Cookie Policy

Summary

QuirkSphere uses cookies and similar technology on this site, and this policy explains what they do and how you control them. In short: nothing that tracks you for advertising loads until you say yes. When you first visit, a banner lets you accept all cookies, reject all non-essential cookies, or open detailed settings and choose by category; analytics and advertising are both off unless you switch them on. Rejecting is exactly as easy as accepting: both buttons are the same size, on the same screen, in one click. You can change your mind at any time by clicking "Cookie preferences" in the footer of every page, which reopens your settings. If your browser sends a Global Privacy Control signal, we treat that as an opt-out of advertising cookies automatically, without you needing to click anything. A small number of strictly necessary cookies run regardless, because the site would not otherwise function; you can still block those at the browser level if you choose. The sections below explain each category in more detail, list the specific cookies and similar technologies we use, and set out how the rules differ depending on where you are visiting from.

CP-1. Scope

CP-1.1. This policy explains how QSP Infosolutions Private Limited, trading as QuirkSphere, uses cookies and similar technologies on quirksphereagency.com (the "Site"). It is a companion to our Privacy Policy (04-privacy-policy.md), which covers personal data generally. This policy covers only cookies and similar tracking technologies.

CP-1.2. This policy applies to visitors of the Site regardless of location. Section CP-9 explains how the legal rules differ depending on where you are.

CP-2. What cookies and similar technologies are

CP-2.1. A cookie is a small text file a website stores on your device (computer, phone, tablet) when you visit. It lets the site remember something about you or your visit the next time you return, or lets a third party recognise your device across different sites.

CP-2.2. We also use, or may use, technologies that work similarly to cookies but are not cookies in the strict sense:

• Pixels (also called tracking pixels or web beacons): a tiny, often invisible image or script embedded in a page that reports back to a third party when the page loads, and can pass along information about you and your visit. The Meta Pixel described in CP-8 is an example.
• Local storage and session storage: data a website's code stores directly in your browser, outside the cookie mechanism, that persists across visits (local storage) or only for the current browsing session (session storage).
• SDKs (software development kits): code libraries embedded in a mobile app or web page, supplied by a third party (an advertising network, an analytics provider), that collect data on that third party's behalf.
• Server-side tagging: instead of a script running in your browser, the site's own server forwards event data to a third party. This can be harder for a browser-based ad-blocker or a cookie-blocking setting to detect, but it collects the same kind of data and is subject to the same consent rules where they apply.

CP-2.3. Everywhere this policy says "cookies," it means cookies and all of the technologies described in CP-2.2, unless we say otherwise.

CP-3. Categories of cookies we use

CP-3.1. We classify every cookie and similar technology on the Site into one of four categories:

• Strictly necessary: required to operate the Site or to provide a service you specifically asked for (for example, keeping a form's contents while you fill it in, or a security token that stops cross-site request forgery). These cannot be switched off through the consent banner because the Site would not function correctly without them, but you can always block them at the browser level (see CP-9).
• Functional: remember choices you make (for example, a display preference) to give you a more personalised experience. Not required for the Site to work.
• Analytics: help us understand how visitors use the Site (which pages are viewed, how long visitors stay, where they came from) so we can improve it. Usually aggregated or pseudonymised, but still capable of identifying a device.
• Advertising: used to build a profile of your interests and to show, measure or target advertising, including retargeting you on other sites and platforms. This is the category the Meta Pixel falls into.

CP-3.2. "Strictly necessary" is a narrow legal category, not a business convenience label. Analytics and advertising cookies do not qualify for it, even when we consider them useful. See CP-9 for the legal basis behind that line.

CP-4. Cookie and similar-technology inventory

This inventory was compiled by reading QuirkSphere's own source code on 27 July 2026. It has not yet been confirmed by scanning the live, deployed Site while it runs, and a third-party script can behave differently at runtime than its integration code suggests. Treat this table as accurate to the code as written, not as a substitute for that runtime scan.

CP-5. Legal position by region

CP-5.1. European Union

CP-5.1.1. Under the ePrivacy Directive (Directive 2002/58/EC), Article 5(3), storing or accessing information on your device requires your prior consent, with only two exemptions: (a) where the sole purpose is carrying out the transmission of a communication, or (b) where it is strictly necessary to provide a service you explicitly requested. There is no general EU-level exemption for analytics or for cookies that merely affect how a site looks or behaves.

