitter session for embedded tweets.
• yt_remote_session_app – Used by embedded YouTube videos for playback preferences.

4.6.4 Legal Basis

Processing relies on user consent, which is collected through the Cookie Preference Center prior to activation. Alva Intelligence ensures that no social media tracking is enabled until consent has been granted.

Users are encouraged to review the cookie and privacy policies of third-party social media networks for further details on their independent practices.

4.6.5 Retention

Social media cookies remain active only during the user’s session unless the third-party provider uses persistent cookies to maintain preferences. Users can delete these cookies at any time through their browser or the third-party account settings.

4.7 Preference and Consent Management Cookies

4.7.1 Purpose

Preference cookies store a user’s privacy and consent settings. They are critical for ensuring compliance with cookie laws and for honoring user choices consistently across sessions.
These cookies record whether a user has accepted, rejected, or customized cookie categories and prevent consent banners from reappearing unnecessarily.

4.7.2 Typical Data Collected

• User consent state (accepted, rejected, customized)
• Timestamp of consent action
• Region or jurisdiction identifier for consent rules
• Cookie policy version number
• Audit token or pseudonymous consent ID

4.7.3 Examples

• cookie_preferences_saved – Indicates user has set cookie preferences.
• cmp_consent_id – Records unique identifier for consent transaction.
• policy_version_recorded – Stores version number of cookie policy in effect at the time of consent.

4.7.4 Legal Basis

Processing is based on legal obligation and legitimate interest to comply with CPRA, GDPR, and ePrivacy requirements. These cookies are considered strictly necessary for compliance and therefore do not require additional consent.

4.7.5 Retention

Consent records are retained for up to five years for audit and regulatory verification. The cookies themselves typically persist for one year to ensure continuity of preference recognition.

4.8 Summary Table of Categories and Legal Bases

4.9 Assurance of Accountability and Review

Alva Intelligence reviews the categories of cookies used across all digital properties at least once every quarter. The review includes:

• verification of cookie inventory and vendor lists;
• confirmation that consent configurations match the declared lawful basis;
• validation that retention schedules are honored; and
• internal sign-off by the Data Protection Officer and Information Security team.

Changes to cookie categories or legal bases trigger updates to this policy and to the Cookie Inventory (Exhibit A). Such updates are documented in the Cookie Governance Register and reflected in the Privacy Compliance Reports submitted annually for SOC 2 Type 2 and GDPR audits.

5. Detailed Cookie Inventory and Technical Descriptions

5.1 Purpose of the Inventory

The Cookie Inventory is a comprehensive record of all cookies and comparable tracking technologies deployed across the Alva Intelligence digital environment.
It serves three functions:

1. Transparency – To inform users of the precise cookies operating on each domain or application.
2. Compliance – To demonstrate conformity with CPRA, GDPR, and ePrivacy record-keeping obligations.
3. Governance – To support quarterly internal audits and SOC 2 Type 2 control testing.

This inventory is reviewed and certified by the Data Protection Officer (DPO) and the Information Security team every quarter, or more frequently when new integrations or vendors are introduced. Each cookie entry includes its name, provider, category, purpose, type, duration, lawful basis, and opt-out mechanism.

5.2 Structure of the Inventory

The inventory is divided into six principal categories corresponding to Section 4 of this policy:

1. Strictly Necessary Cookies
2. Performance and Analytics Cookies
3. Functional Cookies
4. Advertising and Targeting Cookies
5. Social Media Cookies
6. Preference and Consent Management Cookies

For ease of review, the inventory table below uses a consistent column layout. Cookies marked with an asterisk (*) may be set by trusted third-party processors operating under written Data Processing Agreements.

5.3 Master Cookie Table

(Table continues on next page for internal documentation and new integrations)

5.4 Technical Descriptions and Governance Notes

5.4.1 Identification and Tagging

Each cookie is tagged with metadata in Alva Intelligence’s internal Cookie Registry. Metadata includes deployment environment (production, staging, testing), responsible system owner, and change-control reference. The registry feeds automatically into the consent-management platform to ensure consistent disclosures across web properties.

5.4.2 Consent Recording and Synchronization

When a user submits cookie preferences, the Consent Management Platform (CMP) assigns a unique consent ID stored both locally (cmp_consent_id) and in a secure, encrypted database. This allows Alva Intelligence to produce auditable proof of consent upon regulatory request.
The CMP synchronizes preferences across browsers and devices whenever users authenticate through their accounts.

5.4.3 Data Minimization and Pseudonymization

All analytics identifiers are pseudonymized using randomized alphanumeric strings. Where IP addresses are collected for analytics, they are truncated to the first two octets before storage.
Advertising and targeting cookies are configured to use aggregation mode whenever possible to reduce exposure of personal identifiers.

5.4.4 Third-Party Vendor Oversight

Each third-party cookie provider is subject to a Vendor Risk Assessment and must execute a Data Processing Agreement with Alva Intelligence. Vendors undergo annual privacy and security audits to confirm compliance with GDPR Article 28 obligations and SOC 2 criteria.
Cookies from vendors that fail re-certification are removed or replaced within thirty days.

5.4.5 Retention and Deletion Controls

Cookie data retention follows the schedule defined in Section 17 of the Privacy Policy. Automated scripts execute nightly to identify cookies exceeding their declared lifespan and purge them from the database.
Expired consent records are flagged for deletion during the next quarterly compliance cycle.

5.4.6 Testing and Deployment

All new cookies or tracking scripts undergo technical testing in a controlled staging environment. The test confirms correct categorization, banner integration, and respect for user consent before public deployment. Test results are logged in the Cookie Deployment Change Record maintained by the Security team.

5.4.7 Cross-Domain and Subdomain Handling

For domains and subdomains under Alva Intelligence’s control, a shared cookie namespace is used to maintain consistency. Cross-domain cookies are configured with the “SameSite=Lax” attribute unless functionality requires broader access, in which case justification is documented and approved by the DPO.

5.4.8 Secure Configuration

All cookies are set with the Secure and HttpOnly attributes whenever technically feasible to protect against interception or client-side manipulation. Sensitive cookies employ the SameSite=Strict attribute to prevent cross-site request attacks.
Transport occurs exclusively over HTTPS connections, verified through automated TLS scanning.

5.4.9 Automated Inventory Update Process

Alva Intelligence employs automated scanning tools to detect new or changed cookies. Scans run weekly and feed results into the Cookie Registry for human verification. Discrepancies trigger review by the Privacy Engineering team. Each confirmed change generates a Cookie Inventory Update Record which is appended to the quarterly compliance report.

5.4.10 Version Control and Publication

The Cookie Inventory is version-controlled using internal document-management systems. Each published version includes:

• revision number;
• effective date;
• approver signatures (DPO and General Counsel);
• and summary of modifications.

Historical versions are archived for a minimum of five years. Users may request a copy of prior inventories by contacting privacy@joinalva.ai.

5.5 Exhibit A: Public Cookie Inventory Summary

For public display on the website, a summarized inventory derived from this master table is presented in human-readable form under the heading “Cookie Details” in the Cookie Preference Center.
This summary omits internal identifiers and technical attributes while maintaining transparency about providers, purposes, and durations. The publicly displayed inventory is automatically refreshed when internal updates are approved.

5.6 Assurance of Accuracy and Oversight

Alva Intelligence affirms that all cookies deployed across its Sites have been reviewed for necessity, legality, and proportionality. Each cookie serves a defined and documented purpose, aligned with business need and user expectation.
The DPO, assisted by the Compliance and Security teams, certifies the accuracy of this inventory as of the effective date and confirms that no undeclared or unapproved tracking technologies are active.

Ongoing governance ensures that cookie usage remains limited, auditable, and consistent with the highest standards of corporate compliance and consumer privacy protection.

6. How We Use Cookies

6.1 Purpose and Operational Integration

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) uses cookies and related tracking technologies as integral components of our website and application architecture.
Cookies allow us to provide secure, efficient, and personalized services by enabling functionality that cannot operate without short-term data persistence.
They also support our analytics framework, optimize system performance, and enhance the overall experience of users and enterprise clients interacting with our digital ecosystem.

Each cookie deployed serves a documented business purpose, subject to pre-deployment review, privacy risk assessment, and ongoing monitoring.
No cookie is used arbitrarily or beyond its declared purpose.
The functions covered under this section fall into the following operational domains:

1. Authentication and Access Management
2. Security and System Integrity
3. Performance Monitoring and Optimization
4. Product Improvement and Usage Analytics
5. User Experience and Interface Personalization
6. Advertising, Retargeting, and Conversion Analysis
7. Consent, Preference, and Compliance Management

These domains collectively ensure that cookies enhance and not compromise the privacy, transparency, and functionality of the Alva Intelligence platform.

6.2 Authentication and Access Management

6.2.1 Overview

Authentication cookies establish and maintain secure sessions between users and Alva Intelligence applications. When a user logs in to an account or accesses restricted content, a unique encrypted session identifier is generated and stored in a cookie. This cookie confirms the user’s identity to the server and authorizes access without requiring repeated logins.

6.2.2 How They Function

• Upon successful authentication, the system issues a session cookie that contains a cryptographic token tied to the user’s ID in the authentication database.
• The cookie has no readable personal data; it references a server-side entry that validates access rights.
• Once a session ends or the user logs out, the cookie is automatically invalidated.
• Security attributes such as Secure, HttpOnly, and SameSite=Strict prevent the cookie from being intercepted or modified.

6.2.3 Legal and Compliance Considerations

Authentication cookies are essential for contract performance; they enable users to access their accounts and licensed content. Therefore, consent is not required for these cookies under GDPR Article 6(1)(b) and CPRA guidelines, though their operation is disclosed for transparency. Audit records of authentication sessions are retained securely in compliance with SOC 2 Type 2 standards.

6.3 Security and System Integrity

6.3.1 Overview

Cookies play a critical role in maintaining the integrity and security of Alva Intelligence’s digital infrastructure. They help prevent unauthorized access, detect suspicious activity, and enforce consistent security settings across all sessions and browsers.

6.3.2 Use Cases

• Fraud Detection: Security cookies track authentication anomalies and multiple failed login attempts.
• CSRF Protection: Tokens stored in cookies ensure that any form submission originates from a valid session.
• Session Expiration Management: Cookies record the time of last activity to automatically terminate idle sessions.
• Content Delivery: Load-balancing cookies distribute web traffic evenly across servers to avoid downtime or performance degradation.

6.3.3 Data Characteristics

Security cookies contain no personal identifiers beyond pseudonymous session tokens. Data collected is used only for real-time protection and is deleted automatically after session closure or short retention intervals.

6.3.4 Compliance Assurance

Use of security cookies aligns with the principle of data minimization under GDPR Article 5(1)(c) and the reasonable security measures standard under CPRA Section 1798.100(e).
The Information Security team reviews cookie-based security mechanisms quarterly to confirm that they remain necessary, proportionate, and current with emerging cybersecurity best practices.

6.4 Performance Monitoring and Optimization

6.4.1 Overview

Performance cookies measure how our Sites and applications function under actual user conditions. They allow us to evaluate load times, page responsiveness, content rendering, and user flow efficiency.

6.4.2 Use Cases

• Load Balancing: Cookies track server response distribution to optimize resource allocation.
• Latency Measurement: Cookies calculate network delay and rendering speed to inform infrastructure scaling.
• Error Logging: Performance cookies record instances of failed scripts or page loads, helping engineers debug issues.
• Device Adaptation: Cookies detect browser type, operating system, and viewport dimensions to deliver appropriately formatted content.

6.4.3 Data Characteristics

Performance cookies collect pseudonymous metrics and environmental data only; they do not contain names, contact information, or identifiable personal details.
These cookies assist in aggregate analysis to ensure a consistent, reliable user experience.

6.4.4 Legal Basis and Retention

Where required by law (e.g., under the ePrivacy Directive), performance cookies are enabled only after consent. Otherwise, they operate under legitimate interest in maintaining service quality. Data is anonymized within 30 days and retained in aggregate for trend analysis for up to 12 months.

6.5 Product Improvement and Usage Analytics

6.5.1 Overview

Analytics cookies help Alva Intelligence improve its products through insights about usage patterns, feature engagement, and navigation trends.
The goal is to understand what aspects of our services users value and where usability improvements are needed.

6.5.2 Functionality

Analytics cookies measure:

• number of unique visits and frequency of return users;
• sequence of page visits or feature interactions;
• completion rates for forms or onboarding flows; and
• aggregate performance of content campaigns or product modules.

To ensure privacy, IP addresses are truncated or anonymized, and user IDs are hashed. Data collected is aggregated before analysis.

6.5.3 Integration with Analytics Providers

Alva Intelligence uses privacy-compliant analytics tools such as Google Analytics (configured for IP anonymization) and internal event-tracking systems. No analytics data is shared with third parties for advertising purposes. All third-party processors are bound by Data Processing Agreements limiting their use of data solely to statistical reporting.

6.5.4 Legal Basis

Under GDPR, analytics cookies require consent. Under CPRA, their use is permissible as a legitimate business function provided no personal information is sold or shared.
Users may opt out of analytics cookies at any time through the Cookie Preference Center.

6.6 User Experience and Interface Personalization

6.6.1 Overview

Functional cookies provide enhanced usability and customization across the Alva Intelligence platform. They remember user preferences, store interface settings, and ensure that returning users experience consistent functionality.

6.6.2 Examples

• Storing language or localization settings.
• Saving UI configurations (e.g., dashboard layouts, themes).
• Remembering previously entered data to reduce redundancy.
• Maintaining user-selected filters or sorting preferences.

6.6.3 Data Characteristics and Privacy Controls

Functional cookies contain limited configuration data and never store sensitive personal information. They are encrypted at rest and subject to the same retention controls as analytics data. Users can disable these cookies at any time, though doing so may reduce usability.

6.6.4 Legal and Compliance Notes

In the EU/EEA, consent is required before setting non-essential functional cookies. In other jurisdictions, use is permissible based on legitimate interest where personalization is expected and minimally intrusive. Functional cookies are reviewed annually to ensure their continued relevance.

6.7 Advertising, Retargeting, and Conversion Analysis

6.7.1 Overview

Advertising cookies help measure the performance of marketing campaigns and support limited remarketing to business prospects who have shown legitimate interest in Alva Intelligence products. These cookies allow attribution of marketing spend and inform strategic planning but are never used to build individual consumer profiles.

6.7.2 Operational Practices

• Advertising cookies record campaign IDs, ad impressions, and conversion events.
• Cross-domain tracking is disabled by default unless explicitly consented to.
• Third-party advertising integrations are restricted to verified business networks (e.g., Google Ads, LinkedIn, HubSpot) operating under contract.

6.7.3 Legal Framework

Under CPRA, advertising cookies constitute “sharing” of personal information if they link cross-context behavior. Users can opt out at any time via the Do Not Sell or Share My Information link. Under GDPR, advertising cookies require explicit prior consent. Once denied, Alva Intelligence’s systems automatically block third-party tracking pixels.

6.7.4 Safeguards

• Advertising cookies are deployed in aggregation or pseudonymized form.
• No personally identifiable data (PII) is transferred to advertisers.
• Ad logs are retained for 90 days unless required longer for accounting reconciliation.
• Users can revoke consent through the Cookie Preference Center or browser settings.

6.8 Consent, Preference, and Compliance Management

6.8.1 Overview

Cookies also serve a compliance function by storing user preferences, consent records, and policy version identifiers. This ensures that user decisions are respected across sessions and that Alva Intelligence can produce audit evidence for regulators.

6.8.2 Functionality

• When a user sets cookie preferences, the consent choice is written to a consent record cookie and mirrored in an encrypted consent ledger.
• The system uses this cookie to recall the user’s preferences on future visits, ensuring consistent enforcement.
• The ledger includes a timestamp, jurisdiction, and policy version number for each consent transaction.

6.8.3 Legal Rationale

These cookies are classified as strictly necessary for compliance under both GDPR and CPRA, as they document consent and prevent non-compliant cookie deployment. They do not require separate consent.

6.8.4 Retention and Audit

Consent records are stored for up to five years for audit purposes. Users may request confirmation of their consent status or deletion of consent records by contacting privacy@joinalva.ai.

6.9 Ethical and Design Considerations

Alva Intelligence incorporates privacy-by-design and data-minimization principles in every aspect of cookie use. Before introducing any new tracking technology, the Product and Legal teams jointly assess whether the same function can be achieved through less intrusive means.
No cookie is implemented unless its necessity, proportionality, and compliance profile are documented and approved.

Alva Intelligence also conducts annual privacy impact assessments (PIAs) for all cookies and related technologies. These assessments evaluate:

• the risk of user re-identification;
• the scope of data collected;
• retention justifications; and
• vendor compliance with data-protection obligations.

