Legal / Cookies
Cookie Policy and Register
Last updated: 10 July 2026 — automated production-build scan and codebase review (Claude, development)
1. About this policy
This policy describes the storage and access technologies (cookies, local storage, pixels, scripts and similar) that are actually active on this website. It is maintained against a live register and updated after every material release.
2. What these technologies do
- Strictly necessary: operate security, network delivery, consent choices, forms, sessions and requested functions.
- Functional: remember optional settings or provide enhanced features requested by the user.
- Analytics and performance: measure use and performance, usually requiring consent unless a specific exemption applies.
- Advertising or cross-site tracking: build or use profiles, measure campaigns or personalise advertising; normally requires consent.
- Embedded third-party content: video, maps, scheduling, chat or social content that may store/access data and may require consent before loading.
3. Consent and choices
Current codebase position: no analytics, advertising, tracking scripts or third-party embeds are loaded. Vercel provides the hosting infrastructure. A consent banner is not displayed merely for appearance: if the production scan confirms that the site uses only strictly necessary technologies, no consent banner or cookie-preferences control is required.
Google Analytics is used only with consent. On your first visit the site shows equally prominent “Accept analytics”, “Reject non-essential” and “Manage choices” controls; nothing is loaded from Google until you make an affirmative choice, and no advertising or personalisation storage is used at all. A technology is not “strictly necessary” merely because it is useful to the business.
4. Cookie categories
| Category | Default setting | Legal approach |
|---|---|---|
| Strictly necessary | On only where present | No consent where the strict legal criteria are met; still disclosed accurately |
| Functional | Not currently identified | Not activated without reviewing whether consent is required |
| Analytics and performance | Off by default — Google Analytics loads only after consent | Consent before activation; withdrawal available at any time |
| Marketing / advertising | Not used | No marketing tags are approved |
| Embedded media / third-party features | Not used | No third-party embeds are currently approved |
5. Live cookie and technology register
Codebase review completed 10 July 2026: no analytics, tracking scripts or third-party embeds found.
Last production scan: 10 July 2026 — automated production-build scan and codebase review (Claude, development).
| Technology / status | Provider | Purpose and category | Duration / transfers | Consent position |
|---|---|---|---|---|
| Plausible Analytics — cookieless | Plausible Insights OÜ (EU-hosted) | Aggregate, privacy-friendly measurement. Sets no cookies and uses no local storage or cross-site identifiers, so no consent banner is required for it. | No storage. EU processing. | Exempt — no storage or access on your device. |
| Consent preference cookie (pcs_consent) | Privacy Core / privacycoreservices.com | Stores your consent choice, its timestamp and the policy version. Strictly necessary to remember the choice. | 6 months; first party; no transfer. | Exempt — necessary to honour your choice. |
| Vercel hosting and request processing | Vercel Inc. / site infrastructure | Hosts and delivers the website and processes technical request and security data. Not automatically a browser cookie. | International processing governed by Vercel terms, DPA and transfer provisions. | No cookie consent for hosting itself; the processing is disclosed in the Privacy Notice. |
| Strictly necessary first-party item, if discovered | Privacy Core / Vercel / privacycoreservices.com | Only for a requested function or genuine security purpose. | Name, duration and transfer position to be added after the production scan. | No consent only where the strict legal criteria are met. |
| Google Analytics 4 (_ga, _ga_9B7Q98MV8C) — active with consent | Google (Google Ireland Ltd for EEA/UK traffic) | Website measurement; Analytics category. No form contents or assessment answers are sent. User/event data retention: 14 months. | _ga and _ga_* cookies: up to 2 years; set only after consent; withdrawal expires them where technically possible. Transfers under Google's EU safeguards. | Consent required before any Google request; denied by default. |
6. Changing or withdrawing choices
You can reopen cookie settings at any time using the “Cookie preferences” link in the footer of every page. Withdrawing consent is as easy as giving it: it stops future Analytics processing and expires the related first-party identifiers where technically possible.
7. Browser controls
Browsers can block or delete cookies, but doing so may affect requested website functions. Browser controls do not replace the website’s obligation to obtain consent where required.
8. International transfers and third parties
Vercel may process technical request and hosting data through its global infrastructure and subprocessors under its Data Processing Addendum. Google Analytics runs only after consent; its provider, transfer and retention details must be completed before activation. The Privacy Notice explains the relevant safeguards.