Cookie Policy
Last Updated: May 15, 2026
Effective Date: May 12, 2026
Operated by N.S. IT SERVICES PTY LTD (ABN 75 122 740 121 / ACN 122 740 121)
1. What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work, improve user experience, and provide reporting information to site operators. TheDeskMonitor uses cookies on its website and web application at thedeskmonitor.com.
2. Our Approach
We operate a minimal-cookie approach. We use essential cookies that are required for authentication and security (always active, cannot be disabled), and with your permission we use analytics cookies to understand how visitors use our site. We do not use advertising cookies or retargeting pixels at this time.
When you first visit the site, our cookie consent banner gives you granular control over which non-essential categories are active. You can change your preferences at any time via the Manage Cookies link in the site footer.
Consent state is stored in the dm_consent cookie (see Section 5). If you choose to reject analytics cookies, only essential cookies will be set.
Jurisdiction-Aware Consent Defaults
TheDeskMonitor detects your approximate jurisdiction using your network location (provided by Cloudflare, our CDN provider — no additional tracking is performed). Visitors from jurisdictions where non-essential cookies require active opt-in under applicable law are presented with a cookie banner where Analytics and Marketing toggles are OFF by default. You must actively enable these categories if you wish to consent.
Jurisdictions treated as strict opt-IN (toggles unchecked by default):
- European Union (EU) — all 27 member states, under GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive (2002/58/EC)
- European Economic Area (EEA) non-EU — Norway, Iceland, Liechtenstein
- United Kingdom — UK-GDPR and the Privacy and Electronic Communications Regulations (PECR, SI 2003/2426) retained post-Brexit
- Switzerland — revised Federal Act on Data Protection (revFADP/nDSG, effective 1 September 2023, Art. 45c revTDG)
Visitors from other jurisdictions may see the Analytics toggle pre-selected (opt-OUT model), as applicable law in those regions permits this default. Regardless of your jurisdiction, you may freely change your preferences via the consent banner at any time. If we cannot determine your jurisdiction (e.g. you are accessing the site via a privacy proxy), we default to the strict opt-IN setting as a precaution.
3. Essential Cookies
These cookies are strictly necessary for authentication and security. They are set automatically when you use the platform and cannot be disabled. Without them, you would not be able to log in or submit forms securely. Legal basis: strictly necessary under ePrivacy Regulations; contract performance under GDPR Art. 6(1)(b).
| Cookie | Purpose | Duration | HttpOnly | Secure |
|---|---|---|---|---|
.DeskMonitor.Session |
Authenticates your session after login. Contains encrypted user identity. | Up to 30 days with "Remember Me"; sliding expiry refreshed on activity. Sessions without "Remember Me" expire at browser close. | Yes | Yes |
.DeskMonitor.External |
Temporary cookie used during Google/Microsoft social login flow. Automatically deleted after login completes. | 15 minutes | Yes | Yes |
.AspNetCore.Antiforgery.* |
Protects against cross-site request forgery (CSRF) attacks. Required for form submissions. | Browser session | No* | Yes |
.DeskMonitor.Preferences |
Single encrypted cookie storing your preferences: theme selection and cookie consent decision. All values encrypted via ASP.NET Data Protection. No visitor identifier or tracking UUID is stored in this cookie. | 1 year | Yes | Yes |
dm_ref |
Partner referral attribution cookie. Set only when you arrive via a partner referral link (/r/{code}). Stores the referral code in plain text so it can be captured at account registration. Not HttpOnly — readable by JavaScript at sign-up time. Not encrypted. Contains only an opaque referral code; no personal data. |
365 days | No | Yes |
dm_consent |
Records your granular cookie consent choices (essential, analytics, marketing) and the policy version under which consent was given. Not HttpOnly so the browser can read it to gate analytics scripts client-side. | 12 months | No | Yes |
* The anti-forgery cookie is not HttpOnly by design — it must be readable by the browser to submit forms securely.
4. Analytics Cookies — opt-in
With your permission, TheDeskMonitor uses the following analytics services to understand how visitors interact with our public marketing site. Both services are loaded into the same Analytics consent category and are only activated when you opt in.
