Cookie and Device Storage Policy

The inventory in Schedules 1 and 2 reflects the CEMCS Hub code as reviewed on 25 October 2026, when the schedule was reconciled against the storage registries in both the portal and the mobile app. It must be re-verified whenever a release changes cookies, storage or third-party code.

Contents

1. About this Policy
2. Definitions
3. The short version
4. Why the law applies
5. How CEMCS decides what to use
6. Categories
7. The member portal
8. The mobile app
9. Payment pages
10. The portal welcome page
11. Emails
12. What CEMCS does not use
13. Choices and consent
14. How to manage cookies and storage
15. Retention of data collected through these technologies
16. Security
17. Your rights
18. Governance
19. Changes
20. Contact Schedule 1: Portal cookies and browser storage Schedule 2: Mobile app device storage and identifiers Schedule 3: Third-party pages and content Schedule 4: Browser and device instructions

1. About this Policy

1.1 This Policy explains how CEMCS Hub uses cookies, browser storage and storage on your phone, what each item holds, why, how long it lasts, and what choices you have.

1.2 It applies to the CEMCS Hub member portal (including the public pages: the welcome page, sign-in, registration, password reset, the membership verification page and the guarantor response page), the CEMCS Hub mobile app, and emails sent by CEMCS Hub.

1.3 This Policy forms part of the CEMCS Hub Privacy Policy. Where these technologies involve personal data, the Privacy Policy explains how it is used and your rights.

2. Definitions

3. The short version

3.1 CEMCS Hub uses cookies and storage only to:

1. keep you signed in;
2. protect your account and the portal from attack;
3. recognise devices you have used before, for security;
4. remember a few settings you choose, such as hiding balances or your colour theme;
5. keep your shop basket;
6. deliver push notifications; and
7. report errors so they can be fixed.

3.2 CEMCS Hub does not use advertising cookies, analytics or tracking tools, social media plugins, or advertising identifiers.

3.3 Because everything CEMCS Hub stores is either strictly necessary or a setting you have chosen yourself, the portal does not show a cookie consent banner. If CEMCS ever adds a technology that needs consent, it will ask first (Section 13).

4. Why the law applies

4.1 Cookie values, device identifiers, push tokens and IP addresses can identify you, so they are personal data under the NDPA. CEMCS must have a lawful basis under section 25 and, where it relies on consent, must meet section 26.

4.2 The NDPR Implementation Framework required websites to tell users about cookies and get consent for non-essential ones. CEMCS follows that standard to the extent consistent with the NDPA.

4.3 CEMCS’s lawful bases for the technologies in this Policy are:

1. contract, for technologies needed to provide the service you have signed in to use or a feature you have switched on;
2. legitimate interests, for security and error reporting; and
3. consent, for anything non-essential. At the date of this Policy, CEMCS Hub uses nothing that requires consent, other than content loaded on the public welcome page (Section 10), which CEMCS will either self-host or bring under consent [see gap register].

5. How CEMCS decides what to use

5.1 Flexcom keeps a register of every cookie and storage key in the CEMCS Hub code. The portal’s and the app’s automated tests fail if code stores something that is not in the register, so nothing can be added without being recorded. Schedules 1 and 2 are taken from that register.

5.2 Before anything is added, CEMCS and Flexcom check that it is necessary, that it collects the minimum data, that it is secure, and how long it should last. Anything that is not strictly necessary or a user-chosen setting needs the DPO’s approval and an update to this Policy.

6. Categories

7. The member portal

7.1 Signing in

7.1.1 When you sign in, CEMCS Hub’s server (built on the Frappe platform) sets a session cookie called sid. It contains a random token and nothing else. It is HttpOnly and is sent only to CEMCS Hub. While it exists you stay signed in; when you sign out or your session ends, it stops working.

7.1.2 At sign-in the platform also sets four small cookies, system_user, full_name, user_id and user_image, which hold whether you are a staff user, your name, your login identifier and the address of your profile picture, so the page can display them. They are cleared when you sign out. [Flexcom to confirm these are set with the Secure attribute on the production site.]

7.2 Protection against forged requests

7.2.1 The portal stores a token in a cookie called frappe.csrf_token and sends it with every change you make, so that another website cannot make changes in your name. It is set for the whole portal, with SameSite=Lax and Secure on HTTPS. It lasts until you close your browser and is cleared when you sign out.

