Cookie Policy
Notice: This Cookie Policy describes how Nexus AI Consulting Limited (the “Company” or “Nexus”) uses cookies and similar tracking technologies on its website nexusaistart.com and the dashboard portal dashboard.nexusaistart.com. By continuing to use the Company’s website after being informed of this Policy, the visitor consents to the use of strictly-necessary cookies. Other categories of cookies, if any are introduced in the future, will be subject to express opt-in consent per Section 6.
1. Purpose and Scope
1.1 Purpose
This Cookie Policy (the “Policy”) explains: (a) what cookies and similar tracking technologies are; (b) what categories of cookies the Company uses; (c) the specific cookies currently set on the Company’s website and dashboard; (d) the Company’s relationship with any third-party cookie providers; (e) the visitor’s choices and consent mechanisms; and (f) how this Policy may be updated.
1.2 Scope of Application
This Policy applies to all cookies and similar tracking technologies (including local storage, session storage, and pixel tags) set when a visitor accesses:
- nexusaistart.com (the Company’s main website); and
- dashboard.nexusaistart.com (the Customer-facing dashboard portal).
This Policy applies to all visitors and Customers regardless of jurisdiction. Where applicable law imposes additional consent requirements (e.g., in jurisdictions adopting ePrivacy-Directive-equivalent standards), the Company complies with such additional requirements per Section 6.
1.3 Relationship to Other Documents
This Policy is a companion to the Privacy Policy (incorporated by reference) and is incorporated by reference into the Terms of Service. Where this Policy is silent on the broader handling of data collected via cookies, the Privacy Policy governs.
1.4 Legal Framework
The Company’s use of cookies complies with:
- The Hong Kong Personal Data (Privacy) Ordinance (“PDPO”, Cap. 486), particularly DPP1 (Purpose and Manner of Collection) and DPP5 (Information to Be Generally Available);
- The PRC Personal Information Protection Law (“PIPL”), particularly Article 13 (legal basis), Article 17 (notice and consent), and Article 24 (automated decision-making transparency);
- Industry-standard cookie consent practices, including alignment with the ePrivacy Directive (Directive 2002/58/EC as amended) where applicable; and
- Applicable laws of the Hong Kong Special Administrative Region.
2. What Are Cookies
2.1 Definition
A “cookie” is a small text file stored on the visitor’s device (computer, smartphone, or tablet) by the visitor’s web browser when the visitor accesses a website. Cookies enable the website to recognize the visitor’s device on subsequent visits, maintain login sessions, remember preferences, and perform other functions that require persistent state across page loads.
2.2 Similar Technologies
In addition to cookies, this Policy covers the following similar tracking technologies (collectively referred to in this Policy as “cookies” for ease of reference, unless distinguished):
- Local storage (HTML5 LocalStorage and SessionStorage);
- Pixel tags (also called web beacons or clear GIFs);
- Fingerprinting techniques (the Company does not use device fingerprinting); and
- Other similar technologies as may be developed.
2.3 Duration Types
Cookies are classified by lifespan:
- Session cookies: deleted when the browser is closed;
- Persistent cookies: remain on the device for a defined period (specified in Section 4) or until manually deleted.
2.4 Source Types
Cookies are classified by origin:
- First-party cookies: set by the website the visitor is currently visiting (i.e., nexusaistart.com or dashboard.nexusaistart.com);
- Third-party cookies: set by domains other than the one the visitor is currently visiting (e.g., embedded analytics scripts).
3. Categories of Cookies
The Company categorizes cookies into four categories, consistent with industry-standard practice. The Company’s current use is limited to Category I (Strictly Necessary). Categories II, III, and IV are described for completeness and for the visitor’s understanding of future categories that may be introduced subject to express opt-in consent.
3.1 Category I — Strictly Necessary Cookies (Currently Used)
These cookies are essential for the operation of the website and dashboard. Without these cookies, fundamental functionality (such as login, session continuity, and security against cross-site request forgery) would not be possible.
