Cookie Policy

2. Categories of Cookies We Use

We categorise the cookies on our site as follows:

Strictly Necessary Cookies These cookies are essential for the website to function. They cannot be switched off. They are typically set in response to actions like setting your privacy preferences, logging into the client portal, or filling in forms. Without these, services you have asked for cannot be provided.

Examples: CSRF tokens, session cookies for the client portal (convertec-session), Next.js routing cookies.

Functional / Preference Cookies These remember choices you make to improve your experience. On our homepage, we use localStorage (not cookies) to remember your selected language (en/ar/fr) and theme (light/dark). No consent is required because this data is stored locally on your device and never transmitted to our servers.

Analytics Cookies These help us understand how visitors interact with our website by collecting aggregated, anonymised information. We use Google Analytics 4 (GA4) with IP anonymisation enabled. This data is used only to improve the website.

Name: _ga, _ga_XXXXXXXX Provider: Google LLC Duration: up to 2 years Purpose: Distinguish users and measure sessions

Marketing / Advertising Cookies These cookies may be set by our advertising partners to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information but uniquely identify your browser.

Name: _fbp, _fbc Provider: Meta Platforms, Inc. Duration: 90 days Purpose: Attribution for Meta advertising campaigns

Name: _gcl_au, _gcl_aw Provider: Google LLC Duration: 90 days Purpose: Conversion attribution for Google Ads campaigns

Name: _ttp, tt_sessionid Provider: TikTok Technology Ltd Duration: up to 1 year Purpose: Attribution for TikTok advertising campaigns

3. Your Choices and Consent

When you first visit our website, we display a cookie consent banner. You can:

• Accept all — enables strictly necessary, functional, analytics, and marketing cookies • Reject non-essential — restricts cookies to strictly necessary only • Manage preferences — granular control by category

You can change your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of any page.

You can also control cookies through your browser settings: • Chrome: Settings → Privacy & Security → Cookies and other site data • Firefox: Settings → Privacy & Security → Cookies and Site Data • Safari: Preferences → Privacy → Manage Website Data • Edge: Settings → Cookies and site permissions

Note that blocking certain cookies may affect the functionality of our website and services.

4. Third-Party Cookies

Some cookies are set by third parties on our behalf. We have agreements with these third parties that they process data in accordance with our instructions and applicable data protection law. The relevant third-party privacy policies are:

• Google: policies.google.com/privacy • Meta: facebook.com/privacy/policy • TikTok: tiktok.com/legal/privacy-policy

We are not responsible for the content of those third-party privacy policies.

5. Advertising Platform Pixels

To measure the effectiveness of advertising campaigns we run on behalf of clients (and our own promotional activity), we deploy tracking pixels from advertising platforms. These pixels fire when you visit our website and enable:

• Conversion tracking — understanding which campaigns led to enquiry form submissions • Retargeting audiences — building Custom Audiences of past visitors for future ad campaigns (where you have consented) • Lookalike audiences — finding new users similar to our existing audience

If you have consented to marketing cookies, your visit data will be shared with the relevant advertising platforms under our data processing agreements with them.

6. Cookies in Our Client Portal

When you log into the Mafhom client portal (app.mafhomhub.com), the following additional cookies are set:

convertec-session — a secure, HttpOnly, SameSite=Lax session cookie used to authenticate your login. This expires when you sign out or after 30 days of inactivity. __next-auth.callback-url — stores the URL you were trying to visit before logging in, cleared on authentication. __Host-next-auth.csrf-token — CSRF protection token.

None of these are analytics or marketing cookies. They are strictly necessary for the portal to function securely and cannot be disabled.

7. Data Retention

Cookie lifetimes vary by cookie type and are listed in Section 2. Consent records (whether you accepted or rejected cookies) are stored for 12 months and then refreshed to ensure your preferences remain current.

8. Updates to This Policy

We will update this Cookie Policy when we add new cookies or tracking technologies, or when the law requires changes. The "Last Updated" date at the top of this page will be updated accordingly. We recommend reviewing this page periodically.

9. Contact Us

For any questions about our use of cookies, please contact:

Mafhom 20 Farringdon Street, London EC4A 4AB Email: privacy@mafhomhub.com Tel: +44 (0)20 7946 0123