Cookie Policy
This policy explains the cookies, browser storage, scripts and similar technologies used on the public AO Group website at weareao.group, what each one does, how long it lasts, and how you can accept, reject, change or withdraw your consent.
- Responsible party
- AO Group Holdings (Pty) Ltd
- Owner
- Information Officer — Pieter Hendrik du Toit
- Version
- 1.0
- Effective date
- 22 September 2026
- Review date
- 22 September 2027. This document is reviewed on or before the review date, or earlier if there is a material change to the website's tracking technologies, service providers, processing purposes or the applicable legal requirements.
What these technologies are
A cookie is a small text file that a website asks your browser to store. Browser storage (localStorage and sessionStorage) does the same job in a different place. Scripts are small programs that run in your browser and can request content or send measurement information to a provider.
Essential storage is what the website needs to function: keeping you on a consistent version of the site, protecting it against automated abuse, and remembering the cookie choice you make so you are not asked on every page.
Optional analytics, advertising and third-party content are not needed to use the website. They are switched off until you accept them, and the lawful basis for using them is your consent. None of them is strictly necessary.
Rejecting optional cookies does not restrict ordinary use of this website. Every page, form and document remains available.
Who is responsible
- “AO Group” is a collective brand used by a number of affiliated legal entities operating in different countries.
- AO Group Holdings (Pty) Ltd controls the public group website at weareao.group and its general website analytics, consent management and website enquiry handling.
- An enquiry submitted through this website may be referred internally to the AO entity best placed to respond to it.
- Where you enter into a contract, an employment relationship, a supplier relationship or another direct interaction with an AO subsidiary, that subsidiary may be the responsible party or controller for that specific processing.
- The relevant entity is identified in the applicable contract, proposal, invoice, application, employment document, collection notice or correspondence.
Questions about this policy can be sent to Pieter Hendrik du Toit, Information Officer, at info@aogroup.co.za.
How consent works
Accepting, rejecting, changing and withdrawing your choice.
- Optional cookies and similar technologies are switched off until you accept them.
- You can accept, reject or change each optional category at any time in the Privacy Centre.
- Withdrawing consent applies from the moment you withdraw it and does not affect processing that was lawfully carried out before then.
- Your choice is remembered for six months, after which you will be asked again.
- You will also be asked again if a new analytics or advertising provider is introduced, if the purpose changes materially, if additional advertising storage is proposed, or if the consent-policy version changes materially.
The banner shown on your first visit offers, with equal prominence, rejecting all optional cookies, accepting analytics only, accepting all, and managing each category individually. No optional category is preselected. You can reopen the controls at any time in the Privacy Centre or lower down this page.
Analytics — Microsoft Clarity
Optional. Nothing is requested before you accept.
AO uses Microsoft Clarity (project ym82wzqv8l) as an optional website analytics service to understand website interaction — aggregated usage, heatmaps and session recordings — so that AO can improve the usability and performance of the website. The lawful basis is your consent.
Before you accept, and after you reject or withdraw, the Clarity script is not loaded, Clarity collection endpoints are not contacted, no Clarity cookie is set and no cookieless Clarity collection takes place.
AO does not use Clarity for advertising. Clarity advertising storage (ad_Storage) remains denied in every state. Analytics is not connected to named CRM contacts, applicants, portal users or enquiry records, and AO does not send names, email addresses, telephone numbers, enquiry text, credentials or internal customer identifiers to Clarity. Sensitive forms and page areas are explicitly masked and authenticated portal routes are excluded from recording entirely.
Microsoft may process technical and interaction information as a provider in its own right under its applicable contractual and privacy terms, and that processing may take place outside your country.
Advertising — Microsoft Advertising UET
Optional. Nothing is requested from Microsoft Advertising before you accept.
AO uses Microsoft Advertising Universal Event Tracking (tag 97270707) to measure the performance of its advertising. Advertising storage is denied by default.
The UET tag is not loaded and no request is made to Microsoft's advertising or measurement servers until you accept the Marketing/Advertising category. Before a choice is made, and for anyone who rejects, no advertising script runs, no advertising cookie is created and no cookieless advertising measurement takes place. This was verified against the live website on 2026-09-22.
Full advertising measurement, campaign attribution and remarketing storage are enabled only after you accept the Marketing/Advertising category. Microsoft may then receive device, browser, page, referrer, advertising-click and conversion-event information. A conversion is recorded only when the AO server confirms that an enquiry has been accepted; page views, button clicks, validation errors and failed submissions are never counted as conversions.
You can withdraw Marketing/Advertising consent at any time. Withdrawal returns advertising storage to denied immediately and removes the first-party UET cookies that are accessible to this website, so no further identifiable advertising measurement takes place from your browser. The tag is not loaded again on later visits unless you accept the category again.
Microsoft is an external advertising-technology provider and recipient in its own right, and international processing may take place subject to the safeguards applicable to such transfers.
