Comprehensive Cookie & Tracking Technologies Notice

Article 1: Issuing Entity & Contractual Scope

EYC TECHNOLOGY AND ARTIFICIAL INTELLIGENCE COMPANY LIMITED ("EYC", "we", "us", or "our"), operating under Enterprise Registration Certificate No. 0319723892 issued by the Department of Planning and Investment of Ho Chi Minh City, having its registered corporate headquarters at 2nd Floor, 68 Nguyen Hue, Sai Gon Ward, Ho Chi Minh City, Vietnam, publishes this Comprehensive Cookie & Tracking Technologies Notice ("Notice") to provide transparent and exhaustive disclosure regarding our utilization of HTTP cookies and client-side storage technologies.

This Notice governs all individuals and commercial entities accessing, browsing, or interacting with digital assets hosted across our official corporate domain eyc.asia and all auxiliary web applications operated by EYC.

• Integration with Data Privacy Policy: This Notice forms an integral, legally binding part of EYC's Comprehensive Enterprise Data Privacy Policy, detailing granular technical provisions governing client-side digital identifiers.
• Universal Scope: This Notice applies equitably to public site visitors, institutional partners, technical architects, and enterprise customer administrators.

Article 2: Applicable Legal Framework & International Privacy Standards

EYC's Cookie Governance Architecture is engineered in rigorous compliance with prominent global and domestic data privacy frameworks:

• Global Privacy & Telecommunications Regulations: Fully adhering to international telecommunications privacy frameworks, the EU ePrivacy Directive (Directive 2002/58/EC as amended), GDPR Article 7, and global statutory consent requirements governing access to terminal equipment.
• European Union Standards: Compliant with the EU ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC) and the General Data Protection Regulation (EU GDPR / UK GDPR) mandating affirmative, prior opt-in consent for non-essential tracking mechanisms.
• United States Privacy Laws: Fully compatible with transparency and opt-out requirements under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
• IETF & W3C Engineering Specifications: Strictly implementing RFC 6265bis specifications governing secure cookie attributes, including SameSite, Secure, and HttpOnly flags.

Article 3: Technical Definitions & Client-Side Storage Technologies

For clarity, the storage and browser identification technologies referenced in this Notice are defined as follows:

• HTTP Cookie: A compact text file containing an alphanumeric identifier transmitted by a web server to your browser and stored locally on your device to facilitate state recognition across consecutive sessions.
• Session Cookies: Ephemeral identifiers active exclusively during the current browsing session, permanently purged from memory immediately upon browser closure.
• Persistent Cookies: Durable identifiers that remain stored on device non-volatile memory for a predetermined technical lifespan (never exceeding 12 months) or until explicitly purged by the user.
• HTML5 LocalStorage & SessionStorage: High-capacity browser-native key-value storage mechanisms that do not transmit data within HTTP headers, accelerating page rendering and securing interface states.
• Web Beacons & Pixels: Transparent graphic pixels (1x1) utilized strictly for aggregated network latency and delivery verification.
• Device Fingerprinting: EYC does not use canvas, audio, or hardware fingerprinting techniques to profile device configurations.

Article 4: Strictly Necessary & Operational Security Cookies

Strictly necessary cookies represent technical essentials required for eyc.asia to execute secure communication, maintain operational integrity, and deliver requested navigational services.

Under international privacy jurisprudence and the EU ePrivacy Directive, strictly necessary technical cookies are exempt from prior consent requirements because platform delivery and secure session transmission are technically impossible in their absence.

• Infrastructure Security & DDoS Mitigation: Edge security tokens deployed via Cloudflare (e.g., cf_clearance, __cf_bm) to authenticate legitimate web clients, defeat automated botnets, and enforce Web Application Firewall (WAF) policies.
• Contact Form Protection: The contact form is protected by Cloudflare security services and server-side rate limiting. EYC does not set a separate CSRF cookie.
• Consent Decision Memory: Storing your cookie choice in the browser's localStorage under the key eyc-cookie-consent-v1, so the banner does not reappear on every page.
• Language Routing: The language version is part of the page address (/en-us/ or /vi-vn/). No language cookie is set.

Article 5: Functional & User Interface Preference Cookies

Functional cookies and browser storage tokens preserve custom user interface settings, delivering a smooth, customized visual experience across consecutive visits.

These mechanisms do not track personal identities in real life, serving exclusively to preserve aesthetic choices and navigational context.

• Theme Mode Selection (Dark / Light): Storing your display preference in localStorage under the key eyc-theme, preventing visual flickering between dark and light themes during page transitions.
• Typography Font Loading Optimization: Caching display states for self-hosted typography subsets (Be Vietnam Pro for Vietnamese, IBM Plex Sans for English) to eliminate Cumulative Layout Shift (CLS) and Flash of Unstyled Text (FOIT).
• Technical State Caching: Preserving expansion and collapse states across interactive enterprise architecture diagrams and multi-part legal tables.