Only cookies that pass this review remain active.

6.10 Continuous Improvement and Oversight

Cookie use is not static. As technologies evolve, Alva Intelligence continuously refines its cookie architecture to align with evolving privacy standards, including guidance from the California Privacy Protection Agency, the European Data Protection Board, and industry best practices.

The Data Protection Officer, General Counsel, and Information Security teams jointly oversee this process through the Privacy Governance Framework.
Quarterly reports are issued to executive management summarizing cookie activity, opt-out metrics, vendor status, and upcoming regulatory changes.

This ongoing commitment ensures that every cookie deployed by Alva Intelligence continues to support legitimate business goals while preserving transparency, fairness, and the highest level of privacy protection for every user.

7. Third-Party Cookies and Service Providers

7.1 Overview

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) partners with selected third-party service providers to support certain technical and functional aspects of our websites and online applications.
These providers may set or access cookies on user devices as part of their service delivery.
Third-party cookies are used only where they are necessary to operate, maintain, or improve platform performance, and they are deployed in compliance with this policy, the Privacy Policy, and applicable data-protection laws.

The purpose of this section is to explain who these third parties are, the scope of their participation, how we control and monitor their actions, and what rights users have in relation to cookies set by these providers.

7.2 Types of Third-Party Providers

Alva Intelligence engages with four main categories of third-party cookie providers:

1. Analytics and Measurement Providers – Services such as Google Analytics or similar analytics platforms used to generate statistical reports about website usage, page performance, and visitor trends.
2. Advertising and Marketing Partners – Networks or platforms like Google Ads, Meta, LinkedIn, and HubSpot that facilitate digital advertising, remarketing, and campaign performance measurement.
3. Social Media Integrations – Platforms such as YouTube, LinkedIn, or X (Twitter) that enable embedded content, social sharing, or single-sign-on authentication.
4. Infrastructure and Functional Vendors – Cloud hosting, security, and content-delivery partners that may use cookies or equivalent identifiers to ensure service continuity and network optimization.

Each third-party relationship is evaluated to determine whether cookies placed by the provider qualify as first-party (operated through Alva Intelligence’s domain) or third-party (operated independently).
Regardless of classification, every third-party cookie is subject to legal, contractual, and technical control mechanisms described in this section.

7.3 Legal and Contractual Controls

7.3.1 Data Processing Agreements

Before authorizing any third-party cookie or tracking tool, Alva Intelligence executes a Data Processing Agreement (DPA) with the vendor.
The DPA includes, at a minimum:

• Purpose limitation: The vendor may process cookie-derived data solely to provide the contracted service.
• Prohibition on resale or independent use: Vendors are barred from using cookie data for their own marketing or analytics beyond our explicit authorization.
• Security obligations: Vendors must implement administrative, technical, and physical safeguards consistent with SOC 2 Type 2 and ISO/IEC 27001 standards.
• Confidentiality: All vendor employees with access to cookie data must be bound by written confidentiality agreements.
• Subprocessor disclosure: Vendors must disclose any subprocessors and obtain prior written approval from Alva Intelligence before engaging them.
• Audit rights: Alva Intelligence retains the right to audit or obtain certifications demonstrating compliance with data-protection obligations.

These agreements ensure that cookie-related data remains under contractual control throughout its lifecycle.

7.3.2 Jurisdictional Safeguards

If a third-party provider processes cookie data outside the United States or European Economic Area, Alva Intelligence uses approved transfer mechanisms such as Standard Contractual Clauses (SCCs) under GDPR Article 46 or equivalent safeguards.
Where applicable, Transfer Impact Assessments (TIAs) are conducted to evaluate privacy risks associated with cross-border data movement.

7.4 Oversight and Vendor Due Diligence

7.4.1 Vendor Vetting

Before integration, each provider undergoes a Privacy and Security Due Diligence Assessment that evaluates:

• the provider’s privacy policy and data-retention practices;
• historical compliance record and reputation;
• existence of independent audits or certifications; and
• the provider’s responsiveness to user requests and regulator inquiries.

Providers that fail to meet Alva Intelligence’s privacy and security benchmarks are not approved for deployment.

7.4.2 Ongoing Monitoring

Approved vendors are monitored continuously through:

• automated scanning tools that detect unauthorized cookies;
• quarterly cookie audits comparing current deployments against the approved registry; and
• vendor re-certification reviews conducted annually by the DPO and Security team.

If a third-party provider is found to be setting unapproved cookies or deviating from contractual terms, Alva Intelligence immediately suspends integration and initiates remediation or termination procedures.

7.5 Examples of Authorized Third-Party Providers

This list represents typical third-party relationships as of the effective date. A full, current list is available in the Cookie Inventory (Exhibit A) and updated quarterly.

7.6 User Control and Opt-Out Mechanisms

7.6.1 Consent Management Platform (CMP)

Users can control or disable third-party cookies through the Cookie Preference Center, which operates via a certified Consent Management Platform.
When a user selects “Reject All” or disables a category of cookies, the CMP automatically prevents the associated third-party scripts from loading on the website.
Preferences are stored and honored across sessions, unless the user clears browser cookies or revisits after a policy update.

7.6.2 Global Privacy Control (GPC)

Alva Intelligence honors recognized browser-based privacy signals, including Global Privacy Control (GPC).
When a GPC signal is detected, all non-essential third-party cookies are automatically disabled, and data sharing for cross-context behavioral advertising is halted in accordance with CPRA Section 1798.135.

7.6.3 Third-Party Opt-Out Links

In addition to internal controls, users may exercise opt-outs directly through provider tools, such as:

• Google Ads Settings
• Meta Ad Preferences
• LinkedIn Advertising Opt-Out
• HubSpot Privacy Policy

These independent mechanisms operate outside Alva Intelligence’s systems but complement our own consent framework.

7.7 Data Use, Minimization, and Anonymization

All third-party data processing is governed by the principle of data minimization.
Only the information necessary to fulfill the service’s technical or analytical purpose is transmitted.
For example:

• Analytics identifiers are pseudonymous random strings, not personal names or email addresses.
• IP addresses are truncated before storage wherever feasible.
• No precise geolocation, sensitive, or financial data is transferred via third-party cookies.
• Aggregated reporting replaces raw data retention once processing is complete.

Third-party providers are required to confirm deletion of temporary datasets after analytical processing.

7.8 Cross-Domain and Cross-Service Data Sharing

Some third-party providers operate across multiple websites or applications.
When Alva Intelligence integrates with such networks, we configure them to operate in restricted scope meaning they cannot use data collected from our domain to profile users on unrelated websites.

We enforce this restriction through:

• cookie-domain isolation (limiting the scope of cookies to joinalva.ai);
• explicit deactivation of cross-site tracking in vendor settings; and
• audit verification through browser developer tools and third-party compliance scanners.

Under CPRA, any remaining cross-context activity is treated as “sharing,” subject to opt-out rights.

7.9 Recordkeeping and Accountability

To meet regulatory and contractual accountability requirements, Alva Intelligence maintains a Third-Party Cookie Register, which includes:

• provider name and contact details;
• cookie names and types deployed;
• purpose and lawful basis;
• retention period;
• date of last review and approval;
• reference to DPA and transfer mechanism; and
• proof of consent (where applicable).

The register is maintained by the DPO and reviewed quarterly. Records are retained for at least five (5) years as evidence of compliance with GDPR Article 30 and CPRA Section 1798.130(a)(6)(C).

7.10 Enforcement and Remedies

If any third-party provider violates contractual or regulatory requirements related to cookie data, Alva Intelligence will:

1. Suspend data transfers to the provider immediately;
2. Conduct a remediation review and require corrective actions;
3. Notify affected users and regulators where legally required; and
4. Terminate the provider relationship if compliance cannot be restored.

Alva Intelligence has never sold personal data and will not authorize any third-party provider to use cookie-collected data for resale, profiling, or any form of secondary marketing.

7.11 Consumer Rights and Regulatory Transparency

Users may contact privacy@joinalva.ai to obtain a current list of active third-party providers and their respective data-processing activities. Requests are typically fulfilled within 30 days, consistent with CPRA and GDPR timelines. Alva Intelligence will also cooperate with any lawful requests from regulatory authorities concerning third-party cookie disclosures and compliance documentation.

7.12 Assurance of Responsible Vendor Management

Through robust due diligence, contractual restrictions, technical enforcement, and transparent reporting, Alva Intelligence ensures that third-party cookies operate solely within authorized parameters and that no external entity may process personal information obtained through our Sites for its own purposes.

This disciplined vendor-management program reflects Alva Intelligence’s commitment to ethical data stewardship, accountability, and compliance with the highest global privacy standards.

8. Use of Cookies for Personalization and AI Enhancement

8.1 Overview

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) employs cookies and comparable tracking technologies not only to deliver core platform functionality but also to enhance the intelligence, accuracy, and personalization of its products and services.
This section describes how cookie-collected data supports artificial intelligence (AI) models, user personalization, and feature optimization, while ensuring compliance with data-protection laws such as the California Privacy Rights Act (CPRA), the General Data Protection Regulation (GDPR), and recognized ethical AI frameworks.

AI enhancement through cookie data operates exclusively within a privacy-by-design and data-minimization framework. All data used for model training or personalization is aggregated, pseudonymized, and processed under strict internal governance protocols that ensure no personal data is used for automated decision-making that produces legal or similarly significant effects.

8.2 Lawful Basis and Governance Principles

The processing of cookie-derived data for personalization and AI improvement is conducted under the following principles:

1. Purpose Limitation: Cookie data is used only for product improvement and personalization of user experience within the Alva Intelligence ecosystem.
2. Data Minimization: Only data necessary to achieve predictive accuracy or usability enhancement is included in AI model training.
3. Transparency: Users are informed about cookie-based personalization at or before the point of data collection, with the ability to modify or withdraw consent.
4. Non-Discrimination: Refusal or withdrawal of consent does not result in denial of service or reduced functionality beyond the natural impact of disabled personalization features.
5. Ethical AI Practices: All AI models trained using cookie-derived data undergo bias testing, fairness validation, and data-quality assessment before deployment.

The lawful bases for processing include consent (for EU/EEA users and where CPRA defines the use as “sharing”) and legitimate interest (for aggregated analytics that improve service performance without personal profiling).

8.3 Types of Data Used for Personalization

The data derived from cookies that may be used to enhance personalization or AI systems includes:

• Usage patterns: Frequency and sequence of page visits, feature interactions, and dwell times.
• Interface preferences: Selected language, region, dashboard configuration, and theme mode.
• Engagement metrics: Click rates, response times, and navigation flows within the user interface.
• Performance data: Load times, latency, and device types, used to optimize service responsiveness.
• Lead quality indicators (business users only): Aggregated behavioral patterns that inform product recommendations or automated scoring for enterprise analytics.

At all times, this data remains pseudonymous and is decoupled from direct personal identifiers.
Where cookie identifiers are linked to authenticated users for account continuity, the data is subject to strict role-based access controls and encrypted both in transit and at rest.

8.4 Use in AI-Driven Product Enhancement

8.4.1 Model Training and Optimization

Alva Intelligence uses aggregated cookie-based telemetry to refine internal AI models that power features such as lead-generation intelligence, search result ranking, predictive analytics dashboards, and content relevance optimization. These models rely on de-identified behavioral data, not raw personal data. Data pipelines are configured to anonymize identifiers prior to ingestion into machine-learning environments.

The AI systems process metrics such as page loading efficiency, feature adoption rates, and anonymized engagement sequences to predict how users interact with content. This feedback loop allows Alva Intelligence to improve product performance and deliver relevant insights to enterprise clients without profiling individuals.

8.4.2 Algorithmic Transparency and Documentation

Each AI model trained with cookie-related data includes documentation of:

• data sources and categories used;
• preprocessing and anonymization methods;
• model purpose and expected benefit;
• bias detection and correction procedures; and
• retention and deletion schedule for training datasets.

This documentation is reviewed semiannually by the Data Protection Officer (DPO) and the AI Governance Committee, ensuring accountability and compliance with emerging AI regulatory standards.

8.5 Personalization for User Experience

8.5.1 Overview

Cookies are also used to personalize the individual user experience in ways that are transparent, non-intrusive, and user-controlled. Personalization aims to make navigation intuitive, reduce redundant steps, and ensure that the interface adapts to a user’s known preferences or past interactions.

8.5.2 Examples of Personalization

• Remembering the last active workspace or module a user interacted with.
• Displaying recommended resources based on prior visits.
• Adjusting interface layout to emphasize frequently used functions.
• Suggesting relevant content or help articles in real time.
• Providing intelligent auto-completion or form suggestions for recurring tasks.

Personalization cookies are not used to infer sensitive traits or behavioral profiles. They enhance usability and operational efficiency while preserving privacy.

8.5.3 User Control

Users can opt out of personalization at any time through the Cookie Preference Center or by disabling functional and analytics cookies in their browser. When personalization is disabled, Alva Intelligence defaults to a neutral configuration that functions identically for all users.

8.6 Anonymization and Data Security

8.6.1 Anonymization Techniques

Before cookie data is used in analytics or AI training, it undergoes a rigorous anonymization process that includes:

• Hashing and Tokenization: Replacing identifiers with irreversible hashes or random tokens.
• Aggregation: Combining datasets into group-level summaries to prevent re-identification.
• Noise Injection: Applying differential-privacy techniques to mask individual behaviors while preserving analytical value.
• Segmentation Thresholds: Excluding datasets with fewer than a defined number of users to eliminate singular identification.

These methods ensure that cookie-derived data cannot be re-linked to identifiable individuals, even within internal systems.

8.6.2 Data Security Measures

All cookie data used for personalization or AI purposes is protected through multiple layers of security:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for data in transit.
• Access Control: Role-based access enforced through centralized identity management.
• Segregation: AI development environments are isolated from production databases.
• Monitoring: Continuous auditing and anomaly detection on data access logs.

Any access to AI or personalization data is logged, reviewed, and periodically audited under SOC 2 Type 2 controls.

8.7 Consent and Transparency

8.7.1 Obtaining Consent

Alva Intelligence obtains consent for cookies used in personalization or AI functions through a layered consent interface that includes:

1. A clear explanation in the Cookie Banner describing the purpose of AI and personalization cookies.
2. Detailed breakdowns within the Cookie Preference Center allowing users to opt in or out by category.
3. A link to this Cookie Policy and the Privacy Policy for further detail.
4. Records of consent stored for five years for audit and compliance verification.

Consent is collected prior to setting non-essential cookies and may be withdrawn at any time without affecting access to core services.

8.7.2 Transparency and User Notice

Whenever a new AI-driven feature uses cookie data, Alva Intelligence provides a transparent disclosure in the product interface or policy updates.
We also maintain a “Personalization and AI Practices” page that explains which features rely on cookie-based analytics and what safeguards apply.

8.8 Ethical Boundaries and Restrictions

Alva Intelligence expressly prohibits the use of cookie-derived data for:

• profiling individuals to predict or influence personal behavior;
• automated decision-making with legal or comparable effects;
• inferring sensitive attributes such as race, religion, sexual orientation, or health status;
• discriminatory model training or targeting; and
• selling or sharing cookie-based data with third parties for commercial gain.

All cookie-based personalization remains contextual, operational, and user-centric.
AI enhancement operates within defined ethical and legal constraints that prioritize fairness, explainability, and accountability.

8.9 Retention and Deletion of AI-Derived Data

Cookie-derived datasets used in AI systems are retained only as long as necessary to achieve the training or testing objective. Retention periods are documented in the Data Retention and Deletion Policy and follow the principles outlined in Section 17 of the Privacy Policy.
When a dataset is retired:

• identifiers are permanently deleted;
• derived model parameters are preserved only in aggregate form; and
• an internal Data Deletion Certificate is logged in the compliance repository.

This ensures that data lifecycle management extends beyond cookies to all derivative uses.

8.10 Audit and Continuous Oversight

The AI Governance Committee, composed of the Data Protection Officer, General Counsel, and Chief Technology Officer, reviews all personalization and AI activities that rely on cookie data.
Audits verify that:

• only approved cookie categories are used for personalization or AI;
• data is processed in compliance with consent choices;
• anonymization protocols remain effective; and
• ethical guidelines are continuously met.

Findings are documented in the Annual Privacy and AI Compliance Report, which forms part of Alva Intelligence’s SOC 2 Type 2 and GDPR accountability evidence.

8.11 Assurance of Responsible AI Use

By combining robust anonymization, strict consent controls, and ethical governance, Alva Intelligence ensures that the use of cookie-derived data for personalization and AI development remains both responsible and transparent.
Our goal is to improve efficiency, relevance, and user experience without ever compromising individual privacy or autonomy.

