Cookie Notice

This Notice covers cookies, local storage, session identifiers, server logs, measurement, and security technologies used on the Website, portals, forms, dashboards, and external content. The final version will list only tools actually in use.

A small text file stored through a browser on a computer or telephone to remember a session, device, or choice. It does not necessarily contain a name but may link with other information when a user signs in or submits a form.

• Local and session storage.
• Pixels and web beacons.
• Device and session identifiers.
• Security tokens and server logs.
• Measurement links and consent tools.
• Bot protection and login identifiers.

First-party technologies are placed by the Center domain for pages, language, sessions, and security. External providers may place technologies for analytics, video, maps, meetings, forms, protection, or subscriptions. Nonessential services should not activate before the required choice.

These support operation and a requested service, including secure connections, navigation, form submission, anti-forgery, bot prevention, login, and preference storage. The service may not work without them.

• Session identifier.
• Language.
• Login state.
• Security token.
• Privacy choice.
• Session expiry.

These remember nonessential choices such as language across visits, display, search filters, dashboards, date format, or accessibility settings. Rejection may remove preferences without blocking core content.

These may measure visits, pages, duration, paths, devices, referral, form completion, errors, speed, and downloads. Aggregation and minimized identification are preferred, and advertising and unnecessary features should be disabled.

These are not necessary for the Center’s core services. Future introduction requires updated notice, provider and purpose details, duration, sharing, choice, and rejection. They should not support undisclosed political targeting.

Video, posts, sharing buttons, maps, or forms may allow a platform to set cookies. Content may load only after user action, or use static previews and external links to reduce tracking.

Session cookies usually end on browser close, session expiry, or logout. Persistent cookies remain until expiry, deletion, preference change, or service closure and should not last longer than purpose requires.

After implementation an accurate register should be published; hypothetical names must not be presented as active.

• Accept optional categories.
• Reject all nonessential categories.
• Select categories.
• Read detail.
• Save and later change choices.
• Provide equally clear Arabic and English accept and reject controls.

Where required, consent is freely given, clear, specific, affirmative, withdrawable, and separate from unrelated terms. Continued browsing alone is not sufficient where an explicit choice is required.

A necessary record may store accepted and rejected categories, date, notice version, and region. A renewed choice may be requested when categories, providers, purposes, or retention change.

A persistent Manage Cookie Preferences link should appear in the footer and policies. Updated choices stop new optional cookies; existing cookies may also require browser deletion.

Rejecting nonessential cookies should not block public pages, policies, research, contact, complaints, or privacy forms. It may affect remembered language, display, embedded media, dashboard preferences, or performance measurement.

Browsers can view, delete, block, or clear cookies and restrict third parties or storage. Complete blocking may affect login, forms, language, security, and dashboards.

Browsers may send Do Not Track or Global Privacy Control. The Website should not claim support until implementation, testing, and legal treatment are confirmed.

• Aggregate information.
• Minimized network addresses.
• Disabled advertising identifiers and provider sharing.
• Shorter retention.
• No advertising-account linkage.
• More controlled hosting.
• Respect for rejection.

Addresses may appear in security, analytics, and bot-protection logs for error diagnosis, attack prevention, general location, and session management. They are not used for undisclosed political or commercial targeting.

A protection service may assess interaction timing, device, network, tokens, or challenges. Selection should consider data collection, accessibility, Arabic support, processing location, and alternatives.

Dashboards may use sessions, local storage, filters, security tokens, and downloads. Accounts require session verification, permissions, and timeouts. Deletion may sign the user out or remove settings.

Subscription services may confirm registration, record consent, manage unsubscribe, and measure opens or clicks. Actual measurement and choices should be disclosed.

Cookie identifiers may be personal information depending on linkability and law. Necessary technologies may rely on service delivery, security, or contract; nonessential technologies may require consent. Final wording depends on jurisdiction and tools.

Provider and server location, subprocessors, contract, encryption, deletion, retention, and rights are assessed and actual details added after selection.

The general Website should not use marketing cookies to track children. The Center does not sell cookie-derived information to advertisers or data brokers.

• Do not make acceptance much easier than rejection.
• Do not hide reject or use misleading colors or text.
• Do not block core content unnecessarily.
• Do not repeatedly pressure after rejection.
• Do not describe marketing as necessary.
• Do not condition complaints or privacy on tracking consent.

1. Inventory every technology.
2. Classify and remove unnecessary items.
3. Identify purpose, provider, and duration.
4. Block optional cookies before choice.
5. Test acceptance, rejection, and changes.
6. Test mobile, Arabic, and English.
7. Publish and review the register.
8. Confirm forms work without optional cookies.
9. Remove obsolete cookies.
10. Document latest testing.

Undocumented cookies, difficulty rejecting, continued tracking, or panel problems may be reported to [Privacy email]. The Notice changes when tools, providers, services, retention, law, or audit findings change.

Session cookies

Normally end when the browser closes, the session expires, or the user logs out.

Persistent cookies

Remain until a defined date, deletion, preference change, or service termination.

Local storage

May retain language, settings, or dashboard state in the browser until cleared by the user or application.

Security tokens

May verify a session or prevent forged requests and are not ordinarily used for marketing.

A video, map, or social platform may set cookies when embedded content loads and may connect the visit with a user account. A static preview and user-initiated loading are preferred, with an external link or alternative where possible.

An analytical or marketing tool should not send a request or place an identifier before user choice where consent is required. Network and storage behavior must be tested rather than relying only on a banner displaying a “reject” button.

Withdrawal stops new optional storage. A consent tool may delete cookies it controls, while others may require browser or provider controls. The interface should not imply that stopping future storage automatically removes every prior record.

Support for Do Not Track or Global Privacy Control should not be claimed before implementation is tested. Once supported, the Website explains which signals are honored and their effect on categories and prior data.

Network addresses may appear in hosting, security, and analytical records and support attack prevention, diagnosis, and general regional estimation. They should not create undisclosed political or commercial profiles or precise location without necessity and notice.

• Select a provider minimizing data and supporting screen readers.
• Provide an alternative where a challenge fails.
• Review Arabic support and processing location.
• Do not enable marketing tracking under the pretext of form protection.
• Identify the provider in the cookie register and notice.

A dashboard or account may need storage for filters, sessions, permissions, and downloads. Necessity is classified, the system explains what remains locally or is sent to a provider, and deleting session cookies will ordinarily sign the user out.

Where newsletters use pixels or links to measure opens or clicks, this is disclosed with available choices. Nonessential measurement may be disabled or aggregated and is not enabled merely because the mailing provider offers it.

1. Open the Website in a clean browser.
2. Reject optional categories before interaction.
3. Inspect cookies, storage, and network requests.
4. Accept one category and test it alone.
5. Change preference and withdraw consent.
6. Test forms and accounts without optional cookies.
7. Test Arabic, English, mobile, and keyboard use.
8. Reconcile the published register with actual behavior.

The register is reviewed when a tool, provider, dashboard, video, newsletter, or account is added; duration or purpose changes; an undocumented cookie is found; or an incident occurs. The date of the latest technical scan should be recorded.