- Legal basis: Contract necessity and legitimate interests (no consent required under PDPO and PIPL for strictly necessary cookies, consistent with ePrivacy-Directive-equivalent standards);
- Opt-out: cannot be disabled within the website; the visitor may block via browser settings, but doing so will prevent login and authenticated functionality.
3.2 Category II — Functional Cookies (Not Currently Used)
These cookies enable enhanced functionality, such as language preference, region detection, and accessibility settings.
- Legal basis: consent or legitimate interests (depending on the specific cookie);
- Status: not currently used. If introduced in the future, the visitor will be notified and consent will be obtained where required.
3.3 Category III — Analytics Cookies (Not Currently Used)
These cookies collect aggregated information about how visitors use the website, such as which pages are visited most often, how visitors arrive at the website, and any error messages received. The Company does not currently use Google Analytics, Mixpanel, Plausible, or any third-party analytics platform.
- Legal basis: consent (where consent is required by applicable law);
- Status: not currently used. If introduced in the future, the visitor will be presented with a consent banner per Section 6, and analytics cookies will not be set until consent is obtained.
3.4 Category IV — Marketing and Advertising Cookies (Not Currently Used)
These cookies are used to track visitors across websites to deliver targeted advertisements. The Company does not engage in behavioural advertising.
- Legal basis: express opt-in consent;
- Status: not currently used and not anticipated. The Company’s business model does not include behavioural advertising. If circumstances change, this Policy will be updated with at least the notice period set forth in Section 7.
4. Specific Cookies Currently Set
The following table identifies each cookie currently set by the Company. The Company maintains this table for transparency and updates it whenever cookie usage changes.
4.1 Cookies on nexusaistart.com (Marketing Website)
| Cookie Name | Category | Purpose | Duration | Provider |
|---|---|---|---|---|
nexus_session |
Strictly Necessary | Session token for visitor-state continuity across page loads | Session | First-party (Company) |
nexus_csrf |
Strictly Necessary | Cross-site request forgery (CSRF) protection token | Session | First-party (Company) |
nexus_consent |
Strictly Necessary | Records the visitor’s cookie-consent choice to avoid repeated prompting | Twelve (12) months | First-party (Company) |
4.2 Cookies on dashboard.nexusaistart.com (Customer Dashboard)
| Cookie Name | Category | Purpose | Duration | Provider |
|---|---|---|---|---|
nexus_auth |
Strictly Necessary | Authentication session token for logged-in Customer access | Session (cleared on logout or browser close) | First-party (Company) |
nexus_csrf |
Strictly Necessary | CSRF protection token for dashboard form submissions | Session | First-party (Company) |
nexus_preferences |
Strictly Necessary | Customer dashboard layout and language preferences | Ninety (90) days | First-party (Company) |
4.3 Local Storage and Session Storage
The Company uses HTML5 LocalStorage and SessionStorage for the following purposes only:
- Temporary caching of dashboard UI state (e.g., expanded/collapsed panels) — cleared on logout;
- Cached static assets to improve page-load performance — cleared per browser policy.
No personal data is stored in LocalStorage or SessionStorage. The Company does not use these technologies for tracking purposes.
4.4 Pixel Tags and Tracking Beacons
The Company does not currently use pixel tags or tracking beacons on its website or in its email communications.
5. Third-Party Cookies
5.1 Current Status
The Company does not currently set or permit any third-party cookies on its website or dashboard. The Company has not integrated Google Analytics, Facebook Pixel, LinkedIn Insight Tag, advertising networks, or other third-party tracking services.
5.2 Future Third-Party Cookie Use
If the Company introduces any third-party cookies in the future, the Company will:
- Update this Policy with the name, provider, purpose, and duration of each third-party cookie;
- Provide a link to the third-party provider’s own cookie policy and privacy policy;
- Where consent is required by applicable law, obtain express opt-in consent before the third-party cookie is set;
- Identify each third-party cookie in the relevant category in Section 3 (Categories II, III, or IV);
- Provide the visitor with a mechanism to withdraw consent and disable third-party cookies on a per-cookie basis.
