A clear account of site technology.
This notice distinguishes necessary account sessions from proposed diagnostics. Actual production technology and settings still require verification.
Public browsing and requests
Policy pages require no account or acceptance. Site delivery can involve IP address, request path, time, status and browser details in configured hosting/network logs. A page without a form does not necessarily process no personal data.
Account session cookies
The development portals use separate API session cookies: getoutsourced_admin_session, getoutsourced_employer_session and getoutsourced_worker_session. Intended production settings are host-only, HttpOnly and HTTPS with appropriate SameSite behavior; these need deployed verification. A CSRF token in memory protects authenticated requests. These features are for access/security, not permission to advertise.
Diagnostics
Sentry was selected for error monitoring. Only configured, reviewed, minimized technical events should be sent. Actual project, region, retention and scrubbing need verification; the receiver may receive connection metadata. Do not include credentials, tokens, messages, application evidence, full forms or sensitive identifiers. Selection does not authorize session replay or profiling.
Optional technology and your controls
No advertising pixels, optional analytics or marketing cookies are authorized merely by publishing this notice. Review purpose, recipients, choices and required consent before adding them. Use browser settings to inspect or clear cookies; account functions may stop working. Report unexpected items without sending a cookie value or credential.
Before final publication
Complete the deployed cookie/storage inventory, actual expiry/security attributes, diagnostic data settings and any optional-technology review. Cookie expiry differs from retention of related database/audit records. Update this notice when actual technology changes; the privacy notice covers wider processing and requests.