Article 6: Technical Performance & Privacy-Preserving Analytics

To continuously optimize server responsiveness, throughput, and structural rendering, EYC deploys measurement instruments engineered upon privacy-by-design foundations.

All telemetry is processed strictly as aggregated, anonymous technical distributions with zero correlation to individualized user identities or personal dossiers.

• Core Web Vitals Monitoring: Measuring Largest Contentful Paint (LCP), Interaction to Next Paint (INP), and Cumulative Layout Shift (CLS) to maintain fast page delivery.
• Analytics (optional): If you accept analytics in the cookie settings, Cloudflare Web Analytics measures aggregated page performance without setting tracking cookies. If you choose essential cookies only, the analytics beacon is disabled.
• Error Diagnostics: Capturing aggregated HTTP 404 or 500 error frequencies enabling DevOps engineers to resolve broken endpoints without monitoring user browsing journeys.

Article 7: No Behavioral Tracking Ad Networks

EYC keeps eyc.asia free of advertising trackers and respects the privacy of every visitor.

EYC does not embed third-party commercial advertising networks (such as Meta Pixel, Google Remarketing, TikTok Pixel, LinkedIn Insight Tag, or Criteo) on eyc.asia.

• Zero Cross-Site Tracking: We never track your browsing journeys across external digital properties after you depart our portal.
• No Behavioral Profiling: EYC never harvests behavioral records to build consumer psychographic profiles or targeted retargeting ad campaigns.

Article 8: Notice of "No Sale" and "No Sharing" of Personal Information

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), "Sale" or "Sharing" entails transferring personal identifiers to third parties for monetary consideration or cross-context behavioral advertising.

EYC formally declares: We do not sell and do not share personal information, IP telemetry, or cookie identifiers with any third parties under any circumstances.

• No Commercial Consideration: EYC receives zero financial compensation or commercial benefits from transferring visitor telemetry.
• Exemption from Opt-Out Links: Because we never engage in personal data sales or cross-context sharing, a mandatory "Do Not Sell My Personal Information" link is legally unnecessary, yet complete opt-out controls remain perpetually accessible via our Cookie Settings center.

Article 9: Technical Edge Infrastructure & Service Subprocessors

To deliver lightning-fast static assets and safeguard computing infrastructure against massive distributed cyber threats, EYC partners with leading cloud infrastructure providers.

These partners function strictly as Data Subprocessors bound by rigorous Data Processing Agreements (DPAs):

• Cloudflare, Inc. (United States & Global): Delivers global Content Delivery Network (CDN) caching, authoritative DNS, and Web Application Firewall (WAF) mitigation. Cloudflare generates strictly necessary security cookies to isolate malicious traffic from genuine human visitors.
• Edge Processing: Requests are handled by Cloudflare edge data centers near the visitor's location. Security certifications for this infrastructure are held by Cloudflare, not by EYC.

Article 10: Granular Cookie Inventory by Technical Name

The inventory below lists the cookies and browser storage keys used on eyc.asia:

• cf_clearance (First-Party / Cloudflare): Strictly necessary security cookie confirming a browser has passed a Cloudflare security check, preventing repeated challenges. Retention lifespan: up to 1 year, as set by Cloudflare and subject to change.
• __cf_bm (First-Party / Cloudflare): Strictly necessary bot management cookie distinguishing human visitors from automated bots. Retention lifespan: 30 minutes, as set by Cloudflare and subject to change.
• eyc-cookie-consent-v1 (First-Party / localStorage): Strictly necessary key recording your cookie choice (essential only, or analytics allowed) and the time it was made. Retention: until you change your choice or clear your browser storage.
• eyc-theme (First-Party / localStorage): Functional key storing your dark or light mode selection. Retention: until you clear your browser storage.
• Cloudflare Web Analytics (optional): Loads only if you allow analytics. It does not set cookies on your device.
• No other cookies: EYC does not set language, CSRF, or advertising cookies on eyc.asia.

Article 11: Data Retention Lifecycle & Automatic Expiration Mechanisms

Cookies and client-side storage used by EYC have defined lifecycles.

• Automated Temporal Expiration: All persistent cookies incorporate strict Max-Age and Expires attributes; once expired, client browsers immediately purge the files without user intervention.
• Retention Limit: Cookies set by EYC do not persist beyond twelve (12) months. Cloudflare security cookies follow the lifetimes set by Cloudflare. localStorage keys remain until you change your choice or clear browser storage.
• Revocation: When you change your choice in the Cookie settings, the new choice is saved immediately and the analytics beacon is disabled if analytics is no longer allowed.