This integration of compliance, security, and innovation represents the core of Alva Intelligence’s approach to trustworthy artificial intelligence.

9. Cookie Duration, Expiration, and Retention Controls

9.1 Purpose and Overview

The management of cookie duration and retention is central to Alva Intelligence LLC’s (“Alva Intelligence,” “we,” or “our”) data-protection governance. Cookies are not retained indefinitely; each category has a predetermined expiration period aligned with its operational necessity and legal requirements. This section outlines how we define, monitor, and enforce these lifecycles to maintain transparency, accountability, and compliance.

Alva Intelligence distinguishes between cookie duration (the time a cookie remains on a user’s device) and data retention (the time related records remain stored on Alva Intelligence’s servers or with approved processors).

Both are governed by clear schedules and automated controls to ensure data is held no longer than necessary.

9.2 Classification of Duration Types

9.2.1 Session Cookies

Session cookies are temporary identifiers created when a user visits our website or accesses our platform. They enable essential functions such as authentication, page navigation, and secure transmission of form data. These cookies are deleted automatically once the browser is closed or the session expires.

Duration: Active only during the user’s browsing session (typically less than 24 hours).
Examples: auth_session_id, csrftoken, session_id.

9.2.2 Persistent Cookies

Persistent cookies remain stored on the user’s device beyond the current browsing session.
They are used to remember login preferences, language settings, and consent choices or to provide long-term analytics insights in aggregated form.

Each persistent cookie is configured with a defined expiration date.
Once expired, the cookie becomes inactive and is automatically deleted by the browser or upon a user’s manual clearing of cookies.

Duration: Typically 30 days to 24 months, depending on purpose and consent type.
Examples: _ga, _fbp, cookieConsentStatus, policy_version_recorded.

9.2.3 Third-Party Cookies

Third-party cookies are deployed by external service providers integrated into Alva Intelligence’s systems, such as analytics or marketing tools. These cookies are subject to the provider’s retention policies, but Alva Intelligence imposes additional limits through contractual terms and periodic audits.

Duration: Governed by provider settings (commonly 30–90 days).
Examples: hubspotutk, _gcl_au, li_oatml.

9.3 Duration Policy by Category

This matrix reflects the default retention plan across all web properties managed by Alva Intelligence as of the effective date. All durations are subject to review and update in response to changes in regulatory or operational requirements.

9.4 Retention of Cookie-Derived Data

Cookie-derived data refers to information collected or generated from cookies that is processed and stored within Alva Intelligence’s systems or secure cloud infrastructure.
The retention of this data follows the same minimization principle applied to cookies themselves.

9.4.1 Analytics and Performance Data

• Aggregated metrics (e.g., traffic volume, session counts) are retained for 12 to 24 months for trend analysis.
• Raw logs containing pseudonymized identifiers are retained for no longer than 90 days before aggregation or deletion.
• After aggregation, data is anonymized and retained indefinitely for statistical reporting only.

9.4.2 Functional and Preference Data

• Stored configurations (e.g., language, layout) are retained for up to 12 months to maintain user experience continuity.
• Consent preference logs are retained for five years under CPRA and GDPR accountability obligations.
• Once deleted or expired, no residual data can re-identify the user.

9.4.3 Advertising and Marketing Data

• Conversion and attribution logs are stored for up to 90 days following a campaign.
• After 90 days, all user-level identifiers are purged and replaced with aggregated conversion statistics.
• Reports stored for business intelligence purposes contain no cookie IDs or personal information.

9.5 Retention Enforcement Mechanisms

9.5.1 Automated Expiration Controls

Alva Intelligence uses automated expiration mechanisms to enforce cookie lifecycles. Each cookie set by our systems includes a max-age attribute, which instructs browsers to delete the cookie automatically after a defined period. Server-side systems monitor and flag expired cookies for deletion.

9.5.2 Scheduled Purge Routines

Every 24 hours, automated purge jobs run within Alva Intelligence’s analytics and marketing databases to remove expired or deactivated cookie records. A retention-control dashboard alerts administrators to anomalies or missed deletions.

9.5.3 Consent-Based Purging

When a user withdraws consent or opts out of a cookie category, the system immediately triggers the deletion of corresponding cookies and disables related scripts. If withdrawal affects stored analytics data, identifiers associated with that user’s records are pseudonymized or purged.

9.5.4 Manual Oversight

The Data Protection Officer (DPO) and the Security Compliance Team conduct quarterly reviews to verify that expiration controls are functioning as designed.
Audit logs record all deletions, with sample testing to ensure proper execution.

9.6 Storage Limitation and Legal Compliance

Alva Intelligence adheres to the storage limitation principle of GDPR Article 5(1)(e) and the data retention restriction under CPRA Section 1798.100(a)(3). Data collected through cookies is kept only for as long as necessary to fulfill the purpose for which it was collected.
When retention periods expire, data is securely erased or permanently anonymized in accordance with the Data Deletion and Disposal Policy.

Where applicable, data destruction processes comply with NIST SP 800-88 Rev. 1 media sanitization guidelines, ensuring irreversible deletion.

9.7 Retention in Special Circumstances

In limited cases, certain cookie-derived records may be retained beyond standard periods for compliance, legal defense, or audit obligations.
Such retention occurs only under the following conditions:

1. Regulatory Obligations: Where law or regulatory inquiries require temporary retention beyond standard limits.
2. Litigation Hold: Where data is subject to a legal hold in ongoing or anticipated litigation.
3. Security Investigation: Where data is required to complete an internal or external investigation into cybersecurity incidents or policy violations.

Once such obligations expire, the retained data is deleted immediately under supervision of the Legal and Security departments.

9.8 Cross-System Synchronization

Alva Intelligence operates multiple systems (marketing, analytics, and application environments). To maintain consistency, retention and expiration settings are synchronized across all platforms via the Central Data Governance Engine. This automation ensures that expiration schedules are uniformly applied regardless of where data resides.
If a cookie or identifier is deleted in one system, references in associated systems are flagged and purged in the next scheduled cycle.

9.9 Deletion Verification and Audit Trails

All deletion events are logged with:

• timestamp;
• system identifier;
• data category;
• record count affected; and
• confirmation of completion.

Logs are retained for five years for audit purposes and reviewed annually as part of the SOC 2 Type 2 and GDPR accountability framework. Alva Intelligence’s privacy team maintains the authority to validate that data destruction processes are technically effective and compliant.

9.10 Consumer Rights and Retention Transparency

Users have the right to:

• request confirmation of whether cookie-derived data is still held;
• request access to anonymized or aggregated data summaries;
• request early deletion of cookie-related data; and
• receive confirmation of data erasure once executed.

Requests can be submitted through the Privacy Rights Portal or by email to privacy@joinalva.ai.
Responses are provided within 30 days, extendable under statutory allowances.
These rights are honored without prejudice or discrimination against the requester.

9.11 Policy Review and Continuous Improvement

The retention and expiration controls defined herein are reviewed annually or whenever there is a material change in data processing, technology, or applicable law. Alva Intelligence maintains an internal Data Retention Register documenting all categories of cookies, their respective durations, and deletion mechanisms. This register is approved and signed by the DPO and General Counsel during the annual compliance cycle.

Periodic revalidation of cookie lifecycles ensures continuing compliance, operational integrity, and alignment with evolving privacy standards worldwide.

10. User Consent, Control, and Withdrawal Mechanisms

10.1 Purpose and Importance of Consent

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) believes that privacy begins with informed choice. The collection and use of cookies and similar technologies on our websites and applications operate on a foundation of user consent clear, affirmative, and fully revocable at any time. This section outlines how we obtain, record, and respect consent, as well as how users can modify or withdraw it through accessible tools and standardized privacy controls.

Consent management is not a formality but a fundamental compliance requirement.
Under the General Data Protection Regulation (GDPR) and the California Privacy Rights Act (CPRA), organizations must ensure that users are both informed about and in control of non-essential cookies.
Alva Intelligence implements consent in accordance with these principles to guarantee that our users can make autonomous, transparent, and privacy-protective decisions.

10.2 Types of Consent

10.2.1 Explicit Consent

Explicit consent is obtained where required by law before setting any cookie that is not strictly necessary for service operation.
This includes analytics, advertising, and personalization cookies. Explicit consent is collected through the Cookie Banner and Cookie Preference Center, which allow users to make granular selections by category.

A cookie is not deployed until the user takes affirmative action, such as clicking “Accept All” or toggling specific categories to “Enabled.” No cookie banner employs pre-ticked boxes or implied acceptance.

10.2.2 Implied or Legitimate Interest Consent

For cookies essential to core functionality (authentication, security, or network performance), Alva Intelligence relies on legitimate interest or contract necessity rather than explicit consent. These cookies are disclosed for transparency, but no user action is required to enable them.

The rationale for legitimate interest is documented in the Legitimate Interest Assessment Register, maintained by the Data Protection Officer (DPO).

10.3 Consent Collection Interface

10.3.1 Cookie Banner

When a user first visits any Alva Intelligence digital property, a Cookie Banner appears, presenting:

1. A plain-language explanation of the purpose of cookies;
2. A summary of cookie categories with links to further details;
3. Options to Accept All, Reject All, or Customize Settings; and
4. A link to the full Cookie Policy and Privacy Policy.

The banner remains visible until the user makes a selection. Refusing cookies has no impact on access to core site functions, but certain features may operate in a limited manner.

10.3.2 Cookie Preference Center

The Cookie Preference Center allows users to fine-tune their preferences at any time.
It presents cookies grouped by category Strictly Necessary, Functional, Analytics, Advertising, Social Media, and Preference Management with toggles for activation or deactivation.

Once the user submits their choice, a consent confirmation message appears and a consent record is stored locally (via the cmp_consent_id cookie) and within Alva Intelligence’s compliance system for audit purposes.

10.3.3 Layered Consent Model

Alva Intelligence uses a layered consent framework that separates essential notices from optional detail. The first layer provides essential information in concise form, while secondary layers include full legal explanations, provider lists, and retention timelines. This structure ensures that consent remains informed yet accessible.

10.4 Recording and Management of Consent

10.4.1 Consent Records

Every consent action is logged with the following attributes:

• unique consent identifier (CMP ID);
• timestamp of the user’s decision;
• categories accepted or rejected;
• version of the Cookie Policy applicable at the time;
• jurisdiction of the user (for regional compliance); and
• browser and device identifiers (pseudonymized).

These records are stored securely in the Consent Management Database for a minimum of five years. Records enable Alva Intelligence to demonstrate compliance with GDPR Article 7(1) and CPRA Section 1798.100(d).

10.4.2 Synchronization Across Devices

If a user is logged into their Alva Intelligence account, consent preferences synchronize across all devices and browsers. This ensures consistent enforcement regardless of access point or platform. Synchronization is achieved using encrypted tokens stored in both local cookies and secure cloud storage.

10.4.3 Version Control

Each version of the Cookie Policy is assigned a unique identifier and effective date.
When substantive changes occur, all users are prompted to reconfirm consent.
If users do not respond within a reasonable period (typically 30 days), only strictly necessary cookies remain active.

10.5 Consent Withdrawal and Modification

10.5.1 Right to Withdraw

Users may withdraw consent at any time through any of the following methods:

1. Accessing the Cookie Preference Center via the persistent footer link on all pages.
2. Adjusting browser settings to block or delete cookies.
3. Submitting a request through the Privacy Rights Portal or by email to privacy@joinalva.ai.
4. Using browser-based privacy signals such as Global Privacy Control (GPC), which Alva Intelligence fully honors.

Withdrawal of consent results in immediate deactivation of all non-essential cookies and associated processing.

10.5.2 Technical Implementation of Withdrawal

When a withdrawal request is received:

• All active non-essential cookies are deleted from the user’s browser;
• The corresponding consent record is updated to “Withdrawn”;
• Data pipelines connected to analytics or marketing tools are disabled for that user; and
• Any cookie-derived records that remain within internal systems are pseudonymized or erased within 30 days.

This ensures that consent withdrawal is both effective and technically verifiable.

10.5.3 Partial Withdrawal

Users may selectively withdraw consent for specific categories (e.g., advertising or analytics) without affecting others. The Cookie Preference Center supports granular toggling for this purpose. Systems respond dynamically to such changes in real time.

10.6 Global Privacy Control (GPC) and Universal Opt-Out Signals

Alva Intelligence supports Global Privacy Control (GPC), Do Not Track (DNT), and similar recognized privacy signals. When a supported signal is detected, our systems automatically interpret it as a universal opt-out request for all non-essential cookies, including advertising and cross-context tracking.
The system then:

• suppresses the loading of affected scripts;
• deletes corresponding cookies; and
• records the opt-out event in the compliance database for proof of action.

This functionality ensures compliance with CPRA Section 1798.135 and similar global frameworks.

10.7 Browser and Device-Level Controls

Users may also manage cookies directly through browser settings.
Most browsers allow blocking, deletion, or notification prior to cookie placement.
Instructions are available on the official support pages for:

• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Safari (macOS and iOS)
• Opera

For mobile applications, operating systems provide settings under “Privacy” or “Tracking” that allow users to disable identifiers and cookies used for analytics or advertising.

Alva Intelligence’s platform detects these preferences and automatically honors them.

10.8 Evidence of Consent and Regulatory Cooperation

10.8.1 Proof of Consent

Upon lawful request by a data protection authority or user, Alva Intelligence can produce verifiable proof of consent or withdrawal, including:

• consent ID;
• timestamp;
• categories accepted or declined;
• method of collection (banner, preference center, GPC); and
• policy version.

These records are digitally signed and stored in compliance with SOC 2 Type 2 requirements for integrity and authenticity.

10.8.2 Cooperation with Authorities

Alva Intelligence cooperates fully with privacy regulators, including the California Privacy Protection Agency (CPPA), the European Data Protection Board (EDPB), and national data-protection authorities. If a complaint or inquiry arises regarding cookie consent, Alva Intelligence provides documentation within 15 business days, along with an explanation of the consent collection process.

10.9 Consent Lifecycle and Review

Consent mechanisms are reviewed semiannually as part of the Privacy Program Oversight Cycle.
The review includes:

• assessment of clarity and accessibility of consent interfaces;
• verification of lawful bases for all cookies in use;
• technical testing of opt-out effectiveness; and
• user feedback analysis to improve transparency.

Revisions to consent processes are documented in the Consent Management Register and approved by the DPO and General Counsel prior to implementation.

10.10 Assurance of User Control

Alva Intelligence ensures that users remain at the center of consent management.
Every cookie placement or withdrawal honors the user’s choices, supported by verifiable technical enforcement, transparent documentation, and continuous accountability.
No form of consent manipulation such as dark patterns, pre-ticked options, or forced acceptance is tolerated.

Through layered consent, accessible tools, and global privacy compliance, Alva Intelligence guarantees that cookie usage is always guided by user intention and aligned with our foundational principle: data control belongs to the user.

11. Children’s Data and Parental Consent for Cookies

11.1 Purpose and Commitment

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) recognizes the importance of protecting the privacy of children and young users.
Our cookie practices are designed to ensure that no data collected through cookies or similar tracking technologies is used to identify, track, or profile minors.
This section outlines our policy for handling cookies in connection with users under the age of 16, the mechanisms used to obtain verifiable parental consent when required, and the controls we maintain to prevent inadvertent data collection from minors.

We adhere strictly to the principles set forth in:

• The Children’s Online Privacy Protection Act (COPPA) for users under 13 in the United States;
• Article 8 of the General Data Protection Regulation (GDPR) and corresponding EU member-state implementations for children under 16 (or a lower age set by local law, but not below 13); and
• California Privacy Rights Act (CPRA) provisions concerning the sale or sharing of personal information of consumers under 16.

Our systems, procedures, and contractual arrangements are designed to uphold these standards across all jurisdictions in which we operate.

11.2 Applicability

This section applies to:

1. All Alva Intelligence websites, applications, and services accessible to general audiences;
2. Any Alva Intelligence feature or integration that may be accessible to minors; and
3. Cookies or equivalent technologies that may collect data such as IP addresses, device identifiers, or online usage patterns from devices used by individuals under the age of 16.

Alva Intelligence’s services are not directed to children under the age of 13, and we do not knowingly allow registration or account creation by such individuals. In the rare event that data is inadvertently collected from a minor, Alva Intelligence acts promptly to delete such data in accordance with Section 11.8 below.

11.3 Age-Gating and Verification Mechanisms

11.3.1 Initial Access Gate

To minimize the risk of data collection from minors, Alva Intelligence employs age-gating mechanisms on all platforms where user input or account creation is required.
Visitors may be asked to confirm their age or acknowledge that they are over the minimum digital consent age before accessing certain features.
Cookies are not deployed beyond strictly necessary session cookies until this age verification step is completed.