7.3 Recognising your browser

7.3.1 CEMCS Hub sets a cookie called cemcs_did that identifies your browser as a device. It holds a random identifier signed by CEMCS’s server so it cannot be forged. It is HttpOnly, Secure and SameSite=Lax, and lasts up to one year. CEMCS uses it to list your trusted devices in Settings, recognise sign-ins from a known browser, and apply additional checks to unfamiliar ones. It is replaced when you change your password. You can remove the device in Settings > Sessions, or delete the cookie in your browser; you will then be treated as a new device.

7.4 Your settings and basket

7.4.1 The portal stores in your browser’s localStorage whether you have chosen to hide balances (cemcs:hideBalances), your colour theme (cemcs:theme) and accent colour (cemcs:accent), the position of the assistant button (cemcs-chat-widget-position-v1), whether you have dismissed the prompts to install or open the mobile app (cemcs:app-prompt-dismissed, cemcs:app-open-dismissed), and your shop basket as product codes and quantities (cemcs.cart.v1). None of these hold your name, membership number or account data.

7.4.2 In sessionStorage, which is cleared when you close the tab, the portal remembers the position of the shop’s product carousel (cemcs.shop.rail) and whether it has already counted your visit for error-reporting purposes (cemcs.monitor.session-pinged).

7.5 Error reporting

7.5.1 If the portal encounters an error, it sends a report through the portal’s own server to CEMCS Monitor. No cookie is used. Section 9.2 of the Privacy Policy describes what reports contain and how they are redacted.

7.6 Pages not stored

7.6.1 Signed-in portal pages are sent with instructions that stop your browser and any shared cache from storing them, so your account pages are not left in browser history caches on shared computers.

8. The mobile app

8.1 How the app is different

8.1.1 The mobile app does not use browser cookies. It stores a small amount of information in its private storage on your phone and in your phone’s Keychain or Keystore. Other apps cannot read it. The Android app does not allow its data to be copied into device or cloud backups.

8.2 Your sign-in session is not stored

8.2.1 When you sign in, the app holds your session token only in memory. It is never written to your phone’s storage. Your session ends when you close the app, when the app has been in the background for 30 minutes, or when you sign out. When you sign out, the app also tells CEMCS’s server to end the session and stop sending push notifications to that phone.

8.3 Secure storage (Keychain / Keystore)

8.3.1 Your fingerprint and face data stay in your phone’s own biometric system. Neither the app nor CEMCS ever receives them.

8.4 App storage

8.4.1 On Android, crashes that occur in the phone’s native code are written to a small file in the app’s private storage until they are sent.

8.4.2 Data you view in the app, such as balances and statements, is held in memory for up to a minute to make the app faster, and is not saved to your phone. Drafts of applications are saved on CEMCS’s servers, not on your phone.

8.5 Push notifications

8.5.1 If you allow notifications, Google Firebase Cloud Messaging (and, on iPhone, Apple Push Notification service) issues a push token for your phone. After you sign in, the app sends CEMCS the token, the random installation identifier, the platform (iOS or Android) and a label (“iPhone” or “Android”). CEMCS uses these only to send you notifications. The app uses Firebase for push notifications only; Firebase analytics and advertising features are switched off.

8.5.2 When you sign out, the app asks CEMCS to stop using the token. You can turn notifications off in your phone’s settings or choose channels in Settings > Notifications.

8.6 Live updates

8.6.1 While you are signed in, the app and portal keep a secure connection open to CEMCS Hub so notifications, balances and Trade It bids update without refreshing. This uses your existing session and stores nothing extra on your phone.

8.7 Identifiers the app does not use

8.7.1 The app does not access the Apple advertising identifier (IDFA) or the Google advertising ID, does not show Apple’s tracking prompt because it does not track you, and does not read hardware identifiers such as IMEI, serial number or MAC address. The app’s privacy declaration to Apple states that it does not track.

9. Payment pages

9.1 CEMCS Hub does not currently accept online card or bank payments, so it does not open any third-party payment page. If CEMCS introduces an online payment service, any cookies or storage that service uses will be added to this Policy before it starts.

10. The portal welcome page

10.1 The portal’s public welcome page displays photographs served by Unsplash (images.unsplash.com). When the page loads, your browser requests the images from Unsplash, which receives your IP address and browser information as part of that request. CEMCS does not share any account data with Unsplash. [CEMCS will host these images on its own servers before go-live so that no third-party request is made; see the gap register.]

