Cookie Policy

About this policy

This policy covers information stored on, or accessed from, your device when you use this website. Cookies are small files stored by your browser; related technologies include local storage, tracking pixels and device fingerprinting.

[CHECK: Site owner to supply the legal name of the website operator and a working privacy contact address.]

Where these technologies process personal data, the UK General Data Protection Regulation (UK GDPR) applies alongside the Privacy and Electronic Communications Regulations (PECR). A cookie consent choice does not replace the operator’s wider data protection obligations.

Cookies and technologies used on this website

The site’s cookie inventory is awaiting a live technical audit. No analytics provider, advertising service, affiliate tracker, newsletter tool or embedded-media provider is confirmed by this draft. An incomplete inventory must not be presented as evidence that the website uses no cookies.

[CHECK: Site owner to commission and supply a dated audit covering essential infrastructure, security tools, consent management, analytics, advertising, affiliate links, newsletter forms and email tracking, embedded media, external fonts, plug-ins and other storage or access technologies.]

The published policy must identify every technology actually used, including:

• Its exact cookie name or storage identifier and the domain that sets or accesses it.
• Its provider, purpose and information stored or accessed.
• Whether it is first-party or third-party.
• Its expiry or retention period, including whether it lasts only for a session.
• Whether it requires consent or relies on a specific PECR exception, and how visitors control it.

The audit must test representative pages and interactions in a clean browser before any choice, after rejection, after individual category choices, after acceptance and after withdrawal. It must also inspect relevant site configuration and provider documentation, rather than rely solely on an automated cookie scan.

When consent is required

PECR regulation 6 and Schedule A1 govern storage and access technologies. Schedule A1 was inserted by the Data (Use and Access) Act 2025 and came into force on 5 February 2026.

The relevant distinctions are:

• Communication and strictly necessary technologies: consent is not required where the precise statutory conditions are met. “Strictly necessary” means essential to provide a service you request, not simply useful to the website operator.
• Qualifying statistical technologies: a limited exception can cover statistics collected solely to improve the service. Clear information and a simple, free way to object are required.
• Qualifying appearance or functionality technologies: a limited exception can cover adapting or improving how the service appears or functions. Clear information and a simple, free objection mechanism are required.
• Advertising, affiliate tracking and profiling: storage or access for these purposes requires prior consent where no applicable exception is met.

The statistical exception is not restricted simply by whether a tool is first-party. A third-party provider may assist with qualifying statistics, but cannot reuse the information for its own unrelated purposes. Neither calling a tool “analytics” nor placing it on the website’s own domain establishes an exemption.

[CHECK: Site owner to supply the purpose-by-purpose assessment of the audited technologies. Legal reviewer to approve any reliance on an exception.]

Giving, refusing and changing your choices

Consent must involve an informed, affirmative choice. Continuing to browse, silence or pre-selected optional settings must not be treated as consent.

Required implementation before publication: technologies requiring consent must remain blocked until the visitor agrees to their relevant purposes. This includes preventing associated tags, pixels, embeds and device access from operating prematurely, not merely hiding the consent notice.

The website’s controls must provide an equally prominent way to accept or reject consent-required technologies, with separate choices where appropriate. Visitors must also be able to reopen settings and withdraw consent as easily as they gave it. Any technologies relying on the statistical or appearance exceptions must have a simple, free objection control.

[CHECK: Site owner to supply the actual control names, their permanent location, a working settings mechanism and test results confirming rejection, objection and withdrawal take effect. Replace this implementation note with accurate visitor instructions before publication.]

Managing cookies in your browser

Browsers also provide settings for inspecting, blocking and deleting cookies. Blocking some technologies can affect functions that depend on them.

Browser controls supplement the website’s own controls; they must not be the only way to withdraw consent. Deleting stored preferences may mean your previous choice is no longer available to the website.

[CHECK: Confirm the audited consent mechanism’s behaviour after deletion, across browsers and across devices, and explain any relevant limitations.]

Updates and questions

The proposed review schedule is at least annually, and sooner when providers, technologies, purposes or legal requirements change. Where a new use requires consent, updating this policy alone will not authorise that use.

[CHECK: Before publication, add the approved effective date and verified contact details. Obtain legal approval of this policy, the completed inventory, linked privacy information and the functioning controls.]