CP-5.1.2. Because the EU exemption list is narrower than the UK's (see CP-5.2), a banner configuration that is compliant for UK visitors is not automatically compliant for EU visitors. Any analytics or advertising cookie must be opt-in for an EU visitor.

CP-5.2. United Kingdom

CP-5.2.1. UK law (the Privacy and Electronic Communications Regulations 2003, as amended, regulation 6 and new Schedule A1, in force from 5 February 2026) starts from the same flat prohibition as the EU, but the exemption list is wider. In addition to consent, transmission, and strictly necessary purposes, two new opt-out-permitted exemptions apply: statistical/analytics purposes (where the sole purpose is service improvement, the data is not shared with any other person, clear information is given, and a simple, free way to object exists) and website appearance/functionality, on the same conditions. Fingerprinting cannot use either new exemption.

CP-5.2.2. Advertising, retargeting and any cross-site sharing remain strictly opt-in in the UK, exactly as in the EU. Most default analytics or advertising integrations (including a default Meta Pixel setup) fail the "not shared with any other person" condition and therefore cannot rely on the analytics exemption; they need consent.

CP-5.2.3. ICO guidance sets out what a compliant banner looks like: no pre-enabling of non-essential categories, no implied consent through continued browsing, "reject all" as prominent as "accept all," granular categories, no legitimate-interests toggles pre-set to on, no consent bundled into terms and conditions, and no cookie wall that makes access conditional on accepting tracking. This guidance is what our own consent banner (see CP-6) is built to satisfy.

CP-5.3. United States

CP-5.3.1. There is no single federal cookie-consent law. Instead, a patchwork of state privacy laws (California's CCPA/CPRA and, to date, at least eleven other states) gives consumers a right to opt out of the "sale" or "sharing" of their personal information, which in practice includes cross-context behavioural advertising delivered through cookies, pixels and SDKs like the Meta Pixel.

CP-5.3.2. California's regulations (11 CCR section 7025) require a business that sells or shares personal information to treat a valid opt-out preference signal, such as Global Privacy Control (GPC), as a valid opt-out request, without demanding extra information, charging a fee, or degrading the visitor's experience. A dozen other states with comprehensive privacy laws had begun requiring the same signal to be honoured as of 1 January 2026.

CP-5.3.3. Separately, US law requires a clearly labelled mechanism for a visitor to opt out of the sale or sharing of their information (commonly implemented as a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link). See CP-16 for how this must be implemented.

CP-5.4. India

CP-5.4.1. India does not currently have a cookie-specific statute. The Digital Personal Data Protection Act 2023 (DPDP Act) will, once its substantive provisions come into force, impose broad consent and notice requirements on the processing of personal data by automated means, which is likely to reach cookies and trackers, but its substantive duties (notice, consent, security) are not yet in force as of 27 July 2026; they commence on the date given in the government's notification. Section CP-5.4.2 explains what applies today.

CP-5.4.2. Today, the operative Indian rules are the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ("SPDI Rules"), which require consent for the collection of defined categories of sensitive personal data (for example passwords, financial information, health data, biometric data). Ordinary functional or analytics cookies do not typically fall within those defined categories, so the SPDI Rules do not, by themselves, require an EU-style consent banner for most cookies on this Site.

CP-5.4.3. Once the DPDP Act's substantive provisions come into force, section 9(3) will separately prohibit tracking, behavioural monitoring, or targeted advertising directed at anyone under 18, with no advertising or marketing exemption. This will bind any advertising cookie deployed on this Site with respect to under-18 visitors from that date.

CP-5.5. Other jurisdictions

CP-5.5.1. As QuirkSphere's client base expands into the United Arab Emirates and Canada, the cookie-consent position in each will need separate confirmation before this Site (or any client site QuirkSphere builds) targets those markets. Canada's anti-spam law (CASL) treats some forms of automatic software installation as requiring consent, but whether ordinary cookies, tag managers and pixels fall within that boundary was not confirmed against Canadian regulator guidance in the underlying research.