Analytics tools are only loaded when you have opted in via the consent banner. If you reject analytics cookies, neither service is loaded and no data is sent to any third party.
| Provider | Cookie / Data Collected | Purpose | Data Location | Retention |
|---|---|---|---|---|
| Microsoft Corporation (Microsoft Clarity) |
Page URLs, click events, scroll depth, viewport size, session replay, IP address (truncated), browser user-agent. No full IP address retained. Clarity automatically masks all <input> values — no form data, passwords, or emails are captured. |
Session replay, heatmaps, and scroll maps to understand how visitors navigate our marketing site and identify usability improvements. | United States (Microsoft Azure). Transfer mechanism: Standard Contractual Clauses — see Section 6. | Session recordings: 30 days. Aggregated heatmap data: up to 90 days. |
| Google LLC (Google Tag / Google Analytics 4) |
Page URLs, click events, session identifiers, IP address (truncated to city level — last octet zeroed), browser user-agent, referrer, traffic-source attribution. No full IP address retained. | Site usage analytics, traffic-source attribution, and conversion tracking to understand how visitors discover and interact with our marketing site. | United States (Google Cloud). Transfer mechanism: Standard Contractual Clauses — see Section 6. | 14 months (GA4 default, configurable by Google account settings). |
What these analytics tools do NOT capture
- Passwords, email addresses, payment card numbers, or any text typed into form fields — all
<input>elements are masked by Microsoft Clarity by default. - Data from authenticated pages inside the TheDeskMonitor application — analytics tools are configured on the public marketing site only and excluded from
/Billing/*and internal application routes. - Cross-site tracking or advertising profiling — neither Microsoft Clarity nor Google Analytics 4 is used for advertising targeting on our site.
Legal basis
Your consent (GDPR Art. 6(1)(a) / ePrivacy Regulation). You may withdraw consent at any time (see Section 7). Both services stop loading on subsequent page views once consent is revoked.
5. Marketing Cookies
TheDeskMonitor does not currently use any marketing or retargeting cookies (such as Meta Pixel, Google Ads Tag, or LinkedIn Insight Tag). The marketing category in our consent banner is a placeholder reserved for future tools. If we introduce marketing cookies, this policy will be updated and existing users will be re-prompted for consent before any new tools are activated.
6. International Data Transfers — Schrems II
Both analytics services listed in Section 4 are US-hosted and, when you consent to analytics cookies, anonymised session data is transferred from the EU/EEA to the United States.
Microsoft Clarity (Microsoft Corporation)
Transfer mechanism: Standard Contractual Clauses (SCCs) approved by the European Commission under Implementing Decision (EU) 2021/914. Microsoft's Data Processing Agreement, which incorporates the SCCs, is available at microsoft.com/licensing. Microsoft's government access transparency report is published at microsoft.com/transparency.
Google Analytics 4 (Google LLC)
Transfer mechanism: Standard Contractual Clauses (SCCs) approved by the European Commission under Implementing Decision (EU) 2021/914. Google's data processing terms and incorporated SCCs are available at policies.google.com/privacy/frameworks. Google's privacy policy is published at policies.google.com/privacy. Google's government access transparency report is published at transparencyreport.google.com.
EU residents may request a copy of the applicable SCCs by emailing [email protected].
7. How to Control Cookies
Cookie Consent Banner
When you first visit TheDeskMonitor, a cookie consent banner is displayed. You may independently toggle Analytics and Marketing categories. Essential cookies are always active. Your choices are saved to the dm_consent cookie.
Manage your preferences at any time: Click the Manage Cookies link in the site footer to re-open the consent banner. You may change your choices or revoke consent entirely at any time.
Revoking Analytics Consent
To revoke analytics consent: open the consent banner (footer → Manage Cookies), uncheck the Analytics toggle, and click "Accept selected". Clarity will not be loaded on subsequent page views. Microsoft may retain data already collected prior to revocation for up to 30 days per their standard retention schedule.
Browser Settings
You can also control and delete cookies through your browser settings. Note that disabling essential cookies will prevent you from logging into TheDeskMonitor.
- Chrome: Settings → Privacy and Security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Privacy, search, and services → Cookies and site permissions
Provider-Level Opt-Outs
You may also opt out of individual providers directly, independently of our consent banner:
- Microsoft Clarity: Opt out at choice.microsoft.com. This applies across all websites using Clarity.
- Google Analytics: Install the Google Analytics Opt-out Browser Add-on. This prevents Google Analytics from collecting data on all websites you visit.
8. Data Requests & DSAR
To request access to, correction of, or deletion of data held about you, contact our Privacy Team at [email protected]. We will respond within 30 calendar days.
Note: Clarity session data is associated only with anonymous session identifiers — it cannot be linked to your personal identity unless you have provided your name or email within a captured session. Because Clarity masks all input fields, this is not possible through normal use of our site.
9. Changes to This Policy
We may update this Cookie Policy from time to time to reflect changes in tools we use or applicable legal requirements. Material changes — such as adding a new analytics provider or introducing marketing/retargeting cookies — will be communicated via an updated notice on the website and via the consent re-prompt mechanism (version bump in dm_consent). The "Last Updated" date at the top of this page will always reflect the most recent revision.
10. Contact Us
For questions about our use of cookies, please contact us at [email protected] .
N.S. IT SERVICES PTY LTD (ABN 75 122 740 121 / ACN 122 740 121) | [email protected]
Questions about your privacy?
Read our full Privacy Policy or contact our privacy team directly.