Last updated: August 24, 2026
For users in Singapore, the Personal Data Protection Act 2012 (PDPA) and the guidelines and obligations of the Personal Data Protection Commission (PDPC) apply in particular to cookies and similar technologies. Singapore does not have a separate, cookie-specific regulation identical to the EU ePrivacy Directive. However, cookies and similar technologies are subject to data protection laws if they collect, use, or disclose personal data as defined by the PDPA, particularly when online identifiers, device information, IP addresses, cookie IDs, form submissions, or usage behavior can be associated with an identified or identifiable individual. Under the PDPA, the following obligations must be observed in particular: the notification obligation, the consent obligation, the purpose limitation obligation, the protection obligation, the retention limitation obligation, the transfer limitation obligation, and the accountability obligation. Technically necessary cookies may generally be justified on the grounds of the website’s provision, security, and functionality, provided that transparent information is provided. In contrast, analytics, tracking, marketing, profiling, and third-party technologies should only be used with clear, informed, purpose-specific, and documented consent, unless a valid alternative exception or legal basis is documented.
| Cookie | Publicly Available Privacy Notice | Retention Period | Legal Basis in Singapore |
|---|---|---|---|
| __cfruid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests, prevent misuse, and ensure the website is provided in a stable and secure manner. | Until the end of the session. | PDPA, specifically the notification obligation, purpose limitation obligation, protection obligation, and accountability obligation. Purpose: to ensure the secure, stable, and abuse-free operation of the website. No separate consent is required provided that the use is strictly technically necessary and is described transparently. |
| __cfuvid | This cookie is used by the website hosting provider’s content delivery or security service provider to limit requests and support the secure operation of the website. | Until the end of the session. | PDPA, specifically notification, purpose limitation, protection, and accountability. Purpose: technical security, prevention of misuse, and website availability. |
| __cf_bm | This cookie is used to protect against automated access and bots. It helps detect and prevent abusive or technically harmful access to the website. | 30 minutes | PDPA, specifically the obligations regarding protection and purpose limitation. Purpose: to defend against automated access, prevent fraud and misuse, and protect the website infrastructure. |
| __hs_opt_out | This cookie records that a visitor has declined the use of non-essential cookies or should not be prompted for consent again. It contains the value “yes” or “no.” | 6 months | GDPR, specifically the consent obligation, withdrawal of consent, notification obligation, and accountability obligation. Purpose: To store and implement the cookie preference and to provide evidence of preference management. |
| __hs_do_not_track | This cookie may be set to prevent the tracking code from sending information to HubSpot. It stores the corresponding opt-out or “do not track” decision. | 6 months | PDPA, specifically Withdrawal of Consent, Purpose Limitation, and Accountability. Purpose: Technical implementation of the opt-out from tracking and preservation of user preferences. |
| __hs_initial_opt_in | This cookie prevents the cookie banner from reappearing every time a page is loaded in strict mode. It contains the value “yes” or “no.” | 7 days | GDPR, specifically Notification, Consent, and Accountability. Purpose: user-friendly and transparent management of the cookie prompt. |
| __hs_cookie_cat_pref | This cookie stores which cookie categories the visitor has consented to or declined. It is used to manage cookie preferences. | 6 months | GDPR, specifically the obligations regarding consent, withdrawal of consent, notification, and accountability. Purpose: To store and implement the user’s decision to consent, decline, or set preferences. |
| __hs_gpc_banner_dismiss | This cookie records that a notification regarding the Global Privacy Control has been closed. It contains the value “yes” or “no.” | 180 days | PDPA, specifically Notification and Accountability. Purpose: To manage data protection preferences and prevent repeated notifications. |
| __hs_notify_banner_dismiss | This cookie records that a “Notify” notification banner has been closed. It contains a Boolean value. | 180 days | PDPA, specifically Notification and Accountability. Purpose: User-friendly management of technically necessary notifications. |
| hs_ab_test | This cookie is used to display the same version of an A/B test page to a visitor during a session that was previously assigned to them. | Until the end of the session. | Justifiable without consent only if the A/B testing serves exclusively to ensure the consistent technical delivery of the accessed page version and does not pursue any analysis, reach measurement, optimization, personalization, marketing, or profiling purposes. Legal basis: PDPA, specifically Notification, Purpose Limitation, and Protection. Otherwise, clear and documented consent should be obtained. |
| wg-translations | This local storage entry is used by the translation feature to store translations that have already been loaded or generated in the browser and to display the website in the language selected by the user. | Depending on provider or browser configuration; specified in the document as “stored indefinitely.” Recommendation: technically limit storage to a reasonable duration or transparently explain the option to delete. | PDPA, in particular Notification, Purpose Limitation, Retention Limitation, and Accountability. Purpose: to provide the website in multiple languages in a user-friendly manner. Due to unlimited storage, a retention limitation review is required. |
| wg-slugs | This local storage entry is used by the translation feature to store translated URLs in the browser and provide navigation in the selected language. | Depending on provider or browser configuration; specified in the document as “stored indefinitely.” Recommendation: technically limit storage to a reasonable duration or transparently explain the option to delete. | PDPA, in particular Notification, Purpose Limitation, Retention Limitation, and Accountability. Purpose: Consistent language-based navigation. Due to unlimited storage, it is necessary to assess whether a time limit is appropriate. |
| wglang | This cookie stores the language selected by the user so that the website can be displayed in the preferred language. | Until the end of the session. | PDPA, specifically notification and purpose limitation. Purpose: To provide the language version selected by the user. |
These are non-essential cookies that are managed via the cookie banner. As a visitor to a HubSpot-powered website, you can object to the use of these cookies by not giving your consent.
