Marketing Opt-out Policy

Short description: This policy explains how users can opt out of marketing (email/SMS/calls/in-app/online ads), exercise “Do Not Sell/Share” and targeted advertising opt-outs, and manage cookies/trackers (including Global Privacy Control). It covers scope, channels, verification, timelines, exceptions, security, appeals, and live URLs, aligned with GDPR/UK GDPR, Singapore PDPA, CPRA/CCPA, and other applicable U.S. state laws.

1) Purpose and scope (Purpose & Scope)

This policy explains how users can stop marketing across channels (email, SMS, calls, in-app notifications, online ads/cookies), withdraw consent, and use “Do Not Sell/Share” and targeted advertising opt-outs under GDPR/UK GDPR (ePrivacy/PECR), Singapore PDPA, and U.S. state laws (e.g., CPRA/Colorado). It applies to verified users and authorized agents. The English version is authoritative. We update this policy when laws or ad-platform requirements change. Necessary service/security communications (e.g., receipts, security alerts, essential terms updates) are not marketing and may continue as permitted.

Coverage by channel and legal basis: We distinguish between (a) direct marketing (email, SMS, calls, in-app notices), (b) online advertising and retargeting (including cookies, SDKs, pixels, device IDs), and (c) data disclosures that may be considered “sale,” “share,” or “targeted advertising” under U.S. state laws. In the EU/UK, ePrivacy/PECR requires consent for non-essential cookies/trackers and allows an absolute right to object to direct marketing. In Singapore, consent or other valid grounds are required for marketing; users may withdraw consent at any time. In U.S. states with comprehensive privacy laws, users have the right to opt out of sale/share and targeted advertising, and GPC signals must be honored where required.

B2B vs. B2C contexts: We apply opt-out controls consistently for both individual consumers and business contacts. Even in B2B communications, if a message is promotional, we treat it as marketing and honor opt-outs. Transactional and service communications (e.g., invoices, security alerts, system availability notices) are treated as necessary communications, not marketing.

Children and teens: We do not knowingly market to children. Where applicable laws impose stricter rules for minors (e.g., under 13/16 in certain U.S. states, under 13/14 in COPPA contexts), we avoid sale/share/targeted advertising and obtain verifiable consent where required. If we discover that minor data was used for marketing in violation of law, we will cease processing and remediate promptly.

Cross-border considerations: Marketing systems may operate across regions. We apply regional consent/opt-out states per user or per device/browser where technically feasible, and we avoid re-seeding marketing lists across jurisdictions in a way that would override a user’s local opt-out/consent status. When personal data is transferred internationally for marketing (e.g., to vendors/processors), we rely on appropriate safeguards (e.g., SCCs, UK IDTA/Addendum, BCRs) and extend opt-out instructions to those processors.

Vendors and ad-tech partners: We use contracts and platform controls to require processors and ad partners to respect opt-out/Do Not Sell/Share/Targeted Advertising signals and to limit data use to permitted purposes. When you opt out, we instruct relevant processors/recipients to stop sale/share/targeted advertising uses where applicable and not disproportionate.

2) Rights and principles (Rights & Principles)

• Opt-out any time: You may opt out of marketing without affecting core services.
• Withdraw consent: Where consent is the basis, you may withdraw it at any time.
• Do Not Sell/Share & targeted advertising: We honor these rights in applicable jurisdictions and respect GPC signals where required.
• Transparency and minimization: Clear choices, minimum necessary data, and no marketing/profiling when opted out.
• No misuse: Opt-outs do not cover necessary service/security communications allowed by law. In the EU/UK, you may always object to direct marketing (including profiling for marketing) under Art. 21(2) GDPR/UK GDPR, including when legitimate interests is the lawful basis.
• Granular choice: Where supported, you can opt down (e.g., limit to product updates, exclude partner offers) instead of full opt-out. If you do nothing, we honor the strictest applicable opt-out signal (e.g., GPC for sale/share/targeted advertising where required).
• Proof of action: We log consent/withdrawal and opt-out states (by channel and by jurisdiction) to demonstrate compliance and avoid reactivation.
• Fairness and non-discrimination: We do not deny services or vary pricing/quality solely because you exercised a marketing opt-out, subject to lawful loyalty programs or financial incentives where expressly permitted and disclosed under applicable law.
• Timely effect: We apply opt-outs promptly within the legal timelines per channel. While propagation across all systems may take some time, we suppress marketing as soon as feasible and within the mandated windows.
• Processor/recipient alignment: Where data is shared with processors/recipients for marketing, sale/share, or targeted advertising, we pass down your opt-out/withdrawal and require compliance under contract; we can share recipient categories on request.
• Accuracy and scope: Opt-outs are applied to the identifiers you provide (e.g., email, phone) and, where technically feasible, to device/browser identifiers if you manage cookies/consent. For complete coverage, set preferences on each device/browser you use.
• Security of choices: Identity verification (MFA/confirmed email/phone) protects you from unauthorized opt-in/out changes. Suspicious or conflicting requests may be paused pending additional verification.
• Withdrawal vs. objection: In consent-based regimes, you may withdraw consent; in legitimate-interest regimes, you may object (and we will cease direct marketing). In sale/share states, opt-out is required for those transfers; in targeted advertising contexts, opt-out stops cross-context behavioral advertising uses.

