Cookie Policy
1. About this Policy
This Cookie Policy describes the cookies and similar browser-storage technologies (localStorage, sessionStorage and equivalent mechanisms) used on https://beehox.com and on the Beehox dashboard. It supplements our Privacy Policy: any personal data captured through cookies is processed under the rules set out there.
If you are in the European Economic Area, the United Kingdom, Switzerland, Hong Kong or another jurisdiction with comparable rules, non-essential cookies are set only after you give consent through the banner shown on your first visit. You can change your decision at any time — see section 9.
Carbonmall Coal Sales Special Limited is the controller for the processing described in this Policy. Our contact details are in the final section.
2. What is a cookie and which technologies we use
A cookie is a small text file that a website asks your browser to store on your device. Each subsequent request to the same domain includes the cookie, which lets the site recognise you and remember preferences without forcing you to log in or reconfigure everything on every page load.
We also use localStorage and sessionStorage. These work similarly to cookies but are scoped to a single tab (sessionStorage) or kept on your device until you clear them (localStorage). The rules in this Policy apply equally to all three technologies. Where we refer to ‘cookies’ below, the same statements apply to localStorage and sessionStorage entries used for the same purpose.
How cookies are categorised
- First-party — set by beehox.com directly.
- Third-party — set under a different domain by a service we load on the page, such as a security and CDN provider or, where you give consent, an analytics provider.
- Session — deleted when you close the browser.
- Persistent — remain for a defined period or until you erase them.
3. How we ask for your consent
On your first visit to the website or dashboard, we display a cookie banner that asks for your decision. The banner offers at least three actions: Accept all (load all categories), Reject all (load only strictly-necessary cookies) and Settings (granular per-category choice). Your decision is recorded in the first-party cookie cookie_consent described in the table below; no analytics or marketing cookies are set before you make a choice.
We treat continued use without making a choice as a non-decision: the banner remains visible and non-essential cookies remain inactive. Closing the banner does not count as consent.
You can withdraw or change consent at any time using the cookie-settings entry point in the website footer, which reopens the banner. Withdrawal does not affect the lawfulness of any processing carried out before withdrawal.
We also respect the Global Privacy Control (GPC) signal and the Do-Not-Track (DNT) browser header. Where either is enabled, we treat it as an opt-out from non-essential cookies even if cookie_consent is set to accepted.
4. Strictly necessary cookies
These cookies are required for the website and dashboard to function. They cannot be disabled through our banner. If you block them in your browser, parts of the Services will stop working. They are set without prior consent under Article 5(3) of the EU ePrivacy Directive as transposed in your country.
| Cookie | Type | Duration | Purpose |
|---|---|---|---|
cookie_consent | First-party, persistent | 12 months | Stores your decision from the consent banner using a versioned format. Without it the banner would re-appear on every page load. |
| Dashboard session cookies | First-party, session | Until logout or tab close | Set by the dashboard after login to authenticate the session and to protect against CSRF. Scoped to the dashboard subdomain. |
| Theme and locale preferences | First-party, persistent | 12 months | Remember whether you chose light or dark theme and the interface language you selected on the website. |
| Security and bot-protection cookies | Third-party, session / up to 30 days | Up to 30 days | Set by our security and content-delivery provider to distinguish human visitors from automated traffic and to issue cleared-traffic tokens after a challenge has been passed. Required to keep the service available under denial-of-service attacks. |
5. Functionality cookies
Optional cookies that remember preferences you set during a visit so you do not need to set them again on the next visit. We load these only after consent in the banner.
| Cookie / Storage key | Type | Duration | Purpose |
|---|---|---|---|
| Marketing-page language preference | First-party, persistent | 12 months | Stores the language choice you made through the switcher on the marketing site. |
| Cookie-settings dialog state | First-party, persistent | 12 months | Stores granular category choices you made in the cookie-settings modal so the banner can show the right state when you reopen it. |
6. Analytics cookies (only after consent)
If you accept analytics in the cookie banner, we load a third-party analytics script with IP anonymisation enabled. The script measures aggregated traffic, helps us understand which pages and features are used, and powers basic session and event metrics. Without consent the analytics script is not loaded and no analytics cookies are set.
Analytics cookies are typically persistent (up to twenty-four months) and are scoped to the analytics provider's own domain. They are used to distinguish individual visitors and store session state — not for cross-site tracking and not for cross-context behavioural advertising.
7. Customer-experience cookies (only after consent)
If you open an in-product feedback widget on the website or dashboard, it is provided by a third-party tool. The widget loads only when you choose to open it, and only after the relevant cookie category has been accepted in the banner.