| Cookie / Storage Entry | Publicly Available Privacy Notice | Retention Period | Legal Basis in Singapore |
|---|---|---|---|
| __hmpl | This storage entry contains metadata on tracking events that HubSpot collects while you use the website. It is used to analyze website usage and is only used if the appropriate consent has been granted. | Session storage or local storage, depending on the consent and tracking configuration. | PDPA, specifically the obligations regarding consent, notification, purpose limitation, protection, retention limitation, transfer limitation, and accountability. Due to analytics and tracking purposes, this cookie should only be used based on clear, informed, purpose-specific, and documented consent. |
| hublytics_events_53 | This storage entry is temporarily used by HubSpot to store tracking events until they are technically transmitted. It serves analytical purposes and is used only if appropriate consent has been granted. | Session storage or local storage, depending on the consent and tracking configuration. | PDPA, specifically Consent, Notification, Purpose Limitation, and Accountability. Due to tracking events, the potential for personal identification, and third-party involvement, clear and documented consent should be obtained prior to use. |
| __hstc | This HubSpot cookie is used to recognize and track visitors across multiple sessions. In particular, it stores the domain, visitor ID, visit times, and session numbers. | 6 months | PDPA. Consent is required or strongly recommended, as the cookie is used for analytics, recognition, and tracking purposes, and online identifiers may constitute personal data. The purposes, providers, data categories, transfers, retention period, and option to withdraw consent must be explained transparently. |
| hubspotutk | This HubSpot cookie is used to recognize a visitor. It may be transmitted to HubSpot when a form is submitted and helps identify and merge duplicate contacts. | 6 months | PDPA. Due to visitor recognition, potential form and CRM mapping, and third-party involvement, clear, informed, and documented consent should be obtained prior to use. Additionally, notification, purpose limitation, protection, retention limitation, and transfer limitation must be observed. |
| __hssc | This HubSpot cookie is used to track sessions and page views within a session. It supports the analysis of user behavior on the website. | 30 minutes | PDPA. Analytical purposes must be explained transparently in advance; in cases involving the analysis of personal data, third-party tracking, or profiling, use should only occur with consent. |
| __hssrc | This HubSpot cookie is set to determine whether a visitor has restarted their browser and whether a new session should be initiated. | Until the end of the session. | PDPA. If this cookie is part of HubSpot analytics tracking, it must be treated as an analytics cookie and should only be used with prior consent. |
| _ga | This Google Analytics 4 cookie is used to distinguish individual users and to compile statistical information about website usage. | By default, 2 years, subject to different browser settings or a different configuration. | PDPA. Due to user differentiation, recognition, third-party integration, potential profiling, and the potential transfer of personal data outside of Singapore, this feature should only be used with clear, informed, and documented consent. The Transfer Limitation Obligation must be observed. |
| _ga_<Container-ID> | This Google Analytics 4 cookie is used to store the session status and to statistically analyze website usage. | By default, 2 years, subject to different browser settings or a different configuration. | PDPA. Due to analysis, session tracking, third-party involvement, and potential cross-border transfers, this cookie should only be used with clear, informed, and documented consent. The retention period, purpose, recipients, right to withdraw consent, and international transfers must be described transparently. |