11.3.2 Parental Verification (Where Required)

If a user self-identifies as under the applicable age threshold (under 16 in the EU, under 13 in the US), Alva Intelligence requires verifiable parental consent before enabling any cookies beyond those strictly necessary for security and functionality.
Verification may involve one or more of the following methods:

• Submission of a signed consent form by a parent or guardian;
• Provision of a valid payment card number or other verifiable parental identifier;
• Confirmatory contact with the parent via verified email or phone; or
• Cross-verification through a third-party parental consent service provider under contract with Alva Intelligence.

Until consent is verified, non-essential cookies (analytics, advertising, or personalization) remain fully disabled.

11.4 Cookie Restrictions for Minors

11.4.1 Strict Limitation of Cookie Use

For users identified as minors:

• Only strictly necessary cookies are permitted (e.g., session identifiers, security tokens).
• Analytics, advertising, or personalization cookies are never activated, even with parental consent, unless explicitly necessary for an educational or functional feature directly related to the service requested by the user.
• Any data collected is used solely for functionality and not for profiling or marketing.

11.4.2 No Cross-Context Behavioral Tracking

Alva Intelligence strictly prohibits the use of cookies for cross-context behavioral advertising involving minors. No cookie or identifier associated with a minor’s device is used for remarketing, retargeting, or data enrichment in any marketing database.

11.4.3 No Data Sale or Sharing

In accordance with CPRA Section 1798.120(c), Alva Intelligence does not sell or share the personal information of minors under 16. This restriction is enforced at both technical and policy levels, and it applies equally to all affiliates, subprocessors, and marketing partners.

11.5 Parental Consent Process

11.5.1 Parental Rights

Parents or legal guardians of minors whose data may be collected in limited circumstances retain full rights to:

• review the categories of cookies and data collected from the minor’s device;
• request deletion of any such data;
• withdraw consent for future processing; and
• restrict or revoke participation in any feature requiring cookie-based functionality.

Requests may be made via the Parental Consent Portal or by contacting privacy@joinalva.ai. Verification of parental identity is required before any action is taken to protect against unauthorized access.

11.5.2 Verification and Recordkeeping

Each parental consent record includes:

• parent or guardian’s verified identity (name, contact information);
• date and method of consent verification;
• minor’s pseudonymous identifier;
• specific cookies or functions authorized; and
• policy version in effect at the time of consent.

Records are stored securely and encrypted in accordance with COPPA Section 312.5(d) and retained for five years to demonstrate compliance.

11.6 Regional Variations

11.6.1 European Union and EEA

Under GDPR Article 8, member states may set a digital consent age between 13 and 16.
Alva Intelligence maintains a dynamic age matrix based on IP-derived jurisdiction, ensuring the correct threshold is applied automatically. If parental consent is required, the system restricts all non-essential cookies until confirmation is received.

11.6.2 United States

Under COPPA, the default digital consent age is 13. Alva Intelligence does not knowingly collect personal information from children under 13, and all cookie-related data collection mechanisms are disabled for such users unless parental consent is obtained through a COPPA-compliant process.

11.6.3 United Kingdom and Canada

In the United Kingdom, the consent age is 13 under the Data Protection Act 2018.
In Canada, under PIPEDA guidance, meaningful consent requires understanding by the user, typically presumed at 13 or older. Accordingly, Alva Intelligence aligns its cookie behavior and parental-consent standards with these thresholds.

11.7 Technical Controls for Compliance

To ensure enforcement of these restrictions, Alva Intelligence integrates the following controls:

1. Age-Based Cookie Blocking: Non-essential cookie scripts are programmatically disabled upon age verification indicating a minor.
2. Segregated Cookie Registry: A dedicated registry ensures that cookies are classified by allowable age group.
3. Anonymized Session Management: Session cookies for minors contain no identifiable data and expire upon browser closure.
4. Automatic Consent Reset: Parental consent expires automatically after 12 months unless renewed.
5. Periodic Audit: The Privacy and Security teams jointly audit minor-related cookie processes at least once per year.

All technical safeguards are documented in the Children’s Data Compliance Manual, which forms part of Alva Intelligence’s SOC 2 and GDPR accountability documentation.

11.8 Deletion of Minor Data

If Alva Intelligence discovers that cookie data or related personal information has been collected from a minor without proper consent:

1. The data is immediately flagged for deletion;
2. All cookies associated with the session or device are invalidated;
3. The parent or guardian is notified where identifiable contact information is available;
4. Confirmation of deletion is recorded in the Data Erasure Log.

Deletion is completed within 72 hours of verification unless extended for legal or forensic reasons. This protocol aligns with the COPPA Rule (16 C.F.R. § 312.10) and GDPR’s right to erasure.

11.9 Parental and Minor Education

Alva Intelligence promotes awareness among parents and young users regarding online privacy and responsible data practices.
Educational materials are made available on our website under the “Privacy for Families” section, explaining:

• what cookies are and how they function;
• how parents can monitor or limit cookie use; and
• how to exercise privacy rights effectively.

This initiative reflects our belief that informed participation strengthens privacy protection and compliance integrity.

11.10 Ongoing Oversight and Accountability

Compliance with this section is monitored by the Data Protection Officer (DPO) and the Child Data Oversight Committee, which reports to the General Counsel and Chief Compliance Officer.
Their responsibilities include:

• ensuring all age-gating and consent-verification tools function properly;
• maintaining up-to-date jurisdictional mappings;
• verifying annual audit completion; and
• responding promptly to parental or regulator inquiries.

Alva Intelligence also participates in third-party privacy-certification programs where available, reaffirming its commitment to protecting children’s data and maintaining global compliance.

11.11 Statement of Commitment

Alva Intelligence reaffirms that it does not, and will not, intentionally use cookies or related technologies to collect personal data from children for commercial purposes.
Our objective is to provide a secure, privacy-respecting environment for all users while ensuring compliance with the world’s most rigorous child data-protection standards.

12. International Data Transfers and Cross-Border Cookie Data Handling

12.1 Purpose and Scope

This section explains how Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) manages the transfer and processing of cookie-related data across national borders.
Because Alva Intelligence operates globally, certain cookie data may be processed, transmitted, or accessed from jurisdictions outside the user’s country of residence.
These transfers occur in accordance with strict legal safeguards, approved transfer mechanisms, and documented internal procedures that ensure equivalent levels of privacy protection regardless of where the data resides.

The principles governing cross-border cookie data handling apply to all cookies and similar technologies deployed on Alva Intelligence’s websites, applications, and third-party integrations, including those used for analytics, personalization, and compliance management.

12.2 Legal Basis for International Transfers

Alva Intelligence transfers cookie-derived data internationally only when one of the following lawful bases applies:

1. Adequacy Decision: The European Commission or UK Secretary of State has recognized the destination country as providing an adequate level of data protection.
2. Standard Contractual Clauses (SCCs): When transferring data to a country without an adequacy decision, Alva Intelligence enters into the European Commission’s approved SCCs (2021/914/EU) or their UK equivalents.
3. Binding Corporate Rules (BCRs): Internal transfers between Alva Intelligence entities are governed by approved BCRs ensuring uniform privacy standards.
4. Data Privacy Framework (DPF): Transfers to certified U.S. entities rely on the EU-U.S. and UK-U.S. Data Privacy Frameworks, administered by the U.S. Department of Commerce.
5. Explicit Consent: In exceptional cases, a user may explicitly consent to a specific transfer after being informed of the risks involved.

Transfers under any of these bases are documented in the International Data Transfer Register maintained by the Data Protection Officer (DPO).

12.3 Categories of Cookie Data Subject to Transfer

The types of cookie-related data that may be transmitted internationally include:

• pseudonymous identifiers (e.g., cookie IDs, device IDs);
• browser metadata and connection diagnostics;
• analytics event logs aggregated by region;
• consent preference records for global consistency;
• limited marketing attribution metrics (for business users); and
• security tokens required for platform protection.

No sensitive categories of data such as racial, biometric, financial, or health information are transferred through cookies. All data involved in transfers is anonymized or pseudonymized prior to export whenever technically feasible.

12.4 Transfer Mechanisms and Safeguards

12.4.1 Standard Contractual Clauses (SCCs)

When Alva Intelligence transmits cookie data to vendors or affiliates located in jurisdictions without an adequacy decision, SCCs are executed to ensure lawful transfer.
The SCCs establish contractual obligations for recipients, including:

• limiting data use solely to specified purposes;
• implementing equivalent technical and organizational measures;
• notifying Alva Intelligence of any government access requests; and
• permitting audit or inspection upon request.

Supplemental measures such as encryption, pseudonymization, and network isolation are applied in accordance with EDPB Recommendations 01/2020 to guarantee an equivalent level of protection.

12.4.2 EU-U.S. Data Privacy Framework

For transfers to U.S. service providers certified under the EU-U.S. Data Privacy Framework (and UK extension), Alva Intelligence confirms certification status annually and maintains contractual commitments aligned with the DPF Principles of Notice, Choice, Accountability, Security, and Recourse.

12.4.3 Binding Corporate Rules (BCRs)

Internal transfers among Alva Intelligence’s subsidiaries and affiliated entities are governed by Binding Corporate Rules approved by relevant supervisory authorities.
These rules require all group members to adhere to uniform privacy standards and provide enforceable rights for data subjects.

12.5 Technical and Organizational Measures for Cross-Border Security

All international transfers of cookie-derived data are protected by layered technical and organizational safeguards designed to ensure confidentiality, integrity, and availability.

Technical Controls:

• End-to-end encryption during transmission using TLS 1.3.
• Encryption at rest using AES-256 standards.
• Key management through Hardware Security Modules (HSMs).
• Strict access controls based on role and region.
• Logging and monitoring of all transfer events.

Organizational Controls:

• Mandatory data-protection training for all employees handling transfer operations.
• Pre-transfer risk assessments and transfer-impact documentation.
• Vendor compliance attestations reviewed quarterly.
• Incident response plans incorporating international notification requirements.

These measures are validated as part of Alva Intelligence’s SOC 2 Type 2 certification and reviewed annually under its GDPR compliance audit program.

12.6 Transfer Impact Assessments (TIAs)

Before initiating any new data transfer outside the EEA, UK, or Switzerland, Alva Intelligence performs a Transfer Impact Assessment evaluating:

1. the legal and regulatory environment of the destination country;
2. the likelihood and scope of government access to data;
3. the provider’s transparency and redress mechanisms;
4. technical measures ensuring effective protection; and
5. residual risks and mitigation strategies.

TIAs are retained for five years and updated whenever a transfer scope changes or new guidance is issued by supervisory authorities. If risks cannot be mitigated to an acceptable level, the transfer is halted or an alternative hosting arrangement is implemented.

12.7 Cross-Border Data Flow with Third-Party Providers

Third-party vendors, such as analytics or advertising partners, may process cookie data outside the user’s country of residence.
To ensure compliance:

• Each provider must execute Alva Intelligence’s DPA and SCCs or demonstrate valid certification under an adequacy framework.
• Providers must process data only within approved subprocessor regions listed in the Vendor Subprocessing Register.
• Transfers are continuously monitored via automated vendor-risk dashboards and verified by the DPO.
• Providers must delete all transferred cookie data upon contract termination or at Alva Intelligence’s written request.

No third-party vendor is permitted to conduct onward transfers without prior authorization and equivalent safeguards.

12.8 Storage Location and Regional Segmentation

To minimize unnecessary cross-border flow, Alva Intelligence practices data localization wherever feasible:

• Cookie-derived analytics from EU/EEA users are processed and stored within the European Union through regional data centers.
• U.S. and Canadian user data remains within North America.
• Asia-Pacific operations use local data centers under contractual compliance with the APEC Cross-Border Privacy Rules (CBPR) framework.

Replication or backup of cookie data across regions is restricted to anonymized or aggregated form only.

12.9 User Rights in Cross-Border Context

Users retain the same rights over cookie-derived data regardless of where it is processed.
These include the right to:

• access information about transfers affecting their data;
• request a copy of the applicable transfer mechanism (e.g., SCCs);
• object to cross-border processing where justified; and
• request deletion or restriction of cookie-related data held outside their jurisdiction.

Requests may be submitted via the Privacy Rights Portal or by email to privacy@joinalva.ai.
Responses are provided within 30 days consistent with GDPR Articles 12–15 and CPRA Section 1798.130.

12.10 Documentation and Accountability

Alva Intelligence maintains the following documentation to demonstrate compliance with international transfer obligations:

• International Data Transfer Register listing all current transfers, lawful bases, and recipient jurisdictions;
• Vendor Transfer Declarations confirming safeguards in place;
• Transfer Impact Assessments (TIAs) and risk ratings;
• SCC execution records and Data Privacy Framework certifications; and
• Audit Logs of transfer events and access controls.

All records are retained for at least five years and are available to supervisory authorities upon lawful request.

12.11 Regulatory Cooperation and Redress

If a user believes that cookie data concerning them has been transferred in violation of applicable laws, they may contact Alva Intelligence’s DPO or file a complaint with the relevant supervisory authority. For EU users, complaints may be directed to their local Data Protection Authority. For U.S. users covered under the Data Privacy Framework, complaints may be lodged directly with the U.S. Department of Commerce or through the independent recourse mechanism designated by Alva Intelligence.

Alva Intelligence cooperates fully with all oversight authorities and commits to remedying substantiated non-compliance promptly.

12.12 Continuous Improvement and Compliance Review

International transfer procedures are reviewed annually by the Privacy, Legal, and Information Security teams as part of the Global Data Governance Program.
The review ensures:

• continued validity of transfer mechanisms;
• timely adaptation to regulatory developments (e.g., invalidation or update of SCCs);
• updated vendor certifications; and
• risk mitigation for evolving geopolitical or cybersecurity threats.

Findings are summarized in the Annual Cross-Border Compliance Report, signed by the DPO and presented to executive management for oversight and accountability.

12.13 Assurance of Global Privacy Protection

Alva Intelligence affirms that cross-border cookie data transfers occur only under lawful, controlled, and auditable conditions. Every transfer is evaluated, justified, documented, and monitored to ensure consistent protection for all data subjects worldwide. By combining legal safeguards, technical security, and transparent user communication, Alva Intelligence upholds the highest international standards of privacy, security, and trust.

13. Data Security Measures for Cookies and Related Tracking Technologies

13.1 Purpose and Overview

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) employs comprehensive data security measures to protect all information collected, processed, or derived through cookies and related tracking technologies. These measures ensure that personal and pseudonymous data remains secure, confidential, and available only to authorized parties.

Security controls apply throughout the entire data lifecycle from initial collection and transmission to storage, processing, and eventual deletion. This section describes the administrative, technical, and physical safeguards that govern cookie data within Alva Intelligence’s infrastructure and through its approved third-party processors.

Alva Intelligence’s security posture is based on defense-in-depth, least privilege, and privacy-by-design principles, ensuring layered protection against unauthorized access, misuse, alteration, or loss.

13.2 Governance and Accountability

13.2.1 Security Management Structure

Data security oversight is the joint responsibility of:

• the Chief Information Security Officer (CISO),
• the Data Protection Officer (DPO), and
• the Security Compliance Committee, composed of representatives from Legal, Engineering, and IT Operations.

These entities are accountable for developing, implementing, and maintaining the Cookie Data Security Program (CDSP). Policies and procedures are reviewed annually and updated to reflect regulatory and technological changes.

13.2.2 Policy Framework

The CDSP operates under the umbrella of the Information Security Management System (ISMS) certified to ISO/IEC 27001 standards.
Specific sub-policies relevant to cookie data include:

• Data Classification and Handling Policy
• Encryption and Key Management Policy
• Access Control and Authentication Policy
• Secure Development Lifecycle (SDLC) Policy
• Incident Response and Notification Policy
• Vendor Risk Management Policy

Each policy defines roles, responsibilities, and enforcement mechanisms consistent with SOC 2 Type 2 trust principles of Security, Availability, and Confidentiality.

13.3 Technical Security Controls

13.3.1 Encryption

All cookie data and derived identifiers are encrypted both in transit and at rest:

• In transit: All communications between users’ browsers and Alva Intelligence’s servers use TLS 1.3 or higher, ensuring end-to-end encryption.
• At rest: Stored cookie-related data is encrypted using AES-256 with keys managed through FIPS 140-2 compliant Hardware Security Modules (HSMs).

Encryption keys are rotated every 12 months or sooner if compromise is suspected.
Third-party providers are required to implement equivalent encryption standards.

