This Cookie Policy explains how PitchMe Corp Limited (“PitchMe”, “we”, “us”, or “our”) uses cookies and similar tracking technologies on our website and platform (collectively, the “Site”). It also explains how our use of cookies intersects with our obligations under the SOC 2 security framework, UK GDPR, EU GDPR, and the California Consumer Privacy Act (CCPA).
PitchMe Corp Limited is incorporated in England and Wales (registered address: 8 Devonshire Square, London EC2M 4YJ). This policy applies to all users of the Site regardless of location.
1. What Are Cookies?
Cookies are small text files placed on your device by a website when you visit it. They serve a range of purposes, from keeping you logged in to helping us understand how visitors use our Site. Cookies may be:
Session cookies — temporary files deleted when you close your browser.
Persistent cookies — files that remain on your device until they expire or you delete them.
First-party cookies — set directly by PitchMe.
Third-party cookies — set by external services we use (e.g. Google Analytics, LinkedIn).
In addition to cookies, we may use pixel tags (web beacons), local storage objects, and server-side logging. These are described in Section 4 below.
2. Why Cookies Matter for SOC 2 Compliance
PitchMe maintains an information security programme aligned with the SOC 2 Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy). Several categories of cookies and tracking technologies are directly linked to our SOC 2 obligations:
| SOC 2 Criterion | How Cookies / Logs Support It | Cookie Category |
|---|---|---|
| CC6.1 — Logical Access Controls | Session and authentication cookies enforce access controls, ensuring only authenticated users can access protected platform areas. | Strictly Necessary |
| CC6.6 — Boundary Protection | Server access logs and rate-limit identifiers detect and block unauthorised access attempts, credential stuffing, and DDoS activity. | Security & Integrity |
| CC7.1 — Threat Detection | Security event logs capture anomalous activity patterns. CSRF tokens prevent cross-site request forgery attacks. | Security & Integrity |
| CC7.2 — Incident Response | Access and authentication logs provide the forensic evidence trail required for incident investigation and regulatory notification. | Security & Integrity |
| A1.2 — Availability Monitoring | Error and application logs enable rapid diagnosis of service interruptions, supporting our uptime commitments. | Performance |
| P3.1 — Privacy Notice | Consent records demonstrate that users were informed of data collection and provided valid consent before non-essential cookies were placed. | All non-essential categories |
| P4.1 — Consent Management | Cookie consent records are retained for 3 years post-consent to demonstrate compliance with UK GDPR Article 7 and CCPA opt-in requirements. | All non-essential categories |
3. Cookie Categories and Details
The table below sets out each category of cookie we use, the specific cookies in that category, their purpose, duration, and whether you can opt out.
| Category | Name | Purpose | Duration | Third Party | Opt-Out |
|---|---|---|---|---|---|
| Strictly Necessary | Session / auth cookies | Enable login, session management, and navigation across the platform. Required for the service to function. Cannot be disabled. | Session / persistent up to 12 months | No | No |
| Performance & Analytics | Google Analytics (_ga, _gid, _gat) | Collects anonymised data on usage patterns, page visits, and traffic sources to help us improve the platform. IP addresses are anonymised before storage. | Up to 2 years | Google LLC | Yes — see Section 5 |
| Functionality | Preference cookies | Remember user preferences such as language, region, and display settings to personalise your experience. Do not track activity on other websites. | Up to 12 months | No | Yes — via browser |
| Security & Integrity (SOC 2) | CSRF tokens, rate-limit identifiers | Protect the platform against cross-site request forgery (CSRF) attacks, credential stuffing, and other security threats. Required for SOC 2 security controls. Cannot be disabled. | Session | No | No |
| Targeting & Advertising | LinkedIn Insight Tag, retargeting pixels | Track browsing activity across sites to serve relevant advertising and measure campaign effectiveness. Only placed with your prior consent. | Up to 2 years | LinkedIn, Meta | Yes — consent required |
| Social Media | Social share buttons (LinkedIn, X) | Enable sharing of content on social media platforms. These cookies are set by third-party platforms and are outside PitchMe’s direct control. | Up to 2 years | LinkedIn, X Corp | Yes — via platform settings |
4. Other Tracking Technologies
4.1 Server Logs
Our web servers automatically collect certain information from every request, including your IP address, browser type, operating system, referring URL, pages visited, and date/time stamp. This data is used for:
Security monitoring and threat detection (SOC 2 CC6.6, CC7.1).