CP-6. How consent is obtained, withdrawn, and how long it lasts

CP-6.1. Obtaining consent. On your first visit (or first visit since your last consent expired or was withdrawn), a banner appears before any non-essential cookie fires. You choose to accept all, reject all, or open granular settings and choose by category.

CP-6.2. Withdrawing consent. You can change your mind at any time. A persistent control (described at CP-15) reopens your preferences so you can withdraw consent for any category you previously accepted. Withdrawal takes effect immediately: we stop the relevant cookies from firing going forward. Withdrawal does not retroactively undo processing that already happened while consent was in effect.

CP-6.3. How long consent lasts. Your choice is remembered for up to 6 months, after which we ask again. We also ask again sooner than that if we add a new category of cookie, a new third-party recipient, or change the purpose of an existing cookie in a way that was not covered by your original consent.

CP-6.4. What we record. Your choice is stored only in your own browser's local storage; QuirkSphere does not receive or retain a separate copy of it anywhere on our side. That means we cannot restore your choice for you if you clear your browser storage or switch devices, and, as things stand today, we cannot produce proof of what you agreed to if a regulator or you yourself later ask for it. Closing that gap is on our roadmap.

CP-7. The Meta Pixel

CP-7.1. This Site uses the Meta Pixel, a piece of code supplied by Meta Platforms, Inc. that lets us and Meta measure the effectiveness of advertising, build audiences for retargeting, and report on ad performance. It does this by setting cookies (see CP-4) and sending Meta a record of pages you view and actions you take on the Site.

CP-7.2. What this means for QuirkSphere as a Site operator. Under EU and UK data protection law, the advertiser operating a Meta Pixel and Meta Ireland are generally treated as joint controllers of the event data the Pixel collects, for the purposes for which Meta processes it. That means QuirkSphere does not control everything the Pixel does once data reaches Meta, and cannot promise visitors that it does. QuirkSphere installs and configures the Pixel; it does not operate Meta's advertising systems.

CP-7.3. What this means for a client whose site QuirkSphere builds or manages. Where QuirkSphere installs a Meta Pixel (or an equivalent tag from another ad platform) on a client's site, the same joint-controller position applies to the client, not to QuirkSphere. QuirkSphere will tell the client this in writing before installing the Pixel; a client that does not want that legal position should say so before the Pixel is installed, not after.

CP-7.4. What this means for visitors. If you accept the Advertising category in the consent banner, the Meta Pixel begins tracking your visit and Meta may combine that information with what it already knows about you (if you have a Meta account or have visited other sites running the Pixel) to build an advertising profile and show you retargeted ads. If you decline, the Pixel does not fire; see CP-19 for the technical requirement behind that promise.

CP-8. How to control cookies in your browser

CP-8.1. In addition to the consent choices this Site gives you, every modern browser lets you block, delete or be warned about cookies at the browser level. This works independently of any consent you have given us, and can be used at any time:

• Chrome: Settings > Privacy and security > Cookies and other site data.
• Firefox: Settings > Privacy & Security > Cookies and Site Data.
• Safari: Settings (macOS) or Settings app (iOS) > Privacy > Cookies and website tracking.
• Edge: Settings > Cookies and site permissions.

CP-8.2. Blocking all cookies may stop some parts of the Site from working correctly, particularly anything relying on a strictly necessary cookie (see CP-3.1).

CP-8.3. Browser settings alone are not a substitute for, and are not treated in law as equivalent to, giving or withholding consent through this Site's own banner. Set both if you want full control.

CP-8.4. If your browser or a browser extension sends a Global Privacy Control (or equivalent recognised opt-out preference) signal, this Site is required to honour it for advertising cookies where US law applies to you; see CP-18.

CP-9. Changes to this policy and contact

CP-9.1. We may update this policy when our cookie use changes, the law changes, or as part of our scheduled review, next due 27 January 2027. We will update the "last updated" date and, for material changes affecting your prior consent, prompt you to make a fresh choice per CP-6.3.

CP-9.2. Questions about this policy, or to exercise your rights over the data cookies collect, contact business@quirksphereagency.com. For India-specific grievances, contact [TO BE CONFIRMED] at [TO BE CONFIRMED].