13.3.2 Network Security

The Alva Intelligence network is protected through multiple security layers, including:

• Firewalls and Intrusion Detection/Prevention Systems (IDS/IPS) monitoring inbound and outbound traffic;
• Segregated network zones isolating public-facing systems from internal networks;
• Zero-trust architecture for all cross-environment data transfers;
• Continuous packet inspection and TLS inspection for anomaly detection; and
• Geo-restrictions on administrative access from non-authorized regions.

Regular penetration testing and vulnerability scanning ensure that cookie-handling endpoints remain hardened against threats.

13.3.3 Access Controls

Access to cookie-related systems and data is restricted to authorized personnel with legitimate business needs:

• Authentication uses Multi-Factor Authentication (MFA) integrated with identity management solutions.
• All access rights are provisioned on a least privilege basis and reviewed quarterly.
• Privileged administrative actions are logged and reviewed under the Privileged Access Management (PAM) framework.
• Access to analytics or consent data requires explicit approval from the DPO and the CISO.

User access termination occurs automatically upon role change, termination, or inactivity beyond defined thresholds.

13.3.4 Data Segmentation

Cookie data is logically segregated by region and purpose:

• Production, staging, and test environments are isolated.
• Cookie identifiers are stored separately from user account data to prevent linkage.
• Aggregated analytics data is kept in anonymized form in distinct storage clusters.

This segmentation minimizes risk of unauthorized correlation or re-identification.

13.4 Application and Platform Security

13.4.1 Secure Development Lifecycle (SDLC)

All systems managing cookies and consent data are developed under a Secure Development Lifecycle.
Each development phase includes:

• Threat modeling for cookie data flows;
• Static and dynamic application security testing (SAST/DAST);
• Dependency scanning for vulnerabilities; and
• Security peer reviews before code deployment.

New cookie-related functions or integrations undergo privacy impact assessments (PIAs) and data protection impact assessments (DPIAs) before production release.

13.4.2 Session and Token Security

Session cookies employ short lifetimes, cryptographic signing, and secure attributes:

• The HttpOnly, Secure, and SameSite=Strict attributes are set by default.
• Session identifiers are random, non-sequential, and resistant to replay or fixation attacks.
• Session timeouts occur after 15 minutes of inactivity, followed by cookie invalidation.

Authentication and session management comply with OWASP Application Security Verification Standard (ASVS) Level 2.

13.5 Monitoring, Detection, and Response

13.5.1 Continuous Monitoring

Cookie data access and network traffic are monitored 24/7 by the Security Operations Center (SOC) using advanced detection platforms. Logs capture user interactions, consent events, and API calls involving cookie data.
Monitoring systems use machine learning to detect anomalies such as:

• abnormal login patterns,
• unauthorized script injections, or
• unusual data export activity.

13.5.2 Logging and Audit Trails

All cookie data events creation, modification, deletion, or access are recorded in immutable audit logs. Logs are retained for five years and stored securely in write-once, read-many (WORM) systems for regulatory and forensic use. Audit logs are reviewed monthly and during internal or external compliance audits.

13.5.3 Incident Detection and Response

Security incidents involving cookie data are handled according to Alva Intelligence’s Incident Response Plan (IRP):

• Detection triggers automated alerts to the SOC and DPO.
• The response team performs triage, containment, eradication, and recovery actions.
• Notifications to affected users or regulators occur within the legally required timeframe (typically 72 hours under GDPR).

Post-incident reviews ensure continuous improvement and risk mitigation.

13.6 Vendor and Third-Party Security

13.6.1 Vendor Security Requirements

Third-party processors handling cookie data must meet or exceed Alva Intelligence’s security standards.
Each vendor is required to:

• provide SOC 2 Type 2 or ISO 27001 certification;
• maintain encrypted data transport and storage;
• limit subprocessor engagement to approved entities; and
• undergo annual security and privacy audits.

13.6.2 Contractual Safeguards

Vendor contracts include:

• data confidentiality clauses;
• obligations to report incidents within 24 hours;
• provisions for audit rights; and
• obligations to delete or return cookie data upon termination.

Non-compliant vendors are subject to immediate suspension and remediation under the Vendor Security Enforcement Policy.

13.7 Physical and Environmental Security

Alva Intelligence uses Tier III or higher data centers operated by certified providers.
Each facility implements:

• 24/7 monitored access control with biometric authentication;
• CCTV surveillance and motion detection;
• redundant power and cooling systems; and
• fire detection and suppression systems.

Physical access logs are retained for a minimum of one year. Server racks containing cookie data systems are locked and accessible only to authorized personnel.

13.8 Data Integrity and Backup Controls

To ensure the integrity and availability of cookie-related data:

• Checksums verify data integrity during transfer.
• Immutable backups are created daily and stored in separate geographic regions.
• Backups are encrypted and retained for 30 days, after which they are automatically purged.
• Disaster recovery plans ensure restoration of critical cookie-management systems within four hours (RTO) and with minimal data loss (RPO < 15 minutes).

Quarterly backup recovery tests confirm operational resilience.

13.9 Security Training and Awareness

All employees, contractors, and developers undergo mandatory data-protection and security awareness training upon onboarding and annually thereafter.
Training includes:

• secure cookie handling practices;
• recognizing and mitigating phishing and injection attacks;
• compliance with data minimization and privacy principles;
• incident reporting protocols.

Completion is monitored through the Learning Management System, with non-compliance resulting in access suspension.

13.10 Auditing, Certification, and Continuous Improvement

Alva Intelligence’s security controls are independently validated through:

• SOC 2 Type 2 audits (annual);
• ISO/IEC 27001 surveillance audits; and
• GDPR and CPRA privacy compliance assessments.

The DPO and CISO jointly review cookie security annually to:

• evaluate emerging threats;
• adapt encryption and access control policies;
• update vendor certifications; and
• enhance logging, monitoring, and incident response mechanisms.

Results are documented in the Annual Security Assurance Report available upon lawful request.

13.11 Assurance of Confidentiality and Protection

Alva Intelligence guarantees that cookie data and associated identifiers are processed in a manner that ensures:

• confidentiality through encryption and limited access;
• integrity through verification, monitoring, and audit controls; and
• availability through redundancy and disaster recovery planning.

Our multi-layered approach reflects industry-leading security practice and embodies the company’s core principle:
data protection is an obligation, not an option.

14. Data Subject Rights and Procedures for Exercising Cookie-Related Privacy Rights

14.1 Commitment to Data Subject Empowerment

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) recognizes that control over personal information is a fundamental element of privacy. Every individual whose data may be collected through cookies or similar technologies retains enforceable rights to access, correct, delete, restrict, and object to the processing of such data. This section defines those rights, the procedures for exercising them, and the measures Alva Intelligence undertakes to ensure transparent, timely, and lawful responses.

These rights apply to all users, irrespective of residence, with enhanced protections for those located within the European Union, United Kingdom, and jurisdictions that have enacted comprehensive privacy laws such as California, Colorado, and Virginia.

14.2 Overview of Applicable Rights

Under applicable law, individuals may exercise the following rights in connection with cookie-derived data:

1. Right to Know / Access – to obtain confirmation whether personal information is being processed and to receive a copy of such data.
2. Right to Rectification – to request correction of inaccurate or incomplete cookie-related information.
3. Right to Erasure (“Right to Be Forgotten”) – to request deletion of cookie-derived personal data when retention is no longer necessary.
4. Right to Restrict Processing – to limit processing in certain circumstances, such as contested accuracy or pending objection.
5. Right to Object – to object at any time to processing for direct marketing or profiling purposes.
6. Right to Data Portability – to receive data in a structured, commonly used, and machine-readable format where technically feasible.
7. Right to Withdraw Consent – to revoke consent for non-essential cookies at any time without affecting prior lawful processing.
8. Right to Non-Discrimination – to exercise these rights without disadvantage in service quality or price.

14.3 Procedures for Exercising Rights

14.3.1 Submission Channels

Users may submit requests through any of the following methods:

• the Privacy Rights Portal available at https://privacy.joinalva.ai.com;
• by email to privacy@joinalva.ai;
• by postal mail to the address listed in Section 21 of this policy; or
• through automated browser signals such as Global Privacy Control (GPC) for opt-out requests.

To protect confidentiality, Alva Intelligence verifies each requester’s identity before disclosing or deleting data. Verification may include confirmation of browser identifiers, account credentials, or a code sent to the user’s registered email.

14.3.2 Response Timeline

• Initial Acknowledgment: within ten business days of receipt.
• Substantive Response: within thirty calendar days, extendable by an additional sixty days when complexity or volume requires, with explanation provided.
• EU/UK Data Subjects: responses follow GDPR Article 12(3) timelines.
• California Residents: responses follow CPRA Section 1798.130 timelines.

All communications are delivered securely and in the user’s preferred format.

14.3.3 Authentication and Fraud Prevention

Requests involving deletion or data portability undergo enhanced verification to prevent unauthorized access or manipulation. If verification cannot be achieved, the request is denied with notice and an opportunity to resubmit with additional proof of identity.

14.4 Access and Copy of Data

When a valid access request is received, Alva Intelligence provides:

• a summary of categories of cookies that collected data;
• purposes of processing and retention periods;
• categories of third parties with whom data was shared;
• lawful basis for processing; and
• a copy of the data in readable electronic form (CSV, JSON, or PDF).

Access requests for anonymized analytics data are fulfilled through aggregated metrics only, ensuring individual privacy is preserved.

14.5 Rectification of Data

Users may request correction of cookie-derived records that are inaccurate or incomplete. Because most cookie identifiers are pseudonymous, rectification typically involves replacement or regeneration of identifiers rather than alteration of stored values. Rectification is completed within fifteen days unless legal or technical constraints apply.

14.6 Erasure and Deletion Requests

14.6.1 Standard Deletion

Upon receiving a valid deletion request, Alva Intelligence will:

1. delete all non-essential cookies on the user’s device via the Cookie Preference Center;
2. erase corresponding entries from internal databases and analytics logs;
3. instruct all third-party processors to delete associated identifiers; and
4. issue written confirmation of deletion to the requester.

Deletion is executed within thirty days unless extended under lawful exceptions.

14.6.2 Exceptions

Deletion may be denied or delayed where retention is necessary to:

• comply with legal obligations;
• complete ongoing security investigations;
• preserve evidence for legal claims; or
• maintain aggregated, anonymized statistics.

Where exceptions apply, users receive a detailed explanation of the lawful basis for continued retention.

14.7 Restriction and Objection

Users may request restriction of cookie processing under the following conditions:

• accuracy of data is contested;
• processing is unlawful but deletion is opposed;
• data is required for legal defense; or
• an objection is pending.

During restriction, processing ceases except for storage and minimal integrity verification.
When objecting to processing for marketing or profiling, Alva Intelligence disables all related cookies immediately and records the objection in the consent register.

14.8 Data Portability

Where technically feasible, users may request export of cookie-related data that they provided or generated through interactions with our services. Exports include pseudonymous identifiers, consent records, and aggregated session metadata. Files are delivered securely using encrypted download links valid for seven days. Transfers to another controller occur only upon verified request and with equivalent security guarantees.

14.9 Withdrawal of Consent

Users can withdraw consent for non-essential cookies at any time:

• through the Cookie Preference Center;
• by adjusting browser privacy settings; or
• by activating GPC or similar signals.

Withdrawal takes effect immediately and disables future tracking.
Historical data associated with the withdrawn category is pseudonymized or erased within thirty days. Records of withdrawal are maintained for compliance documentation.

14.10 Non-Discrimination and Equal Service

Alva Intelligence never denies goods, services, discounts, or functionality because a user exercises privacy rights. Certain optional features that rely on analytics or personalization cookies may become unavailable, but essential access remains unaffected. This policy satisfies CPRA Section 1798.125 prohibiting discriminatory treatment of consumers asserting their rights.

14.11 Authorized Agents and Representatives

California and certain other jurisdictions permit individuals to designate authorized agents to submit requests on their behalf. Agents must provide written authorization signed by the data subject or other proof of legal authority. Alva Intelligence verifies both the agent’s and the principal’s identities before processing any request.

14.12 Recordkeeping and Audit Trail

All rights requests are logged in the Data Subject Request Register, recording:

• date of receipt;
• type of request;
• verification method;
• completion date; and
• outcome.

Logs are retained for five years to demonstrate compliance with accountability obligations under GDPR Article 5(2) and SOC 2 audit criteria.
Periodic reviews ensure timeliness and accuracy of responses.

14.13 Appeals and Complaint Handling

If a request is denied in whole or in part, the user may appeal within thirty days by contacting the DPO at dpo@joinalva.ai.
Appeals are reviewed by senior privacy counsel not involved in the initial decision.
Users may also lodge a complaint with their supervisory authority:

• EU/EEA: local Data Protection Authority;
• United Kingdom: Information Commissioner’s Office (ICO);
• California: California Privacy Protection Agency (CPPA).

Alva Intelligence cooperates fully with any regulatory inquiry or mediation process.

14.14 Transparency and Ongoing Review

To maintain accountability, Alva Intelligence publishes annual transparency metrics summarizing:

• total number of rights requests received and fulfilled;
• average response time; and
• corrective measures implemented.

Metrics are anonymized and included in the Annual Privacy Compliance Report reviewed by executive leadership.

This continuous feedback loop ensures that user rights are not only respected but continually strengthened as privacy expectations evolve.

14.15 Commitment to Fair Processing

Alva Intelligence affirms its dedication to ensuring that every individual can exercise meaningful control over cookie-related data. Through verified rights procedures, prompt responses, and robust recordkeeping, we uphold our obligations under global privacy frameworks and reinforce user trust in every digital interaction.

15. Interaction Between Cookie Preferences, Privacy Rights, and Global Privacy Control (GPC) Signals

15.1 Overview and Purpose

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) integrates multiple layers of privacy control into its cookie management framework to give users genuine and enforceable control over their personal data. These mechanisms include the Cookie Preference Center, browser-level privacy settings, and automated opt-out signals such as the Global Privacy Control (GPC).

This section explains how these controls interact, the technical sequence by which consent or opt-out preferences are detected and enforced, and how Alva Intelligence harmonizes them to ensure continuous compliance with applicable data protection laws including the California Privacy Rights Act (CPRA), General Data Protection Regulation (GDPR), and ePrivacy Directive.

Alva Intelligence’s objective is to guarantee that once a user expresses a privacy preference whether through its own interface or through a recognized technical signal those choices are respected across all systems and data flows.

15.2 Hierarchy of Privacy Controls

To ensure consistency, Alva Intelligence applies a defined hierarchy of privacy controls determining which mechanism governs when multiple inputs are received simultaneously.

(a) Global Privacy Control (GPC) and Browser Signals:
If a GPC signal or equivalent opt-out header is detected from a user’s browser, that signal takes highest precedence. All non-essential cookies including advertising, analytics, and social media cookies are immediately disabled regardless of prior consent given through the site interface.

(b) Cookie Preference Center Settings:
When no GPC or similar signal is detected, the most recent selection made in the Cookie Preference Center governs. Preferences are stored in a consent record linked to a pseudonymous user identifier and synchronized across sessions for logged-in users.

(c) Regional Legal Overrides:
If a jurisdiction imposes stricter legal requirements (for example, prior opt-in under GDPR for non-essential cookies), that standard automatically overrides less restrictive preferences, ensuring compliance with local law.

(d) Browser-Level Blockers or Private Mode:
Browser settings that block third-party cookies or scripts are respected automatically. Alva Intelligence does not attempt to bypass or override such controls.

15.3 Global Privacy Control (GPC) and Equivalent Signals

15.3.1 Definition and Recognition

The Global Privacy Control (GPC) is a browser- or extension-based mechanism enabling users to send a standardized opt-out signal to websites, indicating that they do not consent to the sale or sharing of their personal information. Under CPRA Section 1798.135(b), businesses are required to honor such signals as valid requests to opt out of “sharing” for cross-context behavioral advertising.

Alva Intelligence actively listens for GPC signals through HTTP headers (Sec-GPC or equivalent). Once detected, the system automatically interprets the signal as a universal opt-out for all non-essential cookies, regardless of region or user login status.

15.3.2 Immediate Enforcement Actions

Upon receipt of a valid GPC signal:

1. All advertising and analytics scripts are blocked from executing;
2. Active non-essential cookies are deleted or deactivated;
3. An opt-out record is written to the consent log, referencing the GPC signal type and timestamp; and
4. The interface displays confirmation that the preference has been honored.

The GPC signal remains active for the duration of the browsing session unless overridden by an explicit subsequent user choice.

15.3.3 Audit and Documentation

Each detected GPC event is recorded in the Privacy Signal Log, capturing:

• timestamp,
• IP region,
• signal type,
• categories of cookies disabled, and
• action confirmation.