Diagnosing technical problems and service interruptions (SOC 2 A1.2).
Analysing usage trends in aggregated, anonymised form.
Server log data is not linked to your personal identity except where required for security investigation or to comply with a legal obligation. Retention periods are set out in Section 6.
4.2 Pixel Tags and Web Beacons
We may use pixel tags (also known as clear GIFs or web beacons) in emails and on certain web pages. Pixel tags allow us to confirm whether emails have been opened and whether users have visited particular pages. This helps us improve the relevance of our communications and measure the effectiveness of campaigns. We do not tie pixel tag data to personally identifiable information.
4.3 Local Storage
We may use browser local storage (HTML5 localStorage) to store user preferences and session state. Unlike cookies, local storage data is not transmitted to our servers with each request. You can clear local storage data through your browser’s developer tools or settings.
4.4 Flash Cookies (Legacy)
PitchMe no longer uses Flash Local Shared Objects (Flash Cookies). Any legacy Flash cookie references in previous versions of this policy are superseded by this version.
5. Your Choices and How to Manage Cookies
5.1 Cookie Consent Banner
When you first visit our Site, you will be presented with a cookie consent banner. You may:
Accept all cookies — enables all categories including analytics and advertising.
Reject non-essential cookies — only Strictly Necessary and Security & Integrity cookies will be placed.
Customise your preferences — enable or disable individual categories.
Your consent choice is recorded and stored for 12 months. You can update your preferences at any time by clicking the “Cookie Settings” link in the footer of our Site. Consent records are retained by PitchMe for 3 years to demonstrate compliance.
5.2 Browser Controls
Most browsers allow you to refuse or delete cookies through their settings. The following links provide guidance for major browsers:
Google Chrome: Settings → Privacy and Security → Cookies and other site data
Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
Apple Safari: Preferences → Privacy → Manage Website Data
Microsoft Edge: Settings → Cookies and Site Permissions
Please note: disabling Strictly Necessary or Security & Integrity cookies may prevent you from logging in or using core features of the platform.
5.3 Google Analytics Opt-Out
To opt out of Google Analytics tracking across all websites, you can install the Google Analytics Opt-out Browser Add-on, available at: https://tools.google.com/dlpage/gaoptout
We have configured Google Analytics with IP anonymisation enabled, meaning your IP address is truncated before being stored by Google.
5.4 Advertising and Behavioural Opt-Out
To opt out of interest-based advertising from participating companies, you can use the following industry opt-out tools:
Your Online Choices (UK/EU): https://www.youronlinechoices.eu
Network Advertising Initiative (US): https://optout.networkadvertising.org
Digital Advertising Alliance (US): https://optout.aboutads.info
Opting out does not prevent you from seeing advertisements. It means that advertising displayed to you will not be personalised based on your browsing behaviour.
5.5 Social Media Platform Controls
Cookies placed by social media platforms (LinkedIn, X) are governed by those platforms’ own privacy and cookie policies. To manage these cookies, please visit the privacy settings of the relevant platform directly.
6. Data Retention — SOC 2 Log and Cookie Data
PitchMe retains cookie-related and log data for the periods set out below, in accordance with our SOC 2 data retention obligations and applicable data protection law.
| Log / Data Type | Retention Period | Purpose | SOC 2 Criterion |
|---|---|---|---|
| Access and authentication logs | 90 days | Detect unauthorised access, support incident investigation | CC6.1, CC7.2 |
| Security event logs (CSRF, rate limiting) | 12 months | Threat detection, forensic analysis, audit evidence | CC7.1, CC7.2 |
| Error and application logs | 30 days | Diagnose platform issues and service interruptions | A1.2 |
| Analytics data (anonymised) | 26 months (Google Analytics default) | Platform improvement and usage trend analysis | P3.1 |
| Cookie consent records | Duration of consent + 3 years | Demonstrate lawful basis and consent under UK GDPR / CCPA | P4.1, P6.1 |
| Server access logs (IP, browser, OS) | 90 days | Security monitoring, DDoS detection, abuse prevention | CC6.6, CC7.2 |
All log and tracking data is stored securely within PitchMe’s SOC 2-audited infrastructure (AWS, UK/EEA or US data residency as selected). Access is restricted to authorised personnel on a need-to-know basis, protected by role-based access controls and multi-factor authentication.