Third-party content
Optional. Nothing is requested from another provider before you accept.
Some pages can display content hosted by other organisations, such as AO's independently verified Clutch award badges. Until you accept this category, AO shows a locally hosted placeholder and a plain link and makes no request to the provider. When the content loads, your IP address, browser information and referring page are transmitted to the provider, which may set its own cookies under its own domain and privacy policy.
Cookie and storage register
Verified against the live production website on 22 September 2026.
Necessary
Always active. These items are required for the website to work securely and to remember the cookie choice you make. They are not used for analytics or advertising.
| Name | Provider | Domain | Purpose | Data involved | Party | Storage type | Duration | Default state | Consent required | Control and deletion |
|---|---|---|---|---|---|---|---|---|---|---|
| ao-cookie-consent | AO Group Holdings (Pty) Ltd | weareao.group | Records your cookie choices so the website does not ask again on every page, and so optional technologies stay switched off unless you accepted them. | Your analytics, marketing/advertising and third-party-content choices, the date and time of the decision, the consent-policy version, the expiry date and whether the decision was made on the banner or in the Privacy Centre. No name, email address or identifier is stored. | First-party | localStorage | 6 months (the record is ignored and you are asked again after that) | Written only once you make a choice | None — strictly necessary to honour your choice | Change or withdraw in the Privacy Centre; use “Ask me again” to delete it, or clear site data in your browser. |
| __cf_bm | Cloudflare (network and bot-management layer used by AO's hosting) | .weareao.group | Distinguishes human visitors from automated traffic, protecting the website against abuse. | Request and browser characteristics used for bot detection. | Third-party | Cookie | 30 minutes | Set on the first request — essential security | None — strictly necessary for security | Managed by the delivery network; can be cleared in your browser. |
| __dpl | AO website hosting platform | weareao.group | Keeps a visit on a single consistent deployment of the website so pages and assets match. | A deployment identifier. No personal information. | First-party | Cookie | 1 day | Set on the first request — essential operation | None — strictly necessary for correct delivery | Clear site data in your browser. |
| session-id | AO website hosting platform | weareao.group | Short-lived request/session identifier used by the hosting platform for routing and abuse protection. | An opaque short-lived identifier. Not used for analytics or advertising. | First-party | Cookie | 30 minutes | Set on the first request — essential operation | None — strictly necessary | Clear site data in your browser. |
Analytics
Optional and denied until you accept the Analytics category. Nothing in this table is requested, set or transmitted before you accept.
| Name | Provider | Domain | Purpose | Data involved | Party | Storage type | Duration | Default state | Consent required | Control and deletion |
|---|---|---|---|---|---|---|---|---|---|---|
| _clck | Microsoft Clarity (Microsoft Corporation) — AO project ym82wzqv8l | .weareao.group | Persists a Clarity user identifier for the website so repeat visits can be counted as the same browser. | A randomly generated Clarity user identifier. No name or contact details. | First-party | Cookie | 1 year | Not set — Clarity is not loaded at all before analytics consent | Analytics | Withdraw analytics consent: the cookie is cleared and Clarity stops loading. |
| _clsk | Microsoft Clarity (Microsoft Corporation) | .weareao.group | Groups the page views of a single session into one Clarity recording. | A randomly generated session identifier and timestamp. | First-party | Cookie | 1 day | Not set before analytics consent | Analytics | Withdraw analytics consent: the cookie is cleared and Clarity stops loading. |
| MUID | Microsoft Corporation | .clarity.ms and .bing.com | A Microsoft-wide browser identifier set when Clarity synchronises with Microsoft's own domains. | A randomly generated Microsoft browser identifier. | Third-party | Cookie | 390 days (about 13 months) | Not set before analytics consent | Analytics | Set on Microsoft domains, so AO cannot delete it from its own pages. Clear it in your browser, or use Microsoft's own privacy controls. |
| MR | Microsoft Corporation | .c.clarity.ms and .c.bing.com | Indicates to Microsoft whether its identifier should be refreshed. | A short technical flag. | Third-party | Cookie | 7 days | Not set before analytics consent | Analytics | Set on Microsoft domains; clear it in your browser. |
| SRM_B | Microsoft Corporation | .c.bing.com | Microsoft browser identifier used during the Clarity/Bing synchronisation call. | A randomly generated Microsoft identifier. | Third-party | Cookie | 390 days (about 13 months) | Not set before analytics consent | Analytics | Set on a Microsoft domain; clear it in your browser. |
| ANONCHK | Microsoft Corporation | .c.clarity.ms | Microsoft technical cookie indicating whether the identifier may be used for analytics measurement. | A short technical flag. | Third-party | Cookie | 10 minutes | Not set before analytics consent | Analytics | Set on a Microsoft domain; clear it in your browser. |
| SM | Microsoft Corporation | .c.clarity.ms | Used by Microsoft to synchronise its identifier across Microsoft domains. | A short technical value. | Third-party | Cookie | Session (deleted when the browser closes) | Not set before analytics consent | Analytics | Set on a Microsoft domain; clear it in your browser. |
| CLIDPossible, not observed | Microsoft Clarity (Microsoft Corporation) | www.clarity.ms | Documented by Microsoft as identifying the first time Clarity saw this browser on any site using Clarity. | A randomly generated Clarity identifier. | Third-party | Cookie | 1 year (per Microsoft's documentation) | Not set before analytics consent | Analytics | Set on a Microsoft domain; clear it in your browser.Documented by Microsoft but not observed in AO's configuration during the 22 September 2026 audit. Listed for completeness because Microsoft may set it. |
Marketing/Advertising
Optional and denied until you accept the Marketing/Advertising category. No advertising cookie or persistent advertising identifier in this table is created before you accept.
