Cookie Policy

1. Introduction

This Cookie Policy (hereinafter, "Policy") is drawn up in accordance with Regulation (EU) 2016/679 (GDPR), the Dutch AVG/UAVG regulation, the European Data Protection Board (EDPB) Guidelines on consent and cookies, and the indications of the competent European and national supervisory authorities.

This Policy describes how Rumoo (Mood Global Services B.V.) uses cookies and similar tracking technologies on its corporate website, web application platform, member area, and related digital environments (hereinafter, collectively, the "Site" or "Platform"). It supplements Rumoo's Privacy Policy, to which reference is made for any information relating to the processing of personal data in a broader sense.

Rumoo is a data-driven and AI-based SaaS/app digital platform for professional and business users. Access is possible via a corporate website, web dashboard, professional accounts, reserved areas, demo requests, onboarding, customer support, and possible enterprise integrations. This Policy applies to all such environments, with the distinctions outlined in the following sections.

2. What are cookies and tracking technologies?

Cookies are small text files that a website or application platform places on the user's device (computer, tablet, smartphone, or any other web-enabled device) when they access the site. These files store and retrieve information about the session and use of the service.

Cookies may be set directly by the owner of the site or platform ('first-party cookies') or by third parties who provide services or content integrated into the Site ('third-party cookies').

In addition to cookies strictly speaking, the Site and Platform may use similar tracking technologies, including: web beacons, tracking pixels, local storage, session storage, device identifiers, technical fingerprinting, or other functionally equivalent technologies. These technologies are subject to the same rules applicable to cookies pursuant to applicable law and this Policy.

Any connection of Rumoo to third-party accounts (e.g., TikTok, Meta) to access insights via official APIs occurs server-side and does not, for this reason alone, result in the installation of cookies or trackers from the respective platforms on the user's device. Any third-party components integrated into the browser are listed separately in Section 5 of this Policy.

3. Types of cookies used

3.1 Classification by duration

The cookies used by Rumoo are distinguished, based on their duration, into:

• Session cookies: active only for the duration of the browsing session or authenticated application session. They are automatically deleted when the browser is closed or the session ends.
• Persistent cookies: stored on the device for a determined period, indicated in the table in Section 4. They allow preferences or configurations to be remembered between different sessions.

3.2 Classification by purpose

Based on their purpose, cookies are classified as follows:

• Strictly necessary cookies — mandatory, cannot be deactivated without compromising essential functions. These cookies are essential for the functioning of the Site and the Platform. They include authentication, session management, security, load balancing, basic preferences (e.g., language), login continuity, access to restricted areas, consent management, and service integrity cookies. They do not require user consent and cannot be deactivated without compromising access or the proper functioning of the Service.
• Functional cookies — optional, activated with consent. These cookies allow the Platform to store user preferences, interface configurations, dashboard settings, non-essential language selections, or other customizations that improve the user experience without being strictly necessary for the Service to function. Disabling these cookies may reduce the personalization of the experience, but does not prevent access to the Service.
• Analytical/statistical cookies — optional in the non-anonymized version, subject to specific conditions for the anonymized version. These cookies collect information on the use of the Site and Platform (pages visited, navigation paths, interaction times, application events, diagnostics, performance, crash data) for statistical, product improvement, and technical monitoring purposes. If the data collected is aggregated or anonymized so as not to allow user identification, they may be considered technical cookies. Otherwise, they require consent.
• Marketing and profiling cookies — optional, subject to explicit consent. On the Rumoo website Rumoo uses the Meta Pixel (Meta Platforms Ireland Ltd.) to measure the results of its advertising campaigns on Facebook and Instagram (pages viewed, clicks on the application buttons, qualified visits, applications submitted). The Pixel is loaded only after the user accepts the marketing category in the cookie banner; without consent no Meta script, cookie or request is activated. The same conversion events may also be sent server-side through the Meta Conversions API, as described in Section 5.2.

4. Details of the cookies and tracking technologies in use

The following tables list the main cookies and tracking technologies used by Rumoo, including the provider, party, duration, and purpose.

Strictly necessary cookies

Functional cookies

Analytical / statistical cookies

Marketing / profiling cookies

Active only after the user accepts the marketing category in the cookie banner. Rumoo's current choice is stored in the browser (local storage key rumoo-marketing-consent) and can be changed at any time from the "Preferenze cookie" link in the footer.