7. International Data Transfers
Some of the third-party services we use (including Google Analytics and LinkedIn) may transfer data outside the United Kingdom or European Economic Area. Where this occurs, we ensure that appropriate safeguards are in place, including:
Standard Contractual Clauses (SCCs) approved by the UK ICO or European Commission.
Adequacy decisions issued by the European Commission (where applicable).
The EU-US Data Privacy Framework, where the third party is certified.
You can find details of the transfer mechanisms used by our third-party providers in their respective privacy policies.
8. Lawful Basis for Cookie Processing (UK GDPR / EU GDPR)
For users in the United Kingdom and European Economic Area, our use of cookies is based on the following lawful grounds:
| Cookie Category | Lawful Basis | Detail |
|---|---|---|
| Strictly Necessary | Legitimate Interests / Contract | Necessary for the operation of the platform and the performance of our contract with you. No consent required under PECR / ePrivacy. |
| Security & Integrity | Legitimate Interests | Necessary to protect the platform and users from security threats. Overriding legitimate interest under SOC 2 security obligations. |
| Performance & Analytics | Consent | Placed only with your prior consent, which you may withdraw at any time via Cookie Settings. |
| Functionality | Legitimate Interests / Consent | Where functionality cookies personalise your experience beyond what is strictly necessary, consent is obtained. |
| Targeting & Advertising | Consent | Placed only with your prior explicit consent. Not placed by default. |
| Social Media | Consent | Placed only with your prior explicit consent. Third-party platforms govern their own use of resulting data. |
9. California Privacy Rights (CCPA / CPRA)
For users based in California, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides additional rights in relation to the personal information collected through cookies and tracking technologies.
9.1 Categories of Personal Information Collected via Cookies
Through cookies and server logs, PitchMe may collect the following categories of California Personal Information: identifiers (IP address, device ID, browser fingerprint); internet or network activity (browsing history on our Site, pages visited, clickstream data); and geolocation data (approximate location inferred from IP address).
9.2 Your California Rights
Right to Know — the categories and specific pieces of personal information collected about you via cookies.
Right to Delete — request deletion of personal information collected through cookies, subject to certain exceptions.
Right to Opt Out of Sale or Sharing — PitchMe does not sell your personal information. Where we share data with advertising partners for cross-context behavioural advertising, you may opt out via the cookie consent banner or the “Do Not Sell or Share My Personal Information” link in our Site footer.
Right to Limit Use of Sensitive Personal Information — we do not collect sensitive personal information through cookies.
Right to Non-Discrimination — exercising your CCPA rights will not affect the quality or price of services we provide to you.
9.3 How to Exercise Your California Rights
Submit a verifiable consumer request to: privacy@pitchme.co. We will respond within 45 days of receipt. We will not discriminate against you for exercising your rights.
10. Children’s Privacy
Our Site and platform are not directed at individuals under the age of 16. We do not knowingly collect personal information from children through cookies or any other means. If you believe we have inadvertently collected information from a child, please contact us at privacy@pitchme.co and we will delete it promptly.
11. Changes to This Policy
We may update this Cookie Policy from time to time to reflect changes in our use of cookies, applicable law, or our SOC 2 compliance programme. Material changes will be communicated to registered users by email and notified via a prominent notice on our Site at least 14 days before taking effect. The “Last Revised” date at the top of this policy indicates when it was most recently updated. We recommend checking this page periodically. Continued use of the Site after the effective date of a change constitutes acceptance of the updated policy.
Previous versions of this Cookie Policy are available on request.
12. Contact Us
If you have any questions about this Cookie Policy or our use of cookies, please contact:
Data Protection Contact: privacy@pitchme.co
General Enquiries: legal@pitchme.co
Registered Address: PitchMe Corp Limited, 8 Devonshire Square, London, England, EC2M 4YJ
You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at www.ico.org.uk, or with your local data protection supervisory authority if you are based in the EU.