COOKIES POLICY
Effective Date: 24 August 2026
Version: 1
This Cookies Policy explains how Henry AI (Pty) Ltd, trading as Henry, Henry AI, Henry Ingest, Henry Insights and Henry Exchange (Henry, we, us or our), uses cookies and similar technologies on https://henryai.co.za, https://app.henryexchange.ai and related Henry-controlled online services (Online Services). It must be read with the Privacy Policy, Suboperator List and Retention, Deletion and De-identification Schedule.
Standard and Enterprise arrangements: The standard position described in this document applies unless a signed Enterprise Annex expressly varies an eligible, identified contractual matter. Where legally and operationally available, any enhanced or non-standard scope, service level, support, infrastructure, assurance, reporting, implementation or other commitment must be separately requested, assessed, approved and priced under the Enterprise Agreement. An Enterprise Annex cannot alter statutory rights or mandatory legal obligations.
1. Scope and Responsibility
1.1. This Policy applies to cookies and similar technologies placed or accessed through the Online Services. A Tenant or third party may use cookies on a website, application or service it controls; its own notice applies to that use.
1.2. Henry is responsible for technologies it uses for Henry-determined purposes. Where Henry uses a technology only on a Tenant's documented instructions, the roles described in the Privacy Policy and Operator Agreement apply.
1.3. Henry's contact details and Information Officer are stated in the Privacy Policy Sections 1 and 14. Questions about this Policy may be sent to legal@henryai.co.za.
2. What Cookies and Similar Technologies Are
2.1. A cookie is a small text file that a website stores on a browser or device. Cookies can enable a website to remember a session, recognise a returning browser, retain a preference or understand how a service is used.
2.2. Similar technologies include local or session storage, software development kits, pixels, tags and device or browser identifiers. In this Policy, cookies includes these technologies unless the context indicates otherwise.
2.3. A session cookie ordinarily expires when the browser session ends. A persistent cookie remains until its configured expiry or earlier deletion. A first-party cookie is set by the Online Service being visited, while a third-party cookie is set or accessed by another provider.
3. How We Use Cookies
3.1. The cookies used on a particular visit depend on the Online Service, enabled features, browser and device, whether the visitor is signed in, and the choices recorded in the relevant interface. Strictly necessary technologies may operate to deliver a requested service or protect the Online Services. Optional analytics, performance, replay and personalisation technologies must remain disabled until the applicable choice has been recorded.
| Category | Purpose | Typical examples | Default treatment |
|---|---|---|---|
| Strictly necessary | Operate the Online Services; authenticate Users; maintain sessions; route traffic; protect accounts; prevent fraud; preserve security; and record privacy choices | Session, authentication, security, load-management and consent-choice technologies | Active where necessary to provide a requested service or protect the Online Services |
| Functional | Remember optional settings and improve convenience | Language, display, interface and other preference storage | Used where enabled and permitted; disabling them may cause preferences to be lost |
| Analytics and performance | Measure feature use, visitor journeys, reliability and performance; diagnose errors; test experiences; and improve the Online Services | Product and website events, pseudonymous or reference identifiers, browser and device data, interaction measurements and cookieless measurement | Used only where configured and lawfully enabled, including consent where required |
3.2. Henry does not use cookies to sell identifiable personal information. Unless this Policy or the relevant interface states otherwise, Henry does not use third-party advertising cookies for cross-site behavioural advertising.
3.3. Blocking strictly necessary cookies may prevent sign-in or cause parts of the Online Services to malfunction. Other categories are not necessary for the core Online Services and may be controlled as described in Section 6.
3.4. Henry maintains the following customer-facing technology register. The exact live cookie or storage key, provider, host, purpose, category, information, duration and region must be shown in the preference tool or a linked current register before a technology is enabled; an unregistered optional technology may not be activated.
| Technology or provider | Category and purpose | Typical identifiers/information | Standard duration | Principal region and activation |
|---|---|---|---|---|
| Henry first-party session and authentication | Strictly necessary; sign-in, session continuity and account security | Session or authentication token, security state and device/browser context; exact key depends on the deployed authentication service | Session, or up to 12 months for a persistent security/authentication identifier | Henry's configured application infrastructure; active only as needed for the requested service |
| Henry consent-choice storage | Strictly necessary; remember and prove privacy choices | Consent version, category selections, time and browser reference | Up to 12 months | Henry's configured application infrastructure; active to record the choice |
| Google Analytics, where enabled | Optional analytics and performance | _ga, _ga_<container> or current equivalent; usage events, page/screen interactions, device/browser data, approximate location and reference identifier |
Cookie expiry and identifiable event retention up to 14 months | United States and other listed provider regions; disabled until the applicable choice |
| Zoho, where enabled | Optional web analytics, user tracking, testing, journey and conversion measurement, personalisation, session analysis and video-like session replay | Provider visitor/session identifier, page views, clicks, scrolling, mouse movement, navigation, form and goal events, and masked interaction recordings | Up to 12 months for browser identifiers and 14 months for identifiable events unless the interface states less | United States, India or configured Zoho region; disabled until the applicable choice |
3.5. The register must identify the actual deployment status for the public website and authenticated application separately. A provider's appearance in the Suboperator List does not mean that its cookie, SDK or replay function is active on every surface.