10.2 The portal’s fonts are stored on CEMCS Hub’s own servers, so no request is made to Google Fonts.

11. Emails

11.1 CEMCS Hub emails do not contain tracking pixels, and links are not rewritten to track clicks. [Flexcom to confirm the production email delivery provider has open and click tracking switched off.]

12. What CEMCS does not use

12.1 CEMCS Hub does not use:

1. analytics tools, such as Google Analytics, Firebase Analytics, Microsoft Clarity, Hotjar, PostHog or Vercel Analytics;
2. third-party crash reporting, such as Crashlytics or Sentry;
3. advertising, retargeting or remarketing cookies;
4. social media pixels, buttons or plugins;
5. session recording or screen replay;
6. device fingerprinting for tracking;
7. advertising identifiers; or
8. third-party chat widgets.

12.2 If CEMCS ever wants to use any of these, it will update this Policy and the Privacy Policy beforehand and ask for your consent before use.

13. Choices and consent

13.1 Strictly necessary technologies are used without consent because CEMCS Hub cannot work or stay secure without them. They are listed here so you know about them.

13.2 Settings you choose are stored because you chose them. Changing or clearing the setting removes the stored value.

13.3 If CEMCS introduces a technology that requires consent, CEMCS Hub will, before using it:

1. show a notice explaining what it is, who provides it and why;
2. give “Accept” and “Reject” options with equal prominence;
3. treat closing the notice as rejection;
4. record your choice with the date, time, version of this Policy and channel; and
5. give you a permanent link in the portal footer and in the app’s Settings to change your mind.

14. How to manage cookies and storage

14.1 Portal. Sign out to end your session and clear the session and request-protection cookies. Remove a browser from Settings > Sessions to stop it being treated as a trusted device. Clear site data in your browser to remove everything (Schedule 4).

14.2 Mobile app. Turn off biometric unlock in Settings. Remove devices in Settings > Sessions. Turn off notifications in your phone’s settings or choose channels in Settings > Notifications. Uninstall the app to remove all its storage.

14.3 Blocking strictly necessary cookies will stop you signing in to the portal.

15. Retention of data collected through these technologies

16. Security

16.1 CEMCS Hub protects these technologies by:

1. setting session and device cookies as HttpOnly and Secure, and limiting cross-site sending with SameSite;
2. signing the device cookie so it cannot be forged, and replacing it on password change;
3. keeping the mobile session token in memory only;
4. storing the device identifier and biometric credential in the Keychain or Keystore, bound to the phone;
5. storing only hashed copies of biometric credentials on CEMCS’s servers;
6. limiting repeated failed biometric sign-ins;
7. applying a strict content security policy on the portal that controls which scripts can run;
8. checking the server’s certificate in the mobile app (certificate pinning); and
9. preventing the Android app’s data from being backed up.

17. Your rights

17.1 Your rights over personal data collected through these technologies are set out in Section 24 of the Privacy Policy. Contact the DPO at [dpo@cemcs.com].

18. Governance

18.1 The DPO owns this Policy. Flexcom maintains the storage registers in the portal and app code and must:

1. update Schedules 1 and 2 whenever a release adds, removes or changes a cookie, storage key, identifier or third-party script;
2. not add any non-essential technology without the DPO’s written approval and an update to this Policy; and
3. scan the production portal with a cookie scanning tool and review the app’s third-party libraries before go-live and at least every six months.

19. Changes

19.1 CEMCS will update this Policy when CEMCS Hub’s use of these technologies changes, and will ask for consent before using any new technology that requires it. The current version is at https://hub.cemcs.com/legal/cookie-policy and in the app under Settings > Legal.

20. Contact

Schedule 1: Portal cookies and browser storage

1.1 Cookies

1.2 localStorage

Development-only keys (cemcs:fixtureExitState, cemcs:fixtureExitOutcome, cemcs:fixtureBigBalances) are used only in test builds and are not set on the production portal. Confirmed: the portal's fixture mode is off in production, so nothing writes these keys.

1.3 sessionStorage

Schedule 2: Mobile app device storage and identifiers

2.1 Keychain / Keystore

2.2 App storage (AsyncStorage)

2.3 Other device data

2.4 Third-party code in the app

No other third-party code in the app sends data off your phone.

Schedule 3: Third-party pages and content

Schedule 4: Browser and device instructions

Menu names vary by browser version, phone maker and operating system.