Article 12: Prior Opt-In Consent Mechanism & Banner Architecture

Upon your initial visit to eyc.asia from a new browser or clean profile, a standardized Cookie Consent Banner is rendered at the bottom viewport.

EYC follows a prior opt-in approach: apart from strictly necessary security and operational storage, analytics is enabled only after you allow it.

• Unconstrained Choice: You maintain complete liberty to select "Accept All", "Essential Only", or launch the granular configuration modal to toggle specific categories.
• Prohibition of Dark Patterns: We present buttons with equivalent visual prominence and contrast, rejecting deceptive design tactics engineered to force consent.

Article 13: Consent Revocation & Perpetual Cookie Settings Center

Your consent is voluntary, and you can change or withdraw it at any time.

We provide a permanent "Cookie settings" trigger within the footer across every page of eyc.asia. Activating this link instantly invokes the configuration modal, allowing you to reconfigure preferences on demand.

• Revocation Enforcement: Turning off analytics saves your new choice and disables the analytics beacon.
• Unrestricted Portal Access: Declining or revoking non-essential cookies has zero impact on your ability to explore engineering documentation, review solutions, or transmit commercial inquiries.

Article 14: Global Privacy Control (GPC) Signals

Global Privacy Control (GPC) is a browser setting that sends an opt-out signal to websites.

eyc.asia does not currently read the GPC signal automatically. Because EYC does not sell or share personal data and runs analytics only after you allow it, no optional tracking takes place unless you opt in.

• Your choice applies: Select "Essential only" in the cookie banner or the Cookie settings link to keep analytics off.
• Future updates: If EYC adds automatic GPC handling, this Notice will be updated.

Article 15: Step-by-Step Configuration Guides for Major Browsers

In addition to on-site controls, you hold sovereign control to audit, inspect, block, or delete cookies directly within the security settings of your web browser.

• Google Chrome: Navigate to Settings > Privacy and security > Third-party cookies > Select "Block third-party cookies" or inspect "See all site data and permissions" to purge stored records.
• Apple Safari: Navigate to Settings > Privacy > Enable "Prevent cross-site tracking" (ITP) and select "Block all cookies" if complete isolation is desired.
• Mozilla Firefox: Navigate to Settings > Privacy & Security > Enhanced Tracking Protection > Select "Strict" mode to automatically neutralize cross-site trackers and fingerprinters.
• Microsoft Edge: Navigate to Settings > Cookies and site permissions > Manage and delete cookies and site data.
• Incognito & Private Browsing: Utilizing private browsing windows ensures that all session tokens and temporary cookies are automatically destroyed the moment all private windows are closed.

Article 16: Technical Impacts of Complete Cookie Deactivation

While you possess full liberty to deactivate all cookies, blocking strictly necessary security tokens will result in observable functional degradations across the platform.

• Repetitive Bot Verifications: Blocking Cloudflare security cookies will trigger frequent interactive CAPTCHA or Turnstile verifications to prove client authenticity.
• Loss of Preferences: If browser storage is blocked or cleared, your theme choice and cookie choice will not be remembered and the banner may reappear.

Article 17: Stateless API Infrastructure & AI Agent Data Isolation

EYC keeps public website cookies separate from enterprise AI processing pipelines.

All Application Programming Interfaces (APIs), Model Context Protocol (MCP) bridges, and autonomous agent coordination workflows operate strictly upon Stateless Architectures or cryptographic bearer tokens.

• No Cookies in AI Pipelines: Browser cookies are not injected into LLM prompts, agent context windows, or vector database indices.
• Complete Isolation from Enterprise Tenant Data: Enterprise production workspaces remain isolated via TenantScope logical partitions, completely uncoupled from public portal web identifiers.

Article 18: Enforceability, Amendment Procedures & Official DPO Inquiries

This Comprehensive Cookie & Tracking Technologies Notice becomes formally effective on October 3, 2026, superseding all prior cookie declarations.

EYC conducts formal annual reviews of tracking mechanisms and updates this Notice promptly whenever new edge infrastructure or data protection regulations emerge.

• Re-Consent Triggers: If material revisions introduce new cookie categories requiring statutory consent, the consent banner will automatically re-render upon your next visit.
• Data Protection Officer (DPO) Inquiries: Technical inquiries, compliance audits, or privacy requests regarding tracking technologies should be directed to our Data Protection Officer at: info@eyc.asia.
• Official Postal Notices: Formal correspondence may be transmitted to: EYC TECHNOLOGY AND ARTIFICIAL INTELLIGENCE COMPANY LIMITED, 2nd Floor, 68 Nguyen Hue, Sai Gon Ward, Ho Chi Minh City, Vietnam.