5. Third-party services

Some features of the Site and Platform may be provided by third-party service providers, who may place cookies or use their own tracking technologies on the user's device. In such cases, the third party's data processing is governed by its own privacy policy, to which reference is made.

5.1 Categories of third-party suppliers potentially involved

Based on the Platform architecture, suppliers belonging to the following categories may be involved:

• Cloud infrastructure and hosting: cloud service providers, servers, CDNs, and technical infrastructure providers for providing the Service. These entities act as data processors pursuant to Art. 28 GDPR.
• Analytics and monitoring: web and application analytics tools, performance monitoring and diagnostics.
• Authentication and access management: authentication, single sign-on (SSO), or identity management providers, if integrated.
• CRM, customer support and communications: tools for managing demo requests, customer support, and commercial communications.
• Consent Management Platform (CMP): tool for collecting, recording and managing cookie preferences.

5.2 Integrations with TikTok and Meta

Rumoo allows Creators, with explicit consent, to connect their Instagram and/or TikTok accounts to access performance insights via the respective platforms' official APIs. This connection occurs server-side and, for this reason alone, does not install TikTok or Meta cookies, pixels, or SDKs on the user's device.

Meta Pixel. With the user's explicit consent to the marketing category, the Rumoo website loads the Meta Pixel, a browser-side component of Meta Platforms Ireland Ltd. The Pixel records page views, clicks on the "Candidati" buttons, qualified visits and submitted applications (with the audience chosen: creator or venue) and sets the _fbp and _fbc cookies listed in Section 4. Legal basis: consent (Art. 6(1)(a) GDPR, Art. 5(3) ePrivacy Directive). The Pixel is active only on www.rumoo.app.

Meta Conversions API. When an application is submitted and marketing consent has been given, Rumoo also transmits the same "Lead" event to Meta from its own servers (Meta Conversions API), so that the result is measured even when the browser blocks the Pixel. The event carries the e-mail address and telephone number entered in the form exclusively as SHA-256 hashes (never in clear text), the IP address and browser user agent of the request, the _fbp and _fbc identifiers, the audience chosen and a technical event identifier that allows Meta to count the browser and server events as a single conversion. No server event is sent if the user has not granted marketing consent. Meta processes this data as an independent controller for ad measurement, in accordance with its privacy policy; transfers to the United States rely on Meta's certification under the EU-US Data Privacy Framework.

Users can object to Meta's processing or manage their advertising preferences through their Facebook and Instagram account settings, in addition to withdrawing consent via the cookie banner (Section 6.2).

5.3 Transfers to third countries

Some third-party providers may be located outside the European Economic Area (EEA), which means that data collected through their cookies may be transferred to third countries. In such cases, Rumoo ensures that the transfer is carried out in compliance with Chapter V of the GDPR, through adequacy decisions from the European Commission (e.g., the EU-US Data Privacy Framework for certified US providers), Standard Contractual Clauses (SCCs), or other appropriate safeguards.

Users can consult the privacy policies of individual third-party providers to obtain detailed information on the transfers they perform. An updated list of third-party providers is available upon request by contacting the Data Controller.

6. Consent management and cookie banner

6.1 The cookie banner

Upon first accessing the Site, and upon each subsequent visit if no preferences have been expressed, the user is shown a cookie banner that allows them to manage their preferences in a granular manner. The banner provides the following options:

• Accept all: the user consents to the use of all cookies, including functional, analytical, and, where applicable, marketing cookies.
• Reject all non-essential: only cookies strictly necessary for the operation of the Site and the Platform are activated. Functional, non-anonymized analytical, and marketing cookies are deactivated.
• Customize: the user accesses a granular configuration panel where they can choose, category by category, which types of cookies to activate or deactivate.

Consent is obtained through the user's affirmative and unambiguous action. Pre-selected boxes for cookies that are not strictly necessary are not permitted. The user always has the option to refuse, just as easily as they can accept.

Failure to consent to non-essential cookies does not prevent access to the Site or the essential features of the Platform. Some optional features (e.g., advanced interface customization) may not be available without the relevant functional cookies.