| Name | Provider | Domain | Purpose | Data involved | Party | Storage type | Duration | Default state | Consent required | Control and deletion |
|---|---|---|---|---|---|---|---|---|---|---|
| _uetsid | Microsoft Advertising (Microsoft Corporation) — AO UET tag 97270707 | .weareao.group | Identifies a single advertising-measurement session so conversions can be attributed to a campaign. | A randomly generated session identifier. | First-party | Cookie | 1 day | Denied — not written before marketing consent | Marketing/Advertising | Withdraw marketing consent: advertising storage returns to denied and this cookie is deleted. |
| _uetvid | Microsoft Advertising (Microsoft Corporation) | .weareao.group | Recognises a returning browser for advertising measurement and remarketing audiences. | A randomly generated visitor identifier. | First-party | Cookie | 390 days (about 13 months) | Denied — not written before marketing consent | Marketing/Advertising | Withdraw marketing consent: advertising storage returns to denied and this cookie is deleted. |
| _uetsid, _uetsid_exp, _uetvid, _uetvid_exp | Microsoft Advertising (Microsoft Corporation) | weareao.group | Microsoft's tag mirrors the two advertising identifiers and their expiry times in browser storage as well as in cookies. | The same two randomly generated identifiers, plus their expiry timestamps. | First-party | localStorage | Mirrors the cookies: session identifier 1 day, visitor identifier about 13 months | Denied — not written before marketing consent | Marketing/Advertising | Withdraw marketing consent: advertising storage returns to denied and these keys are removed. |
| _uetmsclkidPossible, not observed | Microsoft Advertising (Microsoft Corporation) | .weareao.group | Stores the Microsoft advertising click identifier when a visitor arrives from a Microsoft ad, so a later conversion can be attributed to that click. | The Microsoft click identifier (msclkid) from the advertisement URL. | First-party | Cookie | 90 days (per Microsoft's documentation) | Denied — not written before marketing consent | Marketing/Advertising | Withdraw marketing consent: advertising storage returns to denied and this cookie is deleted.Not observed during the audit because it is created only when a visitor arrives through a Microsoft advertisement carrying a click identifier, with marketing consent granted. |
Third-party content
Optional and denied until you accept the Third-party content category. No request is made to the provider before you accept.
| Name | Provider | Domain | Purpose | Data involved | Party | Storage type | Duration | Default state | Consent required | Control and deletion |
|---|---|---|---|---|---|---|---|---|---|---|
| Clutch embedded content (cookies and storage set by clutch.co) | Clutch (Clutch.co) | clutch.co and static.clutch.co | Displays AO's independently verified Clutch award badges. Nothing is requested from Clutch until this category is granted; until then AO shows a locally hosted placeholder and a plain link. | When the embed loads, your IP address, browser information and referring page are transmitted to Clutch, which may set its own cookies or storage under its own domain and privacy policy. | Third-party | Cookie | Determined by Clutch under its own privacy policy; AO cannot read or delete storage on Clutch's domain. | Denied — no Clutch request is made at all | Third-party content | Withdraw in the Privacy Centre: the embed is replaced by the placeholder again and no further Clutch request is made. Existing Clutch cookies must be cleared in your browser. |
Not used on this website
- Google Analytics / Google Tag Manager: Not installed on this website. No Google measurement script, container or advertising tag was requested in any consent state during the audit on 22 September 2026.
- Advertising cookies from networks other than Microsoft: No other advertising, retargeting or social-media pixel is installed on this website.
Manage your preferences
Change any category below. Your choice takes effect immediately, is remembered for six months, and can be changed again at any time. You can also delete cookies and browser storage directly in your browser settings.
Contact and status
To ask a question, request information or lodge a complaint about cookies and website privacy, contact Pieter Hendrik du Toit, Information Officer, at info@aogroup.co.za.
This document is designed to support alignment with POPIA, the GDPR (where it applies) and applicable cookie-consent requirements. It is not a certification or a guarantee of compliance, and it remains subject to review by AO's Information Officer and legal adviser.