Cookie Policy

This page describes the cookies and equivalent browser-storage mechanisms used on siteminderstore.org and on the customer-facing surfaces of the Modules we distribute. It is a companion to the Privacy Policy and it satisfies the transparency obligations of Article 13 of Decree 13/2023/ND-CP and of the Law on E-Transactions 2023. The default posture of the Marketplace is minimalist: no third-party analytics, no advertising trackers, no cross-site pixels. Anything beyond the strictly necessary is opt-in.

§ 01What we mean by "cookie"

A cookie is a small text file that a website places on your device so that the site can recognise your session on subsequent requests. Modern browsers offer several equivalent mechanisms — localStorage, sessionStorage, IndexedDB, and the Cache API — that we treat under the same rules as cookies whenever they are used to hold identifiers or preferences. In the tables below we list each mechanism, its purpose, its retention, and the party that reads it.

§ 02Cookies we set on the Marketplace

Name	Mechanism	Purpose	Retention
smstore_session	Cookie, HttpOnly, Secure, SameSite=Lax	Signed session token that keeps you logged in between page loads.	Cleared on logout; otherwise expires after 30 days of inactivity.
smstore_cart	localStorage	Persists your Marketplace cart across page reloads so that a browser refresh does not empty it.	Cleared at checkout, on manual "empty cart", or after 30 days.
smstore_consent	Cookie, SameSite=Lax	Records the choices you made in the consent banner so that we do not ask again for six months.	6 months, or immediately if you re-open the banner and change your mind.
smstore_locale	Cookie, SameSite=Lax	Remembers your language preference (English / Tiếng Việt).	12 months.
smstore_csrf	Cookie, HttpOnly, Secure, SameSite=Strict	Anti-CSRF token bound to your session; strictly necessary.	Cleared with the session.

All the mechanisms in the table above are considered strictly necessary to deliver the service you have requested and are set without asking for consent, in line with Article 13(3) of Decree 13 which does not require consent for processing that is necessary for the performance of a contract to which the data subject is a party. You can still delete them from your browser at any moment; the consequence will be that you will need to log in again and reconfigure your language.

§ 03Analytics — opt-in only

We do not run any third-party analytics by default. We measure aggregate usage of the Marketplace with a first-party log pipeline that stores only anonymised counters (page path, response status, HTTP method, hashed session identifier truncated to eight bytes). No personal identifier and no IP address is written to the analytics store.

Customers who wish to add their own analytics to a Module's customer-facing surface — for example a booking-recovery landing page that a hotel embeds in its guest e-mails — may opt in on a per-property basis to Google Analytics 4 or to Meta Pixel. The opt-in is captured in an audit log with the timestamp, the seat that authorised it, and the property scope. When a property has opted in, the corresponding third-party tag is loaded only after the visitor has accepted the analytics category in the consent banner shown by that property. If the visitor declines, the tag is not loaded and no data is sent to Google or Meta.

§ 04The consent banner and how to withdraw consent

On your first visit to the Marketplace a consent banner appears at the bottom of the page. It offers three choices: "Accept only strictly necessary", "Accept all", and "Manage preferences". The default option, if you close the banner without choosing, is "Accept only strictly necessary". Your choice is remembered in the smstore_consent cookie for six months. You may revisit it at any moment by clicking the "Cookies" link in the footer of every page. Withdrawing consent takes effect immediately for future page loads; cookies that were already set with your prior consent can be deleted from your browser settings.

§ 05Browser-level controls

Every modern browser lets you view, block, or delete cookies. The exact path depends on the browser, but the settings usually live under "Privacy and security" or an equivalent heading. You can:

• Refuse all cookies from siteminderstore.org, which will prevent you from logging in but will let you browse public pages.
• Refuse only third-party cookies, which is the default of most privacy-friendly browsers and which does not affect the Marketplace since we do not use third-party cookies of our own.
• Delete cookies each time you close the browser, which will require you to accept the consent banner on every visit.
• Enable "Do Not Track" or "Global Privacy Control". We honour both by defaulting to "Accept only strictly necessary" and by suppressing the consent banner.

§ 06Cookies set inside a Module

A Module you have installed may set additional cookies on the customer-facing surfaces it renders. These cookies are always documented on the Module's Marketplace page in the "Cookies and storage" section. If a Module you use behaves differently from what is documented, please report it to abuse@siteminderstore.org so that we can investigate and, if necessary, remove the Module from the catalogue.