These records are retained for five years to demonstrate compliance with CPRA and EU equivalent frameworks.

15.4 Synchronization with Cookie Preference Center

The Cookie Preference Center remains a core mechanism for granular control.
When a user accesses it after sending a GPC signal, the system automatically pre-selects “off” for all non-essential categories. If the user explicitly re-enables categories (e.g., enables analytics cookies for performance evaluation), that choice is honored for that session and recorded as a superseding consent action.

Conversely, if a user opts out via the Preference Center without enabling a GPC signal, the system stores that choice and transmits an internal equivalent of a GPC header to ensure downstream vendors also honor it.

This synchronization ensures both on-site and off-site processing respect the same user intent, closing gaps between local and network-level privacy controls.

15.5 Interoperability with Browser Privacy Settings

Most modern browsers Google Chrome, Mozilla Firefox, Safari, Microsoft Edge offer users the ability to manage or block cookies through built-in privacy settings. Alva Intelligence’s cookie management platform recognizes and adapts to these configurations automatically.

• Third-party cookie blocking: If the browser blocks third-party cookies by default, related tracking scripts are suppressed.
• Private/Incognito modes: When a user visits the site in private browsing mode, no persistent cookies are written, and session cookies are automatically deleted upon closure.
• Do Not Track (DNT) signals: Although DNT is deprecated, Alva Intelligence interprets such signals in good faith as additional opt-out indicators and adjusts cookie behavior accordingly.

Users who manage preferences through browser settings are advised that those controls may not synchronize across devices; however, Alva Intelligence’s internal consent log ensures that account-linked users experience consistent enforcement.

15.6 Integration with Privacy Rights Requests

Alva Intelligence’s systems link cookie preferences and GPC signals directly with formal privacy rights processes described in Section 14.
For example:

• An opt-out request under CPRA automatically triggers cookie deactivation in the same way a GPC signal would.
• A deletion request removes cookie-derived identifiers from all analytics and marketing databases.
• A withdrawal of consent action disables consented cookies and logs the action as a “withdrawal event” under GDPR Article 7(3).

The integration of rights workflows and consent technology ensures uniform compliance across manual and automated channels.

15.7 Communication to Third Parties and Downstream Vendors

When a user’s opt-out or GPC signal is received, Alva Intelligence transmits the corresponding suppression instruction to its third-party vendors via secure APIs or webhook notifications. This ensures that third-party advertising networks, analytics providers, or integration partners also disable cookie placement and cease data sharing for that user.

Each vendor contractually commits to implement these suppression commands within 72 hours of receipt and to confirm completion via audit logs.
Failure to comply constitutes a material breach under the vendor’s Data Processing Agreement (DPA).

Periodic validation tests are performed to verify that external vendors honor user preferences consistently across their systems.

15.8 Technical Implementation and Data Flow Controls

The technical design supporting this framework consists of the following components:

1. Signal Detection Layer: monitors browser headers and preference center input.
2. Consent Decision Engine: applies hierarchy rules, determines active/inactive cookie categories.
3. Script Control Layer: dynamically loads or blocks scripts based on consent state.
4. Audit and Record Layer: logs all preference events, signal detections, and resulting actions.
5. Vendor Notification Service: dispatches opt-out events to connected third parties.

All modules run within Alva Intelligence’s privacy orchestration platform and are subject to continuous monitoring by the Data Governance and Security teams.

15.9 User Confirmation and Transparency

When a privacy signal or preference change occurs, users receive an on-screen confirmation message or visual indicator in the site footer confirming that their choice has been applied.
Alva Intelligence does not obscure or delay such confirmations.

Additionally, users can view their current status, active categories, GPC detection status, and last updated timestamp through the Privacy Settings Dashboard, accessible from every page.

Annual privacy reports summarize the percentage of sessions where GPC signals were detected and honored, demonstrating Alva Intelligence’s commitment to measurable compliance and transparency.

15.10 Interaction with Other Legal Frameworks

While GPC originates in U.S. privacy law, Alva Intelligence treats it as an internationally recognized signal consistent with the GDPR right to object and ePrivacy opt-out principle.
This ensures that users from any jurisdiction benefit from equivalent control, even where formal recognition of GPC has not yet been codified.

The platform’s global enforcement logic treats opt-out signals as binding “objections” to processing for marketing and profiling purposes under GDPR Article 21, ensuring harmonized compliance across all regions.

15.11 Recordkeeping and Auditability

All GPC and preference-based opt-outs are recorded in the Consent and Signal Audit Log, capturing:

• user pseudonymous ID,
• source (Preference Center, GPC, API, or rights request),
• timestamp,
• action type (opt-out, modification, withdrawal), and
• categories affected.

Logs are maintained for five years and reviewed quarterly by the DPO to confirm proper synchronization with third-party systems.
This log serves as proof of compliance under CPRA Section 1798.135(c) and GDPR Article 30(1)(g).

15.12 Continuous Improvement and System Validation

The privacy signal and cookie preference system undergoes annual evaluation under the SOC 2 Type 2 audit framework and the GDPR accountability review cycle.
Tests include:

• simulation of multiple simultaneous signals to verify correct hierarchy enforcement;
• validation of third-party opt-out propagation;
• time-to-honor testing (ensuring deactivation within milliseconds of detection); and
• documentation review for audit completeness.

Results are compiled in the Annual Privacy Controls Validation Report presented to executive management and made available to regulators upon lawful request.

15.13 Assurance of Respect for User Autonomy

Alva Intelligence reaffirms that user autonomy governs all cookie processing and tracking activity. The company’s technology, legal governance, and operational procedures are designed to ensure that every preference, consent withdrawal, or GPC signal is recognized, honored, and documented in a consistent and auditable manner.

Through this multi-layered privacy framework, Alva Intelligence upholds its commitment to transparency, fairness, and legal compliance while empowering users to control how their data is collected and shared.

16. Cross-Device Tracking and Data Correlation Controls

16.1 Purpose and Overview

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) recognizes that users increasingly interact with our services across multiple devices and platforms: desktop browsers, mobile applications, tablets, and integrated third-party systems. This section defines our position, limitations, and safeguards regarding the correlation of cookie-based data across those devices.

Cross-device tracking can be beneficial when implemented responsibly, as it allows users to maintain consistent preferences and seamless functionality. However, it also introduces elevated privacy risks, particularly regarding the potential for re-identification or behavioral profiling.
Alva Intelligence’s approach is therefore grounded in data minimization, pseudonymization, and purpose limitation, ensuring that cross-device linkage occurs only when essential, fully disclosed, and technically safeguarded.

16.2 Scope of Cross-Device Activity

This section applies to all operations where cookie identifiers, device identifiers, or similar signals could be correlated between two or more environments.
Typical scenarios include:

1. Authenticated continuity: maintaining login sessions across desktop and mobile versions of our platform.
2. Preference synchronization: ensuring that cookie consent or language settings selected on one device are mirrored on another under the same account.
3. Fraud prevention and security: detecting anomalies that suggest credential compromise or automated access.
4. Aggregate analytics: measuring service usage across device categories without tracking individual behavior.

Alva Intelligence does not use cross-device correlation for advertising, profiling, or behavioral targeting purposes.

16.3 Lawful Basis for Correlation

All cross-device data linkage is carried out under one of the following lawful bases:

• Contractual necessity: to provide account continuity and legitimate product functionality requested by the user;
• Legitimate interest: to maintain security and prevent fraud, subject to documented balancing tests; or
• Explicit consent: when a user opts to synchronize preferences or data across devices.

Where cross-device correlation extends beyond operational necessity, explicit consent is always required under GDPR Article 6(1)(a) and CPRA Section 1798.100(a).

16.4 Technical Controls and Pseudonymization

16.4.1 Unique Device Identifiers

Each browser or application instance interacting with Alva Intelligence receives a unique pseudonymous token.
Tokens are cryptographically random and contain no personal attributes.
They are rotated periodically to prevent long-term tracking.

16.4.2 Account-Linked Correlation

When users sign in, separate device tokens are mapped to a single account ID through a secure hash function. The mapping table is encrypted and stored in an isolated environment accessible only to the Authentication Services Team. No device fingerprinting or hidden identifiers are employed.

16.4.3 Anonymization of Analytics

Analytics systems rely exclusively on anonymized session data. IP addresses are truncated at the network edge, and user-agent strings are generalized to category level (browser type, operating system, region). No individual device record can be reconstructed from analytics outputs.

16.5 Prevention of Unauthorized Correlation

Alva Intelligence maintains strict technical and organizational barriers against unauthorized linkage of cookie data across devices or with external datasets.

1. Segregated databases: cookie IDs used for website analytics are stored separately from identifiers used for authentication.
2. No external enrichment: data from advertising networks or data brokers is never imported or combined with Alva Intelligence datasets.
3. Access control: only personnel with explicit authorization for security analysis may view multi-device logs, and such access is monitored and logged.
4. Regular audits: quarterly data-mapping reviews verify that no hidden correlations or third-party re-identifications occur.

Violation of these prohibitions constitutes a disciplinary and contractual breach under the Information Security and Privacy Policy.

16.6 Synchronization of User Preferences Across Devices

When a user gives or withdraws cookie consent on one device while logged in, Alva Intelligence synchronizes that preference across all linked sessions.
Synchronization occurs through encrypted API calls using the Consent Synchronization Service (CSS), which performs the following:

• validates the user’s authentication status;
• updates consent status within the master consent registry;
• propagates the updated status to all connected devices within one hour; and
• logs each synchronization event for accountability.

If a user is not logged in, preferences remain device-specific until authentication occurs.
At login, the system reconciles conflicting preferences, defaulting to the most restrictive setting.

16.7 User Controls for Cross-Device Data

Users can manage cross-device functionality through their account dashboard, which provides:

• View Linked Devices: displays pseudonymous identifiers and last-activity timestamps;
• Unlink Device: immediately severs correlation and deletes the device token from the mapping table;
• Sync Preferences: applies cookie and privacy settings across selected devices; and
• Disable Cross-Device Features: permanently prevents linkage for future sessions.

These settings empower users to determine whether, and to what extent, cross-device operations occur.

16.8 Vendor and Third-Party Restrictions

Third-party vendors providing analytics or functionality services must comply with Alva Intelligence’s prohibition on cross-device re-identification.
Contracts require vendors to:

• refrain from combining cookie data with other datasets for profiling;
• maintain pseudonymization of all identifiers;
• limit retention to the period specified in Section 9 of this Policy; and
• submit to periodic compliance verification.

Any attempt by a vendor to engage in cross-device tracking for advertising or unrelated purposes triggers immediate suspension pending investigation.

16.9 Security Measures for Correlation Infrastructure

The cross-device synchronization systems operate within a hardened environment subject to:

• Encryption in transit and at rest using TLS 1.3 and AES-256;

• Key rotation every 12 months or upon incident detection;

• Strict network segmentation separating correlation services from analytics and marketing systems;

• Continuous monitoring for anomalous linkage requests; and

• Integrity verification through hash-based message authentication codes (HMACs).

Logs of all correlation and unlinking events are retained for five years for compliance verification.

16.10 Data Retention and Expiry

Cross-device linkage data is retained only while necessary to provide requested functionality or comply with legitimate security needs.

• Account-linked device tokens expire after 90 days of inactivity.
• Synchronization logs are retained for 12 months for troubleshooting and audit.
• After expiry, records are irreversibly deleted or anonymized.

If a user deletes their account or withdraws consent, all associated linkage records are erased immediately as part of the Data Deletion Protocol.

16.11 Data Subject Rights in Cross-Device Context

Users maintain all rights enumerated in Section 14 of this Policy, specifically:

• the right to request a list of linked devices;
• the right to unlink or delete all device associations;
• the right to object to cross-device correlation for analytics or security purposes; and
• the right to receive confirmation of deletion within thirty days.

Requests are processed through the Privacy Rights Portal or privacy@joinalva.ai, verified under the same authentication protocol as other rights requests.

16.12 International Transfers

If cross-device correlation data involves transfers between jurisdictions, such transfers occur under the lawful mechanisms detailed in Section 12 of this Policy (SCCs, DPF certification, or BCRs).
No cross-device mapping data is transferred to vendors or regions lacking adequate legal safeguards.

16.13 Auditing and Accountability

The Data Protection Officer (DPO) and the Security Compliance Committee conduct annual cross-device data-mapping audits verifying:

• compliance with pseudonymization standards;
• correct deletion of expired tokens;
• separation between analytics and authentication data stores; and
• proper honoring of user opt-out choices.

Results are recorded in the Annual Data Correlation Audit Report and retained for review by external auditors under SOC 2 Type 2 and GDPR accountability principles.

16.14 Continuous Improvement and Technological Neutrality

Alva Intelligence acknowledges that cross-device technology continues to evolve.Accordingly, all systems and policies are reviewed semi-annually to evaluate new industry standards, such as browser privacy sandbox frameworks, token-based federations, and emerging global consent specifications.
Changes are adopted only after validation that they enhance, rather than diminish, user privacy and control.

16.15 Assurance of Privacy by Design

Every cross-device process implemented by Alva Intelligence adheres to Privacy by Design and Default principles. Data linkage occurs only where proportionate, transparent, and technically safeguarded. Through encryption, pseudonymization, minimal retention, and clear user control, Alva Intelligence ensures that cross-device functionality serves the user’s convenience without compromising privacy.

17. Cookie Policy Updates, Change Management, and User Notification Procedures

17.1 Purpose and Commitment

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) is committed to maintaining transparency in how we collect and use data through cookies and similar technologies.
Because privacy laws, browser technologies, and company practices evolve over time, this Cookie Policy is reviewed and updated periodically to ensure continued accuracy and legal compliance.

This section explains how Alva Intelligence manages updates to this Cookie Policy, the mechanisms used to notify users of material changes, and how updated versions are approved, documented, and archived.

17.2 Frequency of Review and Update Triggers

The Cookie Policy is formally reviewed at least once every twelve months as part of Alva Intelligence’s Annual Privacy Compliance Review.
However, an interim update may occur whenever any of the following events take place:

1. Regulatory change: enactment, amendment, or enforcement guidance affecting cookie use or consent requirements under laws such as the GDPR, CPRA, or ePrivacy Directive.
2. Technical change: deployment of new tracking technologies, analytics tools, or cookie categories within Alva Intelligence systems.
3. Business change: introduction of new services, markets, or integrations that alter data collection or transfer practices.
4. Vendor or third-party change: modification to the practices of external analytics, marketing, or consent-management providers that materially affects data processing.
5. User feedback or audit finding: identification of ambiguities or deficiencies in current disclosures through internal or external audits.

Each trigger initiates a structured Change Control Procedure, managed jointly by the Data Protection Officer (DPO), Chief Information Security Officer (CISO), and Legal Department.

17.3 Change Control Process

17.3.1 Drafting and Internal Review

When a change is required, the Privacy Team drafts proposed revisions, ensuring alignment with current laws, guidance, and corporate practices.
Drafts are reviewed by:

• the Legal Department for compliance and consistency with other corporate policies;
• the Information Security Team for technical accuracy; and
• the Communications Team for clarity and readability.

17.3.2 Approval and Version Control

Once finalized, the updated Cookie Policy is approved by the Privacy Governance Committee. Each version receives a unique identifier, effective date, and summary of changes.
The prior version is archived in the Policy Management System for a minimum of five years to support regulatory audits and historical transparency.

A change log is maintained containing:

• version number,
• date of publication,
• summary of modifications,
• approvers, and
• rationale for update.

17.4 Notification of Users

17.4.1 Material vs. Non-Material Changes

• Material changes include any modification that affects users’ rights or obligations, introduces new categories of cookies, expands data-sharing practices, or alters legal bases for processing.
• Non-material changes include editorial improvements, formatting, or clarifications that do not affect substantive rights.

Alva Intelligence distinguishes between these two types of changes to determine the level of user notification required.

17.4.2 Notification Channels

For material changes, Alva Intelligence provides users with clear, proactive notice using multiple channels, such as:

1. Website Banner or Pop-Up: A banner appears upon next visit stating that the Cookie Policy has been updated, summarizing major changes, and linking to the full text.
2. Email Notification: Registered users receive a concise email summarizing updates, with a direct link to the revised version.
3. Consent Renewal Prompt: Where required by law (e.g., if new non-essential cookies are introduced), users are asked to review and re-affirm or adjust their cookie preferences through the Cookie Preference Center.

For non-material changes, the updated date at the top of the Cookie Policy is revised, and users are encouraged to review it periodically.

17.5 Effective Date and Retroactive Application

Each revision includes a clearly stated “Effective Date.”
Unless otherwise required by law, updates apply prospectively, meaning they govern future interactions from the effective date onward.