5.3 CDN and Infrastructure Considerations
The Company’s website and dashboard are hosted on infrastructure that may include content-delivery-network (CDN) services. Where any CDN service sets cookies for security or performance reasons, such cookies are treated as strictly-necessary cookies under Section 3.1 and disclosed in the table in Section 4.
6. Your Choices and Consent Mechanisms
6.1 Cookie Consent Banner
Upon a first visit to the Company’s website, the visitor is presented with a cookie consent notice that:
- Discloses the use of strictly-necessary cookies (which are set without separate opt-in per applicable law);
- Provides a link to this Cookie Policy and the Privacy Policy; and
- Will, if any additional cookie categories are introduced in the future, request express opt-in consent for non-strictly-necessary cookies.
6.2 Browser Settings
The visitor may control cookies through browser settings. Most browsers allow the visitor to:
- View the cookies set on the device;
- Block all cookies or block cookies from specific domains;
- Delete existing cookies;
- Configure the browser to notify the visitor before a cookie is set.
Note: blocking or deleting strictly-necessary cookies will prevent login, authenticated access to the dashboard, and other essential functionality.
Guidance for major browsers:
- Google Chrome: chrome://settings/cookies
- Mozilla Firefox: about:preferences#privacy
- Apple Safari: Preferences > Privacy
- Microsoft Edge: edge://settings/privacy
6.3 Do Not Track (“DNT”) Signals
The Company honours Do Not Track signals to the extent technically feasible. Currently, because the Company does not engage in cross-site tracking or behavioural advertising, the receipt of a DNT signal does not change the cookies set (which remain strictly necessary). If analytics or marketing cookies are introduced in the future, DNT signals will be treated as a withdrawal of consent for such cookies.
6.4 Global Privacy Control (GPC)
The Company honours the Global Privacy Control (GPC) signal in the same manner as DNT signals described in Section 6.3.
6.5 Withdrawing Consent
For cookies based on consent, the visitor may withdraw consent at any time by:
- Adjusting browser settings to delete or block specific cookies;
- Using a Company-provided consent-management tool (if available); or
- Contacting privacy@nexusaistart.com with a written request.
Withdrawal of consent does not affect the lawfulness of cookies set prior to withdrawal.
6.6 Consequences of Disabling Cookies
- Disabling strictly-necessary cookies: login, authenticated access, and security features will not function. The Company’s services will be effectively unusable.
- Disabling functional cookies (if any are introduced): some convenience features may not work; the core service remains available.
- Disabling analytics cookies (if any are introduced): no impact on the visitor’s service experience.
- Disabling marketing cookies (if any are introduced): no impact on the visitor’s service experience.
7. Updates to This Policy
7.1 Modification Right
The Company may modify this Policy at any time to reflect changes in: applicable law; cookies in use; third-party providers; or industry best practices.
7.2 Notice of Material Changes
Material changes (including the introduction of any new cookie category beyond strictly necessary, or any new third-party cookie provider) will be communicated through:
- A prominent banner on the website for at least fourteen (14) days; and
- For registered Customers, notice via the registered email address with at least fourteen (14) days’ lead time before the change takes effect, consistent with the Terms of Service and Privacy Policy.
7.3 Express Opt-In for New Categories
The introduction of any cookie in Categories II, III, or IV (Functional, Analytics, or Marketing) requires express opt-in consent. Existing visitors and Customers will be presented with a consent prompt the next time they access the website or dashboard.
7.4 Version History
Substantive versions of this Policy are archived. Prior versions are available upon request to privacy@nexusaistart.com.
8. Contact and Governing Law
8.1 Contact
For all cookie-related and privacy inquiries:
- Email: privacy@nexusaistart.com
- Subject-line convention: “Cookie — [Inquiry Type]” or “Privacy — Cookie [Inquiry Type]”
- Postal address: Room 1508, 15/F, Argyle Centre Tower 2, 625 Nathan Road, Mong Kok, Kowloon, Hong Kong
8.2 General Contact
For non-privacy inquiries: support@nexusaistart.com
8.3 External Complaint Authority
- Hong Kong Privacy Commissioner for Personal Data: https://www.pcpd.org.hk/
8.4 Governing Law
This Policy is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region of the People’s Republic of China.