§ 07Third-party services embedded in our support workflow

When you open a support ticket through the widget in the bottom-right of the Marketplace, a session cookie from our helpdesk provider is set for the duration of the conversation. The cookie contains an opaque ticket identifier and does not carry any personal data. It is deleted when you close the ticket or, at the latest, after seven days of inactivity.

§ 08Cookies and Vietnamese law

Decree 13/2023/ND-CP does not name cookies specifically, but Articles 13 and 17 require transparent information about every processing of personal data and consent for any processing that is not covered by another legal ground. The Law on E-Transactions 2023 requires operators of e-transaction platforms to inform users of the technologies used to identify their transactions. This Cookie Policy is our response to those requirements. If the Ministry of Public Security or the Ministry of Information and Communications publishes more detailed guidance on cookie consent, we will update this policy accordingly.

§ 09Retention summary

Category	Retention	Cleared by
Strictly necessary	Session or up to 30 days	Logout or browser cache clear
Preferences (consent, locale)	6 to 12 months	Re-opening the banner
Cart persistence	30 days	Checkout or manual clear
Opt-in analytics (per property)	Per third-party retention policy	Withdrawal of the opt-in

§ 10Changes to this Cookie Policy

We review this policy each time we add or remove a cookie or a browser-storage mechanism, and at least once per calendar year. Every change is versioned at the top of this page. Material changes (the introduction of a new opt-in category, for example) are also announced in the Marketplace changelog and, where the change affects logged-in Customers, by e-mail to the account owner.

§ 11Contact

Any question about this Cookie Policy or about a specific cookie set by the Marketplace can be sent to dpo@siteminderstore.org. Our Data Protection Officer will reply within one Vietnamese business day. For urgent questions related to a security concern, please write to security@siteminderstore.org and mark the subject "Cookies — urgent".

§ 12Related documents

This Cookie Policy should be read together with the Privacy Policy for the full picture of how we process personal data, with the Vietnam Personal Data Protection page for a detailed walkthrough of Decree 13/2023/ND-CP, and with the Cybersecurity Law compliance page for the localisation obligations that shape where the cookies you set on the Marketplace are ultimately stored.

§ 13Independence from SiteMinder Limited

SiteminderStore Vietnam Company Limited is an independent Vietnamese company. It is not affiliated with, sponsored by, or endorsed by SiteMinder Limited. The Modules we distribute integrate with your SiteMinder Workspace via the official SiteMinder Application Programming Interface. Any cookie set by the SiteMinder platform itself is governed by the cookie notice published on the SiteMinder website and is outside the scope of the present policy.

§ 14Effective date

This version of the Cookie Policy is in force from 12 August 2026 and supersedes all previous versions. Previous versions are archived and available on request to dpo@siteminderstore.org.

§ 15Frequently asked questions about cookies

Why do I need to accept cookies to log in? The session cookie is a signed token that identifies your browser between HTTP requests. Without it, every page load would send you back to the login form. The token is short (a few hundred bytes), carries no personal data beyond an opaque user identifier, and is marked HttpOnly, Secure, and SameSite=Lax so that no script on any other origin can read it.

Why does the consent banner reappear after six months? Six months is the retention we chose for the consent record, in line with the industry consensus that consent goes stale over time and should be refreshed. If your regulatory circumstances change — a new law is passed, a new subprocessor is added, a new category of cookie is introduced — we may shorten the retention and ask for a fresh consent before the six-month anniversary.

Do you honour "Do Not Track"? Yes. When the browser sends the "DNT: 1" header or the more recent Global Privacy Control signal, we default to "Accept only strictly necessary" and we suppress the consent banner. You do not need to click anything.

Can I export my consent record? Yes. The account settings page contains a "Download consent record" button that produces a signed JSON file containing every consent choice you have made in the last twenty-four months, with the timestamp, the browser fingerprint, and the version of the notice that was shown. The file is signed with our long-lived signing key so that it can be presented in evidence.

What happens to my cookies when I close my account? The session cookie is invalidated on the server side within a few seconds of the account-closure event. The consent record cookie remains in your browser until its natural expiry or until you delete it manually; it no longer maps to any active account. The cart-persistence localStorage entry is cleared by our client-side code at the moment of account closure.

Where do I read about the cookies set by a specific Module? Every Module's Marketplace page has a "Cookies and storage" section that lists the browser-storage mechanisms it uses on its customer-facing surfaces, together with their purposes and retention windows. If a Module does not have such a section it is because the Module has no customer-facing surface and does not set any cookie or localStorage entry.