Tracking and Consent

Version 2026-09-26.3 | 26 September 2026 | CBX Media LLC

1. Before installation

Register only domains you operate or lawfully manage, using their assigned site/survey key. Attribution, linked surveys and conversion feedback require appropriate visitor information and legal grounds. Contract acceptance, an advertising connection or CAPI activation is not visitor consent. The underlying enquiry or purchase must remain available without advertising consent.

2. Technical signal

The consent manager loads optional tracking scripts only after the relevant choice. Set window.bozConsent = true only when the specific attribution, recipients and purposes are permitted. On refusal or withdrawal set it to false and dispatch window.dispatchEvent(new Event('boz-consent-change')). A TCF storage permission alone is insufficient. Before consent, do not read, store or send tracking parameters, form/order data or optional cookies. Withdrawal must also block queued events.

_boz_attr stores first-touch attribution for at most 90 days; session storage _boz_last stores the last permitted marketing contact and must be cleared on withdrawal. Survey marker _boz_svy_… lasts at most 90 days. Use only for the authorised purpose.

3. Conversion feedback and surveys

Meta Conversions API and other feedback require documented customer instructions and suitable visitor consent covering the particular recipient. Hash, click ID, event ID, time and sanitised source URL are limited to what is necessary. Hashing is not anonymisation. Do not upload email hashes or customer segments as lists without their own legal basis. A technical consent field alone is not valid consent evidence.

Surveys are voluntary. Order ID, revenue, country, free text and attribution linkage are processed only as expressly described. Answering one question is not blanket consent to hidden order-data transfers.

4. Customer website text

Incorporate this paragraph into the website operator’s full privacy notice, alongside its identity, actual activated platforms and recipients, transfer safeguards and accessible cookie controls:

“With your voluntary consent, we use Marketing AIgency from CBX Media LLC, UAE, to measure the source and success of our advertising. Authorised source/click identifiers, sanitised page information and timestamps are processed. On submitting a designated form your email may be temporarily transmitted in plaintext, normalised and hashed. Hashes remain personal data. Your underlying enquiry is available without advertising consent. Optional conversion feedback and linked surveys take place only as separately explained and authorised. The basis is GDPR Article 6(1)(a) and, for consent-requiring device access, section 25(1) German TDDDG. You can change your choice for the future through our cookie settings. Raw data are normally retained for at most 90 days. CBX acts on our instructions; necessary UAE access, further recipients and transfer safeguards are described in our full privacy notice.”

5. Functional verification

Before activation, check no choice, refusal, analytics only, attribution, individual platform purposes, withdrawal, return visits, form/manual lead events and surveys. Inspect network, storage and server forwarding. No optional event before authorisation or after withdrawal and no sensitive URL/form fields. Report failures to hello@marketing-aigency.com and suspend the affected integration until fixed.