6.2 Revocation and modification of consent

The user can revoke or modify their cookie preferences at any time, as easily as they expressed them, via:

• the "Cookie management" / "Cookie settings" link present in the footer of the Site;
• the cookie preferences panel accessible from the Platform settings (where available to registered users);
• the cookie banner, which can be reactivated via the dedicated link.

Withdrawing consent does not affect the lawfulness of processing based on prior consent. Following withdrawal, non-essential cookies will be removed from the device at the first technical opportunity.

The user's preferences are stored via the consent management cookie (indicated in the table in Section 4) for a period of 12 months. After this period expires, consent will be requested again.

6.3 Register of consents

Rumoo records and stores evidence of the user's consent (timestamp, Policy version, selected preferences) in accordance with Art. 7(1) GDPR, in order to demonstrate that processing is based on valid consent.

7. Cookies and minors

The Rumoo Platform is a professional service intended exclusively for adult users engaged in commercial, entrepreneurial, or professional activities. Rumoo services are not intended for persons under the age of 18.

Rumoo does not knowingly collect personal data from minors through cookies or other tracking technologies. If the Data Controller becomes aware that cookies have been installed on minors' devices, it will delete the collected data immediately.

Cookies that are not strictly necessary are activated only with valid, free, and unambiguous consent. Rumoo does not adopt mechanisms that could induce a minor to give consent without the necessary awareness.

8. How to disable cookies via your browser

Regardless of the preferences expressed via the cookie banner, users can manage, limit, or delete cookies directly through their browser settings. Below are links to the official guides for the main browsers:

• Google Chrome: support.google.com/chrome/answer/95647
• Mozilla Firefox: support.mozilla.org
• Apple Safari: support.apple.com/guide/safari/sfri11471/mac
• Microsoft Edge: support.microsoft.com
• Opera: help.opera.com/en/latest/web-preferences/#cookies

Please note that disabling strictly necessary cookies via browser settings may prevent or seriously impair use of the Site and Platform, including access to the authenticated area. Disabling non-essential cookies does not affect the essential functionality of the Service.

To manage cookies on mobile devices, we recommend consulting the instructions provided by the device manufacturer or operating system provider (iOS, Android).

Further information on cookies and how to manage them is available on the website of the competent supervisory authority: Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl) and, for Italian users, the Italian Data Protection Authority (www.gpdp.it).

9. Rights of the data subject and contact details

In relation to the processing of personal data carried out through cookies and tracking technologies, the data subject may exercise the rights provided for by Articles 15–22 of the GDPR, including:

• right of access to personal data collected (Art. 15 GDPR);
• right to rectification of inaccurate data (Art. 16 GDPR);
• right to erasure ('right to be forgotten', Art. 17 GDPR);
• right to restriction of processing (Art. 18 GDPR);
• right to data portability (Art. 20 GDPR);
• right to object to processing (Art. 21 GDPR);
• right to withdraw consent at any time, without prejudice to the lawfulness of previous processing (Art. 7(3) GDPR).

To exercise your rights or for any request regarding data processing via cookies, the data subject can contact the Data Controller:

The data subject also has the right to lodge a complaint with the competent supervisory authority: Autoriteit Persoonsgegevens (AP), Huis te Landelaan 492, 2283 SZ Rijswijk, Netherlands — www.autoriteitpersoonsgegevens.nl. Users residing in Italy may also contact the Italian Data Protection Authority — www.gpdp.it.

For more detailed information on the overall processing of personal data carried out by Rumoo, please refer to the Privacy Policy.

10. Cookie Policy updates

Rumoo reserves the right to modify this Cookie Policy at any time due to technological, regulatory, or operational developments (e.g., introduction of new cookies, new suppliers, updates to regulatory authority guidelines).

Substantial changes will be communicated to users via a notice on the Site, an updated cookie banner, or, for registered users, an email or dashboard notification. The date of the last update is indicated at the top of this Policy.

The updated version of the Cookie Policy is always available on the company website. Users are encouraged to check this page periodically for any changes. Continued use of the Site following the posting of changes constitutes acceptance of the updated version, to the extent permitted by applicable law.

In the event of updates introducing new categories of non-technical cookies or new third-party providers, the user's consent will be requested again via the cookie banner before the new trackers are activated.