Cookie Policy

Which cookies and browser storage our website and client portal use, what each one does, how long it lasts, and how to accept, refuse or change your choice.

Applies to: HK, EU/EEA, UK, SG, VN, US, Other

In plain language

• Strictly necessary cookies run the site, the checkout, the client portal sign-in and your cookie choice. They are always on.
• Analytics cookies (Google Analytics) and marketing cookies (Google Ads and our campaign cookie) are optional.
• Wherever you are, optional cookies stay off until you accept them.
• "Reject all" is as easy as "Accept all". Change your mind at any time with "Cookie settings" in the footer.
• When you refuse or withdraw a category, we delete its cookies from our domain.
• Our payment providers set their own cookies only on the payment step, to protect the payment.

This summary helps you read the document. If it differs from the full text below, the full text applies.

1. What cookies and browser storage are

A cookie is a small text file a website saves in your browser. Browser storage (localStorage and sessionStorage) works in a similar way. Session storage is cleared when you close the tab. We call all of these "cookies" in this policy.

This policy is part of our privacy notice. It is issued by One IBC Limited (Offshore Company Corp), Hong Kong TCSP licence TC001305.

2. How your choice works

The first time you visit, a banner asks you to accept all, reject all, or choose by category. The analytics and marketing switches start off. You can reopen the banner at any time with "Cookie settings" in the footer, and withdrawing is as easy as accepting.

Analytics and marketing cookies stay off until you accept them, in every country. We do the same if we cannot tell where you are. If your browser sends a Global Privacy Control signal, we treat it as a refusal of marketing cookies.

Our hosting provider supplies your approximate country with each request. We use it only to set the occ_region cookie, which today holds "optin" for every country. We do not store the country.

We use Google Consent Mode. Before any Google tag loads, it is told whether analytics and advertising storage are allowed, and Google tags respect that setting. When you refuse or withdraw a category, we also delete that category's cookies on our domain.

We keep your choice for 180 days. After that, or when we add a new provider to this policy, we ask again.

You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, checkout and your cookie choice may not work.

3. Strictly necessary (always on)

These make the site work or keep it secure. The law allows them without consent. We do not use them for analytics or advertising.

• occ_consent (first-party cookie): stores your cookie choice and when you made it. 180 days.
• occ_region (first-party cookie): stores the consent default that applies to you ("optin", which means optional cookies stay off until you accept them). 24 hours.
• occ_order (first-party cookie, not readable by page scripts): links your browser to the order you placed so only you can see its confirmation and pay. 30 days.
• occ_checkout_v1 (session storage): keeps your checkout progress, including the name, email and phone you typed, in this tab only. Cleared when you submit or close the tab.
• occ-ask-sid (session storage): a random ID for this tab, used to limit Ask OCC to a fair number of messages per hour. Cleared when you close the tab.
• Cloudflare Turnstile (on pages with forms or chat): checks that a person, not a bot, is sending a form. Cloudflare runs it in its own frame and may store short-lived security data. We do not use it for advertising.
• Payment providers (payment step only): when you pay by card or PayPal, the payment provider's hosted fields or page may set cookies to process the payment and prevent fraud. They are set by the provider under its own policy, and only on the payment step.
• payload-token (first-party cookie, admin area only): signs in our staff to the content system. Not set for visitors. Ends when the staff session ends.

4. Client portal (strictly necessary)

When you sign in to the client area at /myaccount (My account), we set cookies that keep you signed in and protect your account. They are needed for the service you asked for, so they do not need consent. We do not use them for analytics or advertising.

• __Secure-occ_myaccount (first-party cookie, strictly necessary, not readable by page scripts, sent only to /myaccount and the My account sign-in service): keeps you signed in to the client portal. It holds a random session ID; we store only a hashed copy. It lasts at most 30 days, and ends when you sign out or after 7 days without use. You can see your signed-in devices and end a session in your account settings.
• __Secure-occ_myaccount_mfa (first-party cookie, strictly necessary, not readable by page scripts, sent only to the My account sign-in service): remembers that the first sign-in step worked while you enter your second factor (authenticator code or passkey). 5 minutes.

Passkeys are stored by your device or password manager, not in a cookie. We receive only a public key.

5. Preferences you set (always on)

These remember something you asked for. They stay in your browser and are not sent to us.

• occ-theme (local storage): your light or dark mode choice. Kept until you clear it.
• occ-ask-closed (local storage): remembers that you closed the Ask OCC panel, so it does not open by itself again. Kept until you clear it.
• occ-ask-w (local storage): the width you chose for the Ask OCC panel. Kept until you clear it.

6. Analytics (optional)

These help us understand which pages people visit and how the site performs, so we can improve it. We load them through Google Tag Manager, and only as your choice allows. We do not send names, emails or phone numbers to Google Analytics.

• _ga (Google Analytics 4, set on our domain): tells visits from different browsers apart. Up to 2 years.
• _ga_<ID> (Google Analytics 4, set on our domain): keeps the state of your session. Up to 2 years.
• occ_track_<order> (session storage): stops a purchase from being counted twice in this tab. Cleared when you close the tab.

7. Marketing (optional)

These show us which adverts and campaigns bring visitors and clients. They are used only after you accept marketing cookies. Turning marketing off tells Google tags not to use advertising storage or ad personalisation, and deletes our campaign cookie.

• occ_attr (first-party cookie): stores the campaign that brought you here (UTM tags, advertising click IDs such as Google's gclid, gbraid or wbraid, or fbclid when a link was shared on Facebook or Instagram, the landing page and the referring site). If you send us a form, we add this to your enquiry. 90 days. We write it only after you accept marketing cookies.
• _gcl_au and other _gcl_ cookies (Google Ads, set on our domain): link ad clicks to enquiries and orders. 90 days.

8. Other companies involved

Google (Tag Manager, Analytics, Ads), Cloudflare and our payment providers may receive your IP address and browser details when their code runs in your browser: Google only as your cookie choice allows, payment providers only on the payment step. Google may use data from its cookies under its own privacy policy. Our privacy notice explains where these companies are and how we protect transfers.

• Google: policies.google.com/privacy
• Cloudflare: cloudflare.com/privacypolicy
• PayPal: paypal.com/privacy
• Card payment provider: see the privacy notice linked on its payment page

9. Changes to this policy

We update this policy when we add or remove a cookie. If we add a new provider to an optional category, we ask for your choice again. Questions: privacy@offshorecompanycorp.com.

Sources

• Directive 2002/58/EC (ePrivacy Directive), EUR-Lex
• Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex
• Privacy and Electronic Communications (EC Directive) Regulations 2003, legislation.gov.uk
• Data (Use and Access) Act 2025, legislation.gov.uk
• The Data (Use and Access) Act 2025: what does it mean for organisations?, Information Commissioner's Office
• Personal Data Protection Act 2012, Singapore Statutes Online
• Luật Bảo vệ dữ liệu cá nhân số 91/2025/QH15, Cổng Thông tin điện tử Chính phủ (vanban.chinhphu.vn)
• Nghị định số 356/2025/NĐ-CP quy định chi tiết Luật Bảo vệ dữ liệu cá nhân, Cổng Thông tin điện tử Chính phủ (vanban.chinhphu.vn)

Laws and regulator guidance this document follows. They explain our obligations; they are not legal advice for your situation.

One IBC Limited · HK TCSP Licence TC001305 · Unit 1411, 14/F, COSCO Tower, 183 Queen's Road Central, Sheung Wan, Hong Kong