3) Channels and verification (Channels & Verification)

• Self-service:
  • Email: “unsubscribe” link in each marketing email.
  • SMS: reply “STOP” (where supported).
  • Cookie/consent banner or preference center on web/app.
  • In-app notification settings.
• Direct request: Email privacy@tanqory.com or marketing@tanqory.com with subject “Marketing Opt-out” and include the registered email/phone.
• Verification: MFA or verified email/phone to prevent unauthorized opt-outs. Agents need POA/authorization plus ID for principal and agent; incomplete documents are declined with reasons.
• GPC signals: We treat valid GPC as a “Do Not Sell/Share” and targeted advertising opt-out where required by law.

4) Scope and exceptions (Scope & Exceptions)

• Covers: Marketing emails/SMS, promotional calls, in-app marketing, cross-context/targeted advertising, sale/share of personal data for marketing.
• Exceptions: Contractual/necessary communications (receipts, security alerts, material terms notices); processing required by law; legitimate-interest marketing in some regions may require case-by-case opt-out handling. If data includes others or must be retained by law, we stop marketing use but may retain for compliance. Some features may degrade if non-essential cookies are blocked (e.g., remembering preferences).

5) Cookies/trackers and GPC (Cookies/Trackers & GPC)

• Consent-first in EU/UK/EEA: Non-essential cookies (marketing/most analytics) are blocked until consent. A preference center allows granular opt-in/out by category; we log consent/withdrawal (GDPR Art. 7).
• GPC: We honor GPC as a “Do Not Sell/Share” and targeted advertising opt-out where required (e.g., CPRA/Colorado).
• Changing choices: You can revisit the banner/preference center anytime. Cookie purposes/providers are listed in the Cookie Policy; we update when vendors or uses change.

6) Timelines and SLA (Timelines & SLA)

• Email/SMS opt-outs: aim to process within 7 calendar days from verification.
• Do Not Sell/Share/targeted advertising: apply as soon as feasible, within 15 days or faster where required by U.S. state law.
• For combined U.S. state rights requests (e.g., CPRA/CCPA), we can respond within 45 days and may extend once by up to 45 days where reasonably necessary, with notice.
• Complex/agent-verified requests: we provide status updates.
• Enterprise SLAs: governed by the Order Form/contract addenda; this policy is a baseline.

7) Service impact and mandatory communications (Service Impact & Mandatory Comms)

Opting out of marketing does not remove core service communications. You may miss promotional/news updates delivered via marketing channels. Mandatory communications (transactions, security, critical terms) continue where permitted by law and contract. Contact privacy@tanqory.com if you want to review necessary communications; changes may affect service terms.

8) Security and verification (Security & Verification)

• Identity checks (MFA/verified email/phone) precede changes.
• TLS in transit and AES-256 at rest for opt-out records; audit trails of changes.
• Opt-outs apply to the specified account/device/browser; set preferences on each device/browser used.
• Suspicious requests may be paused/denied with reasons; additional verification may be requested.

9) Appeals and limitations (Appeals & Limitations)

• Appeal by emailing privacy@tanqory.com within 30 days with request details. We aim to review within 15 business days and will inform if more time is needed.
• If limited by law/contract/third-party rights, we explain the reason and alternatives (e.g., channel-specific opt-down, stopping third-party marketing).
• If unresolved, you may contact the relevant regulator (EU/UK/SG DPA or applicable U.S. state authority); contact details available on request. We also notify processors/recipients involved in sale/share/marketing use, where applicable and not disproportionate, to align with your opt-out.

10) Recordkeeping and audit (Recordkeeping & Audit)

• We log opt-out/Do Not Sell/Share/GPC signals, verification channel/date, effective date, marketing categories disabled, and reasons for any limits.
• Records retained 3–5 years or longer if required by law/contract, with least-privilege, encrypted access.
• Periodic review under ISMS and, where applicable, SOC 2; changes to opt-out tooling/vendors are tested and documented before production.

11) Policy updates and language (Policy Updates)

• Reviewed at least annually or sooner if laws/ad-platform rules change.
• Significant updates posted at https://legal.tanqory.com and via registered email; we note effective date, version, and change summary.
• The English version is authoritative; translations are for convenience.
• Questions: privacy@tanqory.com.

---

Appendix A: Live URLs/channels (replace with live links when ready)

• Do Not Sell/Share & Cookie Settings: https://legal.tanqory.com/cookie-settings
• Email unsubscribe: link in every marketing email.
• SMS opt-out: reply “STOP” (where supported).
• Data Rights Portal: https://legal.tanqory.com/rights (example).

Glossary

• MFA (Multi-Factor Authentication): Authentication using two or more factors.
• POA (Power of Attorney): Authorization for an agent to act on behalf of the account holder.
• GPC (Global Privacy Control): Browser signal for Do Not Sell/Share and targeted advertising opt-out.
• TLS (Transport Layer Security): Protocol for encrypting data in transit.
• AES (Advanced Encryption Standard): Standard for encrypting data at rest/in transit.
• ISMS (Information Security Management System): Framework for managing information security risks.
• SOC 2: Audit framework covering security, availability, confidentiality, processing integrity, and privacy controls.
• DPA (Data Protection Authority): Regulator overseeing data protection laws.