In cases where continued use of certain cookies requires renewed consent due to expanded purposes or third-party changes, users will be prompted to consent again before those cookies are re-activated.
No retroactive application of new purposes occurs without explicit user approval.

17.6 Consent Re-Collection and Re-Validation

When an update materially changes the nature, category, or purpose of cookies used, Alva Intelligence initiates a consent re-collection process.
This process involves:

1. Resetting the consent status for affected categories in the Consent Management Platform (CMP).
2. Displaying a new cookie banner requesting updated consent under the revised terms.
3. Recording the new consent event with the updated policy version identifier in the Consent Registry.

This ensures that all active consents correspond to the most recent and accurate disclosures.

17.7 User Acknowledgment and Continued Use

By continuing to use Alva Intelligence’s websites or applications after being notified of an update, users acknowledge that they have read and understood the revised Cookie Policy.
However, users may adjust their cookie settings at any time through the Preference Center or by sending a rights request under Section 14 of this Policy.

Alva Intelligence does not interpret silence or inactivity as consent to new cookie categories or expanded processing purposes.

17.8 Recordkeeping and Audit Requirements

To satisfy regulatory and audit obligations, Alva Intelligence maintains the following documentation:

• version history and approval records;
• notifications and user communication templates;
• evidence of banner displays and email notices;
• consent re-collection logs; and
• archived prior versions of the Cookie Policy.

These records demonstrate compliance with accountability principles under GDPR Article 5(2) and SOC 2 Type 2 requirements for policy change traceability.

Auditors and regulators may request copies of historical versions or change logs to confirm compliance. Such requests are handled by the DPO and Legal Department.

17.9 Annual Governance Review

The Cookie Policy is included in the broader Annual Privacy Governance Review conducted by Alva Intelligence’s Privacy Office.
This review assesses:

• the adequacy of change management controls;
• user comprehension and notification effectiveness;
• cross-departmental compliance with new requirements; and
• recommendations for future improvement.

Outcomes are documented in the Annual Privacy Assurance Report presented to executive management and made available to supervisory authorities upon lawful request.

17.10 Assurance of Transparency and Accountability

Alva Intelligence affirms its ongoing commitment to transparency, clarity, and proactive communication. We recognize that privacy obligations evolve and that users deserve timely notice of how their information is handled. By maintaining rigorous version control, consent re-validation, and documented accountability, Alva Intelligence ensures that all updates to this Cookie Policy uphold both the spirit and letter of global privacy laws.

18. Enforcement, Violations, and Remedies

18.1 Purpose and Enforcement Philosophy

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) enforces its Cookie Policy and associated privacy commitments through a structured governance and compliance framework designed to uphold the highest standards of integrity and accountability. This enforcement framework ensures that every instance of cookie use, consent handling, or data processing adheres to applicable law, company policy, and ethical practice.

Compliance is not viewed as a passive obligation but as an active operational discipline. The enforcement of this Cookie Policy reflects our broader corporate philosophy: privacy and data protection are integral to product excellence, not administrative formality.

18.2 Scope of Enforcement

This enforcement section applies to all individuals and entities that process or have access to cookie-related data within the scope of Alva Intelligence’s operations, including:

• employees and contractors;
• subsidiaries and affiliates;
• third-party processors and vendors; and
• strategic partners with integrated technologies.

All such parties are bound by Alva Intelligence’s policies, Data Processing Agreements (DPAs), and confidentiality obligations. Violations, whether intentional or negligent, are treated as serious compliance incidents.

18.3 Enforcement Authorities and Responsibilities

18.3.1 Data Protection Officer (DPO)

The Data Protection Officer has independent authority to monitor compliance with this Cookie Policy, investigate potential breaches, and recommend remedial action. The DPO reports directly to the Chief Executive Officer and has unrestricted access to company leadership for compliance matters.

Responsibilities include:

• conducting periodic audits of cookie processing operations;
• reviewing vendor compliance certifications;
• validating that consent collection and withdrawal mechanisms function as represented; and
• serving as the primary liaison with supervisory authorities.

18.3.2 Chief Information Security Officer (CISO)

The CISO is responsible for enforcing technical and cybersecurity controls governing cookie data, including encryption, access control, and incident response measures. All system logs and audit trails relevant to cookie activity fall under the CISO’s monitoring domain.

18.3.3 Legal and Compliance Department

The Legal Department advises on interpretation of applicable privacy laws, oversees enforcement of contractual obligations with third parties, and coordinates incident disclosures. It ensures that violations are addressed in accordance with both statutory requirements and company disciplinary policies.

18.4 Internal Enforcement Mechanisms

18.4.1 Compliance Audits

Alva Intelligence performs quarterly internal audits of cookie usage, consent records, and vendor activity logs.
Audits verify that:

• only approved cookies are active;
• lawful bases for processing remain valid;
• withdrawal requests are honored in a timely manner; and
• retention periods are observed in accordance with Section 9 of this Policy.

Findings are documented in the Cookie Compliance Audit Report.
Any identified non-conformities are tracked to resolution through the Corrective and Preventive Action (CAPA) system.

18.4.2 Disciplinary Measures

Violations by employees or contractors may result in disciplinary action up to and including termination of employment or contract.
Severity is determined based on:

• intent and frequency of the violation;
• risk to data subjects; and
• cooperation during investigation.

Corrective actions may include mandatory retraining, written warnings, or suspension of system access.

18.4.3 Vendor Enforcement

Third-party vendors that fail to comply with cookie-related obligations under their DPA are subject to contractual enforcement.
Remedies include:

• suspension of data transfers;
• mandatory remediation within a defined period;
• financial penalties or offset; and
• termination of contract for material breach.

Vendor non-compliance is reported to the DPO and recorded in the Vendor Risk Management Register.

18.5 Violation Investigation Procedure

When a potential violation is identified, Alva Intelligence follows a standardized investigation process:

1. Detection and Reporting: Any employee, user, or third party may report suspected misuse of cookies or violation of consent through the Compliance Hotline, Privacy Rights Portal, or direct contact with the DPO.
2. Preliminary Assessment: The DPO and CISO jointly assess whether the incident constitutes a breach or policy deviation.
3. Containment: Systems involved are isolated if ongoing unauthorized activity is detected.
4. Root Cause Analysis: Technical and procedural causes are analyzed to determine corrective measures.
5. Remediation: Systems and processes are corrected, and preventive measures are implemented.
6. Notification: If the incident qualifies as a personal data breach under GDPR Article 33 or CPRA Section 1798.150, notifications are made as required (typically within 72 hours of confirmation).

Each investigation is assigned a unique case number and documented in the Incident Management Register.

18.6 Regulatory Enforcement and Cooperation

Alva Intelligence fully cooperates with supervisory authorities in any investigation, audit, or inquiry concerning compliance with cookie regulations or privacy law.
This includes the California Privacy Protection Agency (CPPA), European Data Protection Board (EDPB), UK Information Commissioner’s Office (ICO), and other relevant national authorities.

Upon lawful request, Alva Intelligence provides:

• logs of consent collection and withdrawal events;
• vendor audit reports;
• incident documentation; and
• remediation evidence.

Regulatory findings or directives are reviewed by senior leadership and implemented promptly under oversight of the DPO.

18.7 Remedies Available to Users

Alva Intelligence ensures that users whose privacy rights have been infringed have access to multiple remedies:

18.7.1 Internal Redress

Users may contact the Privacy Office at privacy@joinalva.ai to file a complaint regarding cookie usage or data handling. Complaints are acknowledged within ten business days and investigated by the DPO. Findings and outcomes are communicated to the complainant in writing within thirty days.

18.7.2 External Remedies

If users are unsatisfied with the internal response, they may escalate the matter to:

• their regional data protection authority (for EU/EEA or UK users);
• the California Privacy Protection Agency (for California residents); or
• any other competent regulatory body under applicable law.

Under GDPR Articles 77–82, users may also seek judicial remedies for violations resulting in harm. Alva Intelligence respects and complies with all final determinations or orders issued by competent authorities.

18.7.3 Compensation

Where legally required, individuals who suffer material or non-material damage due to unlawful cookie processing are entitled to compensation. Claims are reviewed in coordination with Legal and resolved through established dispute resolution procedures.

18.8 Prevention and Continuous Improvement

Alva Intelligence treats enforcement not as punitive but as preventive.
To minimize the likelihood of violations:

• regular privacy and security training is mandatory for all staff;
• cookie management tools undergo quarterly validation testing;
• consent banners and scripts are reviewed for accuracy; and
• automated alerts notify compliance officers of anomalous script behavior or third-party tag activity.

Lessons learned from any enforcement action are incorporated into revised training, policy updates, and technical controls.

18.9 Recordkeeping and Audit Trail

All enforcement actions internal or external are documented in the Compliance Enforcement Register, which includes:

• description of the violation;
• corrective action taken;
• responsible department;
• verification of closure; and
• date of resolution.

Records are retained for at least five years, ensuring traceability and accountability consistent with SOC 2 and GDPR documentation requirements.

18.10 Statement of Zero Tolerance and Corporate Integrity

Alva Intelligence maintains a zero-tolerance policy for any willful violation of privacy or data-protection obligations. The company’s leadership fully supports robust enforcement to preserve the integrity of its systems, the trust of its users, and the credibility of its compliance commitments.

Violations of this Cookie Policy are not treated as isolated incidents but as critical risk events demanding full remediation and disclosure. Every employee, partner, and vendor shares the collective responsibility to ensure that cookie use remains lawful, transparent, and ethical.

19. Recordkeeping, Audit, and Accountability Framework

19.1 Purpose and Governance Principle

Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) maintains formalized recordkeeping and audit mechanisms to demonstrate continuous compliance with every requirement contained in this Cookie Policy and the broader privacy-management program. Accountability is a legal and ethical obligation under global privacy law. Accurate, verifiable records provide proof that data-protection commitments are not aspirational but operational. This section outlines the documentation maintained, the frequency and scope of audits, and the governance structure that ensures privacy accountability across all business units.

19.2 Documentation and Registers Maintained

The following registers and logs are maintained within the Central Privacy Repository (CPR), an encrypted, access-controlled documentation system located in Alva Intelligence’s secure compliance cloud:

Records are stored in immutable format, protected by AES-256 encryption, and indexed for retrieval within two business days of lawful request.

19.3 Roles and Responsibilities for Recordkeeping

• Data Protection Officer (DPO): Ensures completeness and accuracy of all privacy-related records; validates audit evidence before submission to regulators or auditors.
• Chief Information Security Officer (CISO): Maintains technical logs supporting security and access-control records.
• Legal Department: Retains contractual and regulatory documentation and coordinates discovery requests.
• Internal Audit Function: Conducts assurance testing and certifies the integrity of recorded data.
• Business Process Owners: Responsible for timely entry of cookie and vendor information into the CPR system.

Non-compliance with recordkeeping obligations constitutes a reportable control deficiency under the corporate compliance program.

19.4 Internal Audit Program

19.4.1 Frequency and Scope

Internal audits occur semi-annually and cover:

1. accuracy of the Cookie Inventory Register;

2. functionality and evidence of consent mechanisms;

3. alignment of vendor contracts with current SCC / DPF requirements;

4. verification of deletion and retention controls; and

5. testing of incident-response and notification procedures.

Each audit follows a risk-based sampling plan approved by the DPO and CISO.

19.4.2 Methodology

Audits adhere to the Institute of Internal Auditors (IIA) standards and SOC 2 Type 2 criteria. Procedures include:

• walkthroughs of data-flow diagrams;
• inspection of system logs and consent records;
• interviews with responsible personnel; and
• technical validation of cookie-deployment scripts.

Findings are graded as Low, Moderate, or High risk, with mandatory corrective-action plans for any Moderate or High-risk item.

19.4.3 Reporting and Follow-Up

The Internal Audit Report is delivered to the Privacy Governance Committee within 30 days of completion. Management responses and remediation evidence are verified within 90 days. Unresolved issues escalate to executive leadership and the Board Audit Committee.

19.5 External Audit and Certification

To reinforce credibility, Alva Intelligence engages independent assessors annually to validate its controls under:

• SOC 2 Type 2 (Security, Confidentiality, Privacy);
• ISO/IEC 27001 Information Security Management System; and
• GDPR Accountability Assessments by qualified EU privacy auditors.

Audit evidence includes the registers listed in 19.2 and policy change logs from 17.3. External assessors issue a compliance attestation detailing scope, findings, and recommendations. Summaries of attestation results are made available to clients and regulators upon request under appropriate confidentiality protections.

19.6 Automated Monitoring and Continuous Assurance

To complement manual audits, Alva Intelligence implements continuous-monitoring tools that:

• detect unauthorized script or cookie insertion;
• reconcile live cookie inventory with the approved register daily;
• flag expired cookies for automatic deactivation; and
• verify that opt-out signals are honored within milliseconds of detection.

Alerts feed into the Compliance Dashboard, providing real-time metrics to the DPO and CISO. Key performance indicators include percentage of cookies compliant with policy, time-to-honor consent changes, and incident resolution rates.

19.7 Regulatory and Legal Cooperation Records

All correspondence with supervisory authorities including notifications, requests for information, and audit outcomes is archived under the Regulatory Engagement File. This file provides traceability for demonstrating good faith cooperation and timely remediation of regulatory findings. Records are retained for a minimum of seven years.

19.8 Accountability and Governance Reporting

19.8.1 Privacy Governance Committee Meetings

The Committee meets quarterly to review:

• internal and external audit results;
• metrics from continuous monitoring systems; and
• open corrective actions.

Minutes are recorded and signed by the DPO and General Counsel. Material issues are escalated to executive leadership and included in the annual Privacy Compliance Report.

19.8.2 Executive and Board Reporting

A summarized privacy-risk dashboard is presented to the Board Audit Committee each year, covering:

• audit completion status;
• significant findings and remediation progress; and
• recommendations for policy or budgetary changes.

This ensures direct oversight of privacy accountability at the highest corporate level.

19.9 Retention and Disposition of Records

All records referenced in this section follow the Data Retention and Destruction Policy approved by the Legal Department. When retention periods expire:

• records are permanently deleted using NIST SP 800-88 Rev 1 methods; or
• anonymized for statistical and trend analysis.

Deletion events are logged with timestamp, record type, and authorizing officer signature.

19.10 Continuous Improvement and Certification Readiness

Following each audit cycle, the Privacy Office prepares a Continuous Improvement Plan summarizing:

• lessons learned from findings;
• enhancement actions for the next period; and
• anticipated legislative developments requiring record changes.

Implementation progress is monitored quarterly and feeds directly into next-year SOC 2 Type 2 and ISO certification preparations. This loop ensures that recordkeeping and accountability remain dynamic, not static.

19.11 Statement of Accountability and Assurance

Alva Intelligence affirms that privacy accountability extends beyond regulatory compliance; it is a core component of corporate ethics and trust. By maintaining comprehensive records, independent audits, and documented governance, the company ensures that every representation made to users, clients, and regulators can be substantiated through verifiable evidence.
This system of accountability demonstrates our commitment to transparency, responsibility, and continuous improvement in data-protection practice.

20. Liability, Indemnification, and Limitation of Responsibility

20.1 Purpose and Overview

This section sets forth Alva Intelligence LLC’s (“Alva Intelligence,” “we,” or “our”) commitments and limitations concerning liability for the use of cookies and related tracking technologies, as well as the rights and remedies available to users and partners in the event of harm, breach, or noncompliance. The provisions herein reflect the principle of proportional responsibility meaning each party bears the consequences of its own conduct while safeguarding users’ rights and ensuring fairness in risk allocation.

20.2 General Liability Framework

Alva Intelligence operates under a “reasonable diligence and due care” standard in managing the collection and processing of cookie-derived data. Our liability for any breach or violation of this Cookie Policy, or for related data-protection failures, is governed by applicable law and subject to the limitations and exclusions set forth below.

Liability arises only when harm results directly from actions or omissions within Alva Intelligence’s control and where such harm was foreseeable and preventable through adherence to required technical and organizational safeguards.

20.2.1 Compliance with Applicable Law

Alva Intelligence is liable under the General Data Protection Regulation (GDPR), California Privacy Rights Act (CPRA), and comparable laws where the company acts as a controller of personal data derived from cookies. When functioning as a processor for third parties, Alva Intelligence’s liability is limited to breaches of its processing obligations under written instructions and Data Processing Agreements.

20.2.2 Shared Liability in Joint Processing

Where Alva Intelligence jointly determines the purposes and means of cookie processing with another controller (for example, a marketing or analytics partner), both parties share liability under GDPR Article 26(3) to the extent of their respective participation. A clear delineation of roles is maintained through contractual terms ensuring transparency and mutual cooperation in case of claims.

