This Cookie Policy explains how Three's A Crowd PTY LTD trading as Thirteen Degrees ("we", "us") uses cookies, pixels, SDKs, local storage entries, server logs and similar technologies (together "cookies") on our marketing site, client portal, studio workspace and academy (the "Services"). It supplements, and should be read with, our Privacy Policy and Terms of Use.

This Policy is issued under the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable, the EU and UK General Data Protection Regulations ("GDPR"), the ePrivacy Directive 2002/58/EC (as implemented in EU member states and the UK Privacy and Electronic Communications Regulations), the California Consumer Privacy Act as amended ("CCPA/CPRA") and equivalent laws.

1. What is a cookie

A cookie is a small text file placed on your device when you visit a site. Similar technologies include web beacons, pixel tags, SDKs in mobile apps, local and session storage and server-side identifiers. We use the term "cookies" to cover all of them in this Policy.

2. Categories of cookies we use

Strictly necessary. Authentication, session, CSRF protection, load balancing, security and fraud prevention. These cannot be disabled and the Services will not function without them. Legal basis: legitimate interest / performance of contract; no consent required under ePrivacy.
Functional. Preferences such as active workspace, locale, theme and brand selection, and remembering that you have dismissed a notice. Legal basis: legitimate interest or consent depending on jurisdiction.
Analytics / performance. Aggregated traffic and product analytics to understand how the Services are used and to improve them. In the EU, UK, and other regions that require it, these are set only after you give consent through our cookie banner.
Marketing / advertising. We do not set marketing or advertising cookies on our own marketing site. On client properties we configure and on campaigns we operate on a client's behalf, advertising cookies, pixels and SDKs from Meta (Facebook, Instagram, WhatsApp), TikTok, Google (including YouTube, Google Ads, Google Analytics, Google Tag Manager), Snap, Pinterest, X (Twitter), LinkedIn and similar Platforms may be set under the client's consent framework and privacy notice. The client is the controller of that activity.

3. Third-party embeds and platforms

Some pages embed video or content from third parties such as Vimeo, YouTube, Instagram and TikTok. These embeds may set their own cookies and collect device, IP and viewing data under those providers' own privacy and cookie policies, which we do not control.

When we run paid media or build measurement infrastructure for clients, advertising Platforms may set cookies and pixels and may receive event data through server-side Conversion / Events APIs (including Meta Conversions API, TikTok Events API, Google Enhanced Conversions, Customer Match and Custom Audiences). Those Platforms act as independent or joint controllers for the data they receive under their own terms. The client property's consent banner and privacy notice govern whether and how those technologies are used.

4. Legal basis and consent

In the EU, UK, EEA, Switzerland and other regions with prior-consent rules, we set non-essential cookies only after you give consent through our cookie banner. You can withdraw consent at any time via the cookie settings link in the footer or by clearing cookies in your browser.
In South Africa, we rely on POPIA's grounds for processing (consent, performance of a contract, legitimate interest and legal obligation) depending on the category.
In the United States, where applicable, we honour "Do Not Sell or Share My Personal Information" requests and Global Privacy Control ("GPC") signals for the categories of cookies we control.
Strictly necessary cookies do not require consent because they are essential to deliver the Services you have requested.

5. Managing and withdrawing consent

You can clear or block cookies in your browser at any time. Disabling strictly necessary cookies will break sign-in, the portal and other protected areas. EU/UK visitors are presented with a consent choice where non-essential categories are gated. You can change your choice at any time via the cookie settings link in the footer (where shown), via browser controls, or by emailing privacy@13-degrees.com. We respect browser-level signals such as Global Privacy Control and "Do Not Track" where legally required.

Useful third-party opt-out resources include youronlinechoices.eu, optout.aboutads.info and optout.networkadvertising.org.

6. Retention

Session cookies expire when you close the browser. Persistent cookies typically expire within 13 months unless renewed, in line with EU regulator guidance. Third-party cookies follow the provider's own retention. Server-side identifiers and audit logs are retained in line with our Privacy Policy.

7. International transfers

Some cookie and Platform providers are located outside South Africa, the EU and the UK. Where personal information is transferred cross-border in connection with cookies we control, we rely on POPIA section 72 grounds and, for GDPR / UK GDPR data, Standard Contractual Clauses or equivalent transfer mechanisms with the receiving provider.

8. Changes

We may update this Policy from time to time. Material changes will be posted on this page with a new "Last updated" date.

9. Your rights and contact

You have rights of access, correction, deletion, objection and (where applicable) portability over personal information processed via cookies. See section 10 of our Privacy Policy for details and how to exercise them.

Information Officer: privacy@13-degrees.com. Postal: Three's A Crowd PTY LTD, Century City, Cape Town, South Africa. You may also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za or your local EU/UK or state data protection authority.