These cookies store the widget's state during your visit (for example, which conversations and feature-requests you have opened) and, if you sign in to vote on or comment on feature requests, identify you across visits for up to twelve months. They are not used for cross-site tracking or advertising.
8. Cookies we do not set
For clarity, we do not use:
- cross-context behavioural advertising cookies;
- retargeting pixels;
- social-network ‘like’ or ‘share’ buttons that drop cookies on page load;
- fingerprinting libraries that build a non-consent-based identifier;
- session-recording tools that capture form inputs.
We do not share any data collected through cookies with advertising networks. If we ever introduce such categories, the cookie banner will be re-displayed and we will not load anything new until you give explicit consent.
9. Controlling cookies
Through our banner
The banner appears on the first visit and after you clear our cookies. To change your decision later, click the ‘Cookie settings’ link in the website footer; the banner will reopen and you can adjust per-category choices.
Through your browser
All modern browsers let you view, block and delete cookies on a per-site basis. The relevant menus are usually under Settings → Privacy & Security. Note that blocking strictly-necessary cookies will break the dashboard.
On mobile devices
Browser cookies on iOS Safari, Chrome on Android, Firefox Mobile and the Telegram in-app browser are managed in the same way as on desktop, though the menu paths differ. Refer to your browser’s documentation if you cannot find the right menu.
Global Privacy Control and Do-Not-Track
We honour the GPC signal and the DNT header. When either is set we will not load analytics or any non-essential third-party scripts, even if cookie_consent is set to accepted. To enable GPC, use a browser or extension that supports it; to enable DNT, see your browser’s privacy settings.
Third-party opt-out tools
Several third-party tools and browser extensions let you opt out of analytics across many sites at once. A good overview is available at https://www.aboutcookies.org/.
10. How long cookies last
Each cookie entry above specifies its duration. As a general rule, session cookies are deleted when you close the browser; persistent cookies last for the period stated, after which the browser deletes them automatically.
We periodically refresh persistent cookies on activity. For example, cookie_consent is refreshed each time you visit the website so that your stored decision lasts for twelve months from the most recent visit. Once you stop visiting the site, persistent cookies expire on their own schedule.
Clearing your browser’s cookies or running it in private / incognito mode removes all stored cookies immediately. The next visit will trigger the banner again because cookie_consent is no longer present.
11. Children
The Services are not directed at children under the age of sixteen. We do not knowingly serve our cookie banner to anyone we know to be under that age, and we do not set non-essential cookies on visitors we identify as minors. If you become aware that a child has interacted with the cookie banner on our site, please contact us using the details below.
12. International transfers
Some of the third-party services that may set cookies on our website operate from countries outside the European Economic Area, the United Kingdom and Switzerland. When they receive data via cookies, they act as separate controllers or processors under their own contracts with us, and they rely on transfer mechanisms appropriate for international transfers, including the European Commission's Standard Contractual Clauses and supplementary technical and organisational measures where required.
Our Privacy Policy describes our overall approach to international transfers in more detail.
13. Updates to this Policy
We will update this Policy whenever we add or remove a cookie, change the duration or purpose of an existing cookie, introduce a new third-party tool or change the category in which a cookie is treated. The ‘Effective’ date at the top of this page is bumped on every revision.
If we introduce a new category that requires consent (for example, a marketing or advertising category), the cookie banner will be re-shown before any new cookies in that category are set. Until you choose, the new category remains inactive.
14. Your rights
Withdrawing cookie consent is one of the data-subject rights we describe in our Privacy Policy. You also have rights of access, rectification, erasure, restriction, objection and portability with respect to personal data collected through cookies. See section 8 of the Privacy Policy for the full list and how to exercise these rights.
If you have a complaint about how we handle cookies you can lodge it with the supervisory authority in your country of residence or with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong. We would appreciate the opportunity to address your concern first by email at team@beehox.com.
Contact
Carbonmall Coal Sales Special Limited is a company incorporated in Hong Kong under registration number 3348577, with its registered office at Rm 06, 13A/F., South Tower, World Finance Centre, 17 Canton Road, Harbour City, Tsim Sha Tsui, Kowloon, Hong Kong SAR.
For any questions about this document, requests to exercise your data-subject rights, or anything else covered above, please email team@beehox.com from the email address associated with your account. We aim to acknowledge requests within five business days and to provide a substantive reply within thirty days. We may extend that period for complex requests, in which case we will tell you so in writing.
Written correspondence can be sent to the registered office above. Please mark envelopes "Legal — Carbonmall Coal Sales Special Limited" so they reach the right team.