4. Information Collected
4.1. Depending on the technology and configuration, cookie-related information may include an IP address; cookie, session, User or device identifier; browser, device and operating-system information; referring and requested pages; timestamps; feature interactions; settings; authentication state; approximate location derived from an IP address; performance; and diagnostic or security events. Where enabled after the applicable choice, Zoho may record a visitor's interactions with the Online Services, including page navigation, clicks, scrolling and mouse movement, and reproduce them as a video-like session replay. This feature does not access the visitor's camera or microphone. Sensitive fields and information must be masked or excluded from recording. A surface using session recording must display a prominent disclosure before activation.
4.2. Henry aims to minimise substantive Tenant content in analytics and may use cookieless, aggregated or pseudonymous configurations where appropriate. Pseudonymous information remains personal information where it can be linked to an identifiable person by a reasonably foreseeable method.
4.3. Henry processes cookie-related personal information for the purposes stated in this Policy and the Privacy Policy, on an applicable ground under POPIA or other law. Depending on the activity, that ground may include necessity for a contract or requested service, legal obligation, legitimate interests that are not overridden, or consent.
4.4. Session recording, analytics, replay and heatmap configurations must technically exclude passwords, authentication tokens, payment-card fields, bank or financial details, identity numbers and documents, free-text fields likely to contain sensitive content, Children's Information, Special Personal Information and fields designated confidential by the Product Schedule. Masking must be tested before activation and after a material form or provider change. If reliable exclusion is not available, recording on the affected surface must remain disabled.
5. Providers and Technologies
5.1. Henry may use third-party providers that place or access cookies or similar storage when their relevant features are enabled. A listed provider or technology does not necessarily operate on every page or visit.
5.2. The current provider identities, purposes, information categories and principal processing locations are maintained in the Suboperator List.
5.3. A provider may process information outside South Africa subject to the transfer safeguards described in the Privacy Policy Section 8.
5.4. Cookie names, storage methods and durations can change when security controls, providers or product configurations change. Henry will update the register before activating a changed or new optional technology and will keep an archived version tied to the relevant consent record. Browser storage and the recorded consent event provide visit-specific evidence. Henry will also provide reasonable information about a cookie or identifier on request.
6. Choices and Controls
6.1. The cookie banner or preference tool provides equally accessible Accept optional, Reject optional and category-level controls without preselected optional choices. A person may change the choice at any time through the persistent cookie-preferences link. A choice applies to the browser or device on which it is made and may need to be repeated after cookies are cleared, a browser is changed or another device is used.
6.2. Most browsers allow a person to view, block or delete cookies and clear local storage. Browser help pages explain the available controls. Blocking all cookies may prevent authentication and impair security, settings or functionality.
6.3. Where consent is the applicable ground, it may be withdrawn as easily as it was given through the available preference tool or by clearing or blocking the relevant optional technology. Withdrawal does not affect processing that was lawful before withdrawal.
6.4. Withdrawing or rejecting an optional category must prevent new optional collection and trigger the applicable deletion or restriction process for associated identifiers and events, subject to the Retention Schedule and a minimal consent or opt-out proof record. A support or authentication function may not be made conditional on optional analytics consent.
6.5. Browser-based global privacy signals will be respected where required by applicable law and technically supported. Because such signals are not interpreted uniformly, visitors should also use the controls described above.
7. Retention and Security
7.1. Session technologies ordinarily expire when the session ends. Unless the relevant interface identifies a shorter period, persistent authentication and security cookies expire within 12 months, preference and consent-choice cookies within 12 months, and identifiable analytics event data within 14 months. A record may be kept for longer only where reasonably necessary to investigate security or fraud, prove a consent or opt-out, comply with law or preserve a legal claim, and must then be restricted to that purpose. Browser deletion may remove a cookie earlier. The complete lifecycle is governed by the Retention, Deletion and De-identification Schedule.
7.2. Cookie-related information is protected by the safeguards described in the Privacy Policy Section 10. No browser or internet technology is completely secure.
8. Changes to This Policy
8.1. Henry may update this Policy when its Online Services, providers, technologies or legal obligations change. The Effective Date and version identify the current text. A materially adverse change ordinarily applies on renewal or after at least 30 days' notice, while an urgent legal or security change may apply earlier to the extent reasonably necessary. Henry will provide any additional notice or choice required by law.
8.2. A material new purpose is not authorised merely because this Policy is changed. Where consent is required for that purpose, Henry will request it before using the relevant optional technology.
END OF COOKIES POLICY