8.5 Jurisdiction
The Hong Kong courts have exclusive jurisdiction over disputes arising under this Policy.
8.6 Language
This Policy is executed in English. The Chinese Summary below is provided for convenience only; in the event of conflict, the English text controls.
中文摘要（Chinese Summary — Non-Binding Reference）
本中文摘要仅供参考，与英文条款发生歧义时以英文条款为准。
文档定位
本《Cookie 政策》（Cookie Policy）是 Nexus AI Consulting Limited 关于网站 cookie 和类似追踪技术使用的对外公开声明，是 Privacy Policy 的配套文档，并通过服务条款纳入。
适用范围
- nexusaistart.com（公司主网站）
- dashboard.nexusaistart.com（客户仪表盘门户）
关键内容摘要
1. Cookie 是什么（§2）：浏览器在访客设备上存储的小型文本文件，用于会话保持、安全防护等。包含 cookie + LocalStorage + SessionStorage + 像素标签等技术。
2. Cookie 四类（§3）：
- I 严格必要（当前唯一使用）：会话 token + CSRF 防护 + 同意记录
- II 功能性（未使用）：语言 / 区域 / 无障碍偏好
- III 分析（未使用）：不使用 Google Analytics 等第三方分析
- IV 营销广告（未使用且不预期使用）：不进行行为广告
3. 当前 Cookie 清单（§4）：
nexusaistart.com：
nexus_session（严格必要 / 会话 / 第一方）nexus_csrf（严格必要 / 会话 / 第一方）nexus_consent（严格必要 / 12 个月 / 第一方）
dashboard.nexusaistart.com：
nexus_auth（严格必要 / 会话 / 第一方）nexus_csrf（严格必要 / 会话 / 第一方）nexus_preferences（严格必要 / 90 日 / 第一方）
LocalStorage：仅用于 dashboard UI 状态 + 静态资源缓存。不存储个人数据，不用于追踪。
像素标签：当前未使用。
4. 第三方 Cookie（§5）：当前完全不使用。无 Google Analytics / Facebook Pixel / LinkedIn / 广告网络等。未来引入需更新本政策 + 取得明示同意 + 提供禁用机制。
5. 用户选择（§6）：
- Cookie 同意横幅：首次访问展示，严格必要 cookie 无需单独同意（符合 ePrivacy 指令标准）
- 浏览器设置：访客可通过 Chrome / Firefox / Safari / Edge 设置查看、阻止、删除 cookie
- DNT 信号：尊重 Do Not Track 信号
- GPC 信号：尊重 Global Privacy Control 信号
- 撤回同意：浏览器设置 / 联系 privacy@nexusaistart.com
禁用 cookie 后果：
- 禁用严格必要 cookie → 登录 / 仪表盘功能失效
- 禁用其他（如未来引入）→ 不影响核心服务
6. 修改（§7）：重大修改提前 14 日横幅公告 + 客户邮件通知。新增 II/III/IV 类 cookie 需明示同意。
7. 联系方式（§8）：privacy@nexusaistart.com / 投诉 PCPD https://www.pcpd.org.hk/ / HK 法院专属管辖。
与 Privacy Policy 的关系
Privacy Policy 给出 cookie 使用的简要陈述，本 Cookie Policy 提供完整细节。两份文件的实质标准一致，本 Cookie Policy 是 Privacy Policy 相关章节的展开。
Cookie 极简原则
Nexus 当前采取 cookie 极简策略：仅使用严格必要 cookie，无任何第三方追踪，无任何分析或广告 cookie。这是基于：
- 最小化数据收集原则（PDPO DPP1）
- 降低跨境数据合规复杂度
- 客户隐私优先的产品理念
未来扩展（如引入分析）将严格遵守明示同意 + 提前 14 日通知机制。