20.3 Indemnification by Alva Intelligence

Alva Intelligence agrees to defend, indemnify, and hold harmless users, clients, and authorized partners from and against any direct losses, damages, costs, or expenses (including reasonable attorney’s fees) arising from:

1. any proven violation by Alva Intelligence of applicable data-protection or privacy law related to cookie operations;
2. any negligent or willful misconduct in implementing or maintaining security measures;
3. any unauthorized disclosure of cookie-derived personal information resulting from a failure of Alva Intelligence’s systems; or
4. any material misrepresentation regarding the collection, use, or disclosure of cookie data.

Indemnification applies only to direct losses and excludes indirect, consequential, or exemplary damages except where prohibited by law. The indemnifying obligation is subject to prompt written notice by the injured party and full cooperation in defense of the claim.

20.4 Indemnification by Vendors and Third Parties

Third-party vendors and processors providing cookies, scripts, or analytics technologies to Alva Intelligence are contractually bound to indemnify and defend Alva Intelligence against:

• any regulatory penalties or damages arising from the vendor’s unlawful processing, misuse, or failure to comply with consent signals;
• breach of representations or warranties under the Data Processing Agreement; or
• introduction of malicious code, unauthorized tracking, or security vulnerabilities through their services.

Each vendor must maintain adequate professional liability and cyber-insurance coverage throughout the term of engagement. Failure to maintain coverage or satisfy indemnity obligations constitutes grounds for immediate termination.

20.5 Limitations of Liability

20.5.1 Cap on Liability

To the fullest extent permitted by law, Alva Intelligence’s total aggregate liability for all claims, losses, or damages arising from or relating to the use of cookies, this Cookie Policy, or related processing activities shall not exceed:

• USD $10,000 per individual claim, or
• the total amount of fees paid by the affected user or client to Alva Intelligence in the preceding twelve months, whichever is greater.

This limitation does not apply in cases of willful misconduct, gross negligence, or intentional violation of data-protection law.

20.5.2 Exclusion of Certain Damages

Alva Intelligence shall not be liable for:

• incidental, consequential, punitive, or exemplary damages;
• loss of profits, goodwill, or anticipated savings;
• damage arising from acts or omissions of third parties beyond our control; or
• damages caused by user misuse or failure to implement available privacy controls.

These exclusions are intended to reflect proportional fairness and do not limit statutory remedies available under applicable consumer protection or privacy laws.

20.5.3 Force Majeure

Alva Intelligence is not liable for failure or delay in performance caused by events beyond its reasonable control, including natural disasters, cyberattacks by third parties, governmental actions, or widespread Internet outages. Obligations suspended under such circumstances resume immediately once normal operations are restored.

20.6 User Obligations and Responsibility

Users are responsible for:

1. maintaining the security of their own devices and browsers;
2. managing cookie preferences accurately through the provided tools;
3. reviewing updated versions of this Cookie Policy periodically; and
4. refraining from disabling essential cookies required for authentication or fraud prevention.

Alva Intelligence disclaims liability for consequences resulting from user-initiated disabling of essential technical cookies that are necessary to maintain service integrity.

20.7 Reporting of Potential Claims or Losses

Any potential claim, suspected violation, or instance of harm related to cookie processing must be reported promptly to the Privacy Office via privacy@joinalva.ai or by certified mail to:

Alva Intelligence LLC
Attn: Data Protection Officer
30 N Gould Street, Suite R
Sheridan, WY 82801

Reports should include a description of the incident, affected systems, and evidence of harm.
Acknowledgment of receipt will be provided within ten business days, followed by a formal investigation under Section 18.5 of this Policy.

20.8 Regulatory and Judicial Remedies

Nothing in this section limits users’ statutory rights to:

• lodge complaints with supervisory authorities;
• seek judicial remedies for damages under GDPR Articles 77–82; or
• bring civil actions for data breaches under CPRA Section 1798.150.

Alva Intelligence cooperates fully with any regulatory or judicial authority handling such complaints and will not require arbitration or waiver of statutory remedies unless expressly permitted by law and mutually agreed.

20.9 Insurance and Financial Responsibility

Alva Intelligence maintains comprehensive cyber-liability and professional indemnity insurance covering:

• data-breach costs;
• regulatory fines and penalties where insurable; and
• third-party damages arising from operational negligence.

The insurance policy is reviewed annually by the Legal Department to ensure adequacy relative to evolving privacy and cybersecurity risks.

20.10 Relationship to Other Policies

This liability and indemnification framework operates in conjunction with:

• the Privacy Policy (governing broader data-processing obligations);
• the Terms of Service (governing contractual relationship with users); and
• the Data Processing Agreement (where applicable to business clients).

In case of inconsistency, the document granting the highest degree of user protection prevails, unless expressly superseded by a binding contractual term.

20.11 Severability and Survival

If any provision of this section is held invalid or unenforceable by a competent authority, the remaining provisions shall remain in full force and effect.
Obligations relating to indemnification, limitation of liability, dispute resolution, and recordkeeping survive termination or expiration of this Policy for as long as necessary to resolve outstanding matters or enforce rights and obligations arising before termination.

20.12 Statement of Equitable and Legal Balance

Alva Intelligence aims to strike a balance between protecting user rights and preserving operational feasibility. Through carefully constructed liability caps, mutual indemnities, and a robust insurance framework, Alva Intelligence ensures accountability while preventing disproportionate exposure that could undermine service delivery or innovation.

The company’s guiding principle remains: to act transparently, to remedy any proven harm swiftly, and to maintain trust through fairness and compliance.

21. Contact Information, Complaints, and Supervisory Authority Coordination

21.1 Purpose of This Section

This section establishes the official channels through which individuals may contact Alva Intelligence LLC (“Alva Intelligence,” “we,” or “our”) regarding the collection or use of data through cookies and similar technologies. It also defines how complaints are received, investigated, and, where appropriate, coordinated with competent supervisory or regulatory authorities. The objective is to ensure that every person has a direct, reliable, and law-compliant path to obtain information, assert rights, or escalate concerns.

21.2 Designated Contact Points

Alva Intelligence maintains dedicated communication channels for privacy and data-protection matters:

All communications are acknowledged within ten business days, and substantive responses are normally provided within thirty calendar days unless complexity or volume necessitates extension.

21.3 Information to Include in a Request or Complaint

To ensure efficient handling, individuals are encouraged to provide:

1. Full name and contact details;
2. Description of the issue or suspected violation;
3. Relevant dates, browser type, or device used;
4. Evidence such as screenshots or transaction references; and
5. Preferred method for receiving a response.

Incomplete submissions will receive a request for additional information before investigation begins.

21.4 Complaint Handling Procedure

1. Receipt and Logging – Every complaint or inquiry is recorded in the Privacy Correspondence Register with a unique reference number.
2. Acknowledgment – The DPO’s office confirms receipt and explains expected timelines.
3. Preliminary Review – Within ten days the DPO determines whether the issue involves alleged non-compliance, user misunderstanding, or third-party activity.
4. Investigation – Relevant departments (Legal, Information Security, Product, or Vendor Relations) provide written findings.
5. Resolution and Response – A formal written reply is issued detailing conclusions, corrective actions, and available next steps.
6. Appeal Option – If dissatisfied, the complainant may request escalation to the Chief Privacy Counsel for independent review within thirty days of receiving the outcome.

All complaint records are retained for five years for accountability and audit purposes.

21.5 Cooperation with Supervisory and Regulatory Authorities

Alva Intelligence recognizes the oversight authority of privacy regulators in every jurisdiction in which it operates. The company cooperates promptly and transparently with such authorities by:

• responding to lawful information or inspection requests;
• providing copies of relevant registers, audit reports, or consent logs;
• implementing corrective measures or enforcement orders without delay; and
• notifying the authority and affected users of material breaches where required by law.

The DPO acts as the single liaison point for all supervisory-authority interactions and ensures consistency of responses across jurisdictions.

21.5.1 Principal Authorities by Region

When a complaint originates from outside the United States, the DPO determines the competent authority based on the user’s habitual residence or place of alleged infringement.

21.6 Coordination During Investigations

If an investigation is initiated by a supervisory authority:

1. The DPO immediately notifies the Legal Department and CISO.
2. Relevant systems or logs are preserved under Legal Hold status.
3. The company designates subject-matter experts to provide technical and factual information.
4. Periodic progress reports are delivered to both the authority and executive management.

Confidentiality is maintained throughout, and communications are logged in the Regulatory Engagement Register described in Section 19.7.

21.7 Cross-Border Complaint Handling

For data subjects in the EU/EEA, Alva Intelligence applies the one-stop-shop mechanism under GDPR Articles 56 and 60, coordinating primarily with the lead supervisory authority designated by the DPO. For users in other regions, the company cooperates directly with the authority that first receives the complaint. Where multiple jurisdictions assert competence, Alva Intelligence facilitates a cooperative resolution ensuring consistency of factual representations and remediation.

21.8 User Assistance and Accessibility

To ensure accessibility and inclusivity:

• All communication channels support English as the primary language and translation assistance upon request.
• Persons with disabilities may request alternative formats (large-print, audio, or digital accessible versions).
• No fee is charged for submitting or processing a complaint unless requests are manifestly unfounded or excessive, consistent with GDPR Article 12(5).

21.9 Transparency and Annual Reporting

Each year the DPO prepares a Privacy Interaction Summary Report including:

• total number of inquiries and complaints received;
• percentage resolved within statutory timelines;
• nature of issues raised (informational, rights exercise, or alleged breach); and
• actions taken or systemic improvements adopted.

This anonymized report is shared with executive management and made available to regulators upon request, demonstrating a culture of openness and continuous improvement.

21.10 Escalation, Appeals, and Judicial Remedies

If a user remains dissatisfied after internal review and external regulatory contact, they retain the right to:

• pursue mediation or alternative dispute resolution if offered by the authority; or
• seek judicial remedies in accordance with their national law.

Alva Intelligence honors all final judgments or orders issued by competent courts or authorities and implements any corrective actions promptly.

21.11 Commitment to Constructive Engagement

Alva Intelligence views dialogue with users and regulators as an essential element of trust. Every complaint or inquiry is treated as an opportunity to refine controls and strengthen transparency. By maintaining clear contact points, efficient investigation procedures, and cooperative relationships with oversight bodies, the company ensures that accountability extends beyond written policy into verifiable practice.

22. Exhibits and Appendices – Cookie Inventory, Consent Record Template, and Technical Diagram References

22.1 Purpose and Structure of Exhibits

The exhibits and appendices accompanying this Cookie Policy are integral components of Alva Intelligence LLC’s (“Alva Intelligence,” “we,” or “our”) compliance documentation. They provide the factual and operational evidence necessary to demonstrate adherence to the commitments and procedures described in the main body of this Policy.
Each exhibit is maintained as a separate living document, updated periodically without requiring republication of the entire Policy.

The exhibits are designed to:

• maintain transparency regarding cookies and tracking technologies in use;
• standardize consent recordkeeping;
• provide visual clarity of data flows and control points; and
• facilitate independent audits, regulatory review, or contractual due diligence.

22.2 Index of Exhibits

Each exhibit forms part of the compliance portfolio maintained by the Data Protection Officer (DPO) and is available upon lawful request to regulators, auditors, or contractual clients.

22.3 Exhibit A – Comprehensive Cookie Inventory Register

The Cookie Inventory Register lists every cookie and similar technology deployed by Alva Intelligence and its approved vendors.
Entries are organized by function and category, each including:

The Register is reviewed quarterly and certified by the Privacy Office.
Changes trigger an update process as defined in Section 17 (Change Management).

22.4 Exhibit B – Consent Event and Preference Record Template

This standardized template documents every consent or withdrawal event to ensure evidentiary integrity and audit traceability under GDPR Article 7(1) and CPRA Section 1798.135.

This record is automatically generated within the Consent Management Platform (CMP) and stored in the secure Consent Registry Database.
Records are retained for a minimum of five years.

22.5 Exhibit C – Technical Architecture Diagram – Consent and Script Control

Purpose:
To provide visual and technical clarity on how Alva Intelligence’s cookie-consent infrastructure functions end-to-end.

Core Components Illustrated:

1. User Interface Layer: Banner, Preference Center, and GPC detection module.
2. Consent Engine: Real-time decision logic governing script activation and cookie placement.
3. Script Control Gateway: Filters all outgoing tags based on current consent state before execution.
4. Audit and Record Layer: Logs every decision, storing consent metadata in the database.
5. Synchronization API: Pushes updates to third-party systems and vendor suppression endpoints.

Each diagram version includes revision number, creation date, and reviewer signatures from the DPO and CISO. The diagram is updated upon any architectural or vendor integration change.

22.6 Exhibit D – Vendor Data Transfer and Suppression Notification Matrix

This exhibit identifies each vendor or subprocessor receiving cookie-derived data and documents their opt-out propagation process.

The DPO reviews this matrix quarterly to confirm that vendors remain within scope, continue to honor suppression notifications, and maintain active compliance certifications.

22.7 Exhibit E – Browser and Device Cookie Management Reference Guide

This guide provides non-technical users with clear instructions for managing cookies across devices. It includes:

• step-by-step instructions for deleting cookies in Chrome, Firefox, Safari, Edge, and Opera;
• details on clearing cached data on iOS and Android;
• guidance for enabling Global Privacy Control (GPC); and
• explanation of how local browser settings interact with Alva Intelligence’s Consent Preference Center.

The guide also outlines limitations such as per-browser scope and lack of cross-device synchronization without account login so users can make informed privacy decisions.

22.8 Maintenance and Version Control of Exhibits

Each exhibit is versioned separately from this Cookie Policy and includes:

• Version Number and Date of Issue;
• Author and Reviewer Signatures;
• Change Summary; and
• Cross-Reference to Policy Section.

Exhibit updates follow the same governance and approval workflow described in Section 17.3.
Users are notified only when exhibit changes materially alter data categories, processing purposes, or user choices.

22.9 Access and Disclosure Controls

Access to exhibit content is restricted to authorized personnel with a demonstrated need, including:

• the Privacy Office;
• the Information Security Department;
• the Legal Department; and
• external auditors under confidentiality agreement.

Where exhibits contain proprietary vendor information, only aggregated or redacted versions are shared publicly. Complete versions are disclosed solely to regulators or contractual clients upon lawful or written request.

22.10 Periodic Review and Certification

All exhibits undergo comprehensive review at least annually. The DPO issues a Certificate of Exhibit Accuracy confirming that the data and processes reflected remain correct as of the certification date. This certificate forms part of the Annual Privacy Assurance Report described in Section 19.8 and is available for inspection by supervisory authorities.

22.11 Concluding Statement

The exhibits accompanying this Cookie Policy represent Alva Intelligence’s operational transparency and accountability in tangible form. They translate the commitments of this Policy into measurable, verifiable practice. Together, the main body of the Cookie Policy and its supporting exhibits form a complete compliance framework demonstrating that Alva Intelligence not only states its privacy obligations but documents, audits, and proves them in full accordance with law and industry best practice.

Execution and Certification Page

COOKIE POLICY
of
ALVA INTELLIGENCE LLC
Effective Date: 2nd of November 2025
Version:

Certification and Execution

This Cookie Policy has been reviewed, approved, and adopted by the authorized representatives of Alva Intelligence LLC in accordance with internal governance protocols and applicable data-protection regulations.
By executing this Policy, the undersigned certify that all operational, technical, and administrative controls necessary to enforce the commitments contained herein have been implemented and validated through internal audit.

The signatories below further affirm that this Policy will be:

• published on all relevant company websites and applications;
• reviewed annually for continued compliance and accuracy; and
• updated as required by changes in law, technology, or business operations.

For and on behalf of:

ALVA INTELLIGENCE LLC
30 N Gould Street, Suite R
Sheridan, Wyoming 82801
United States

Acknowledgment of Legal Review

This document has been examined by qualified legal counsel to confirm compliance with applicable laws and regulations, including the California Privacy Rights Act (CPRA), General Data Protection Regulation (GDPR), ePrivacy Directive, and relevant U.S. state privacy frameworks. Counsel has verified that all required disclosures, rights, and procedural safeguards are appropriately represented.

Record of Publication

Statement of Accountability

The undersigned officers acknowledge collective responsibility for the accuracy, transparency, and enforcement of this Policy. Failure to implement or maintain controls described herein constitutes a breach of internal compliance duties and may trigger disciplinary or remedial action as outlined in Section 18 of this Policy.

ALVA INTELLIGENCE LLC
By: Denniz Özden
Authorized Signatory
Title: Chief Executive Officer

Date: 2nd of november 2025

Name / Title Denniz Özden CEO

Date 2nd of november 2025