Cookie statement

Part 01

The inventory, in one table

Everything capable of being written to your device by visiting this address, traced from whatever writes it through to whoever can read it afterwards. There is no second table and nothing has been left out for brevity.

Neither of the two entries above is readable by us as an identifier for you, and neither travels anywhere beyond the network that issued it.

Back to contents

Part 02

The rule this answers to

Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 is the operative rule, read alongside the UK GDPR. Putting information onto somebody's device, or reaching into what is already there, requires clear information and their agreement.

The drafting is deliberately indifferent to technology. Local storage, session storage, IndexedDB, a tracking pixel and a fingerprinting script are all caught on the same terms as a cookie, which means a site that avoids the word while doing the thing has avoided nothing.

2.1 The exemption, read narrowly

Agreement is not needed where the storage is strictly necessary to deliver a service the user actually asked for. The Information Commissioner's Office reads that tightly: a load balancing or security mechanism sits inside it, and analytics sits outside it however anonymised the analytics claims to be. The two entries in Part 1 are inside it, which is why you were not interrupted on arrival.

Back to contents

Part 03

Why nothing interrupts you

A consent banner is a mechanism for collecting permission. With nothing here that needs permission, a banner would be a dialogue about an empty set, and putting one up would misrepresent the site to its own readers while training them to click through a control that matters elsewhere.

Should anything outside the exemption ever be added, the sequence is fixed in advance: this page and its effective date change first, the request comes before the thing loads, refusing is exactly as easy as agreeing, and the record of what was agreed keeps the wording and the timestamp.

Back to contents

Part 04

Requests that leave your browser

Nothing is stored on your device by this, so regulation 6 is not engaged, but tracing only the inbound direction would leave half the picture missing.

The typefaces this page names are hosted by Google. Your browser therefore contacts fonts.googleapis.com for the stylesheet, then fonts.gstatic.com for the font files themselves. Those requests carry your address, your browser string and the page that referred you, and they travel from you to Google directly without passing through anything of ours. Google states that the service writes no cookies and that the requests are not used to build advertising profiles.

Serving the files from this domain would remove the hop altogether and is on the list of things to do here. Until it happens the honest move is to describe it rather than omit it. Blocking both hosts in an extension leaves every word on this site readable in whatever font your system falls back to, and costs you nothing else.

Back to contents

Part 05

Absent by design

Each of the following is a normal component of a business website and none of them is present here.

• Any measurement package, hosted or self run, of any brand.
• Advertising, retargeting and the identifiers that make either work.
• Conversion pixels belonging to a social network or an advertising exchange.
• Session replay, heatmapping and scroll depth instrumentation.
• Embedded video, maps, chat widgets and social timelines, each of which imports somebody else's storage along with its content.
• Fingerprinting, and any other attempt to recognise a device between visits.
• Visitor identification services that resolve an address to an employer and drop the result into a sales pipeline. That practice is widespread on engineering supplier sites and worth naming rather than quietly leaving out.

Back to contents

Part 06

Logs sit on our side, not yours

Every web server records what it was asked for. The network in front of this site keeps a line per request holding the address, the time, the path, the browser string and the response code. None of that is device storage, so regulation 6 has nothing to say about it, and an address is still personal data under the UK GDPR, so it belongs in an accurate account of what a visit produces.

Article 6(1)(f) carries it: the interest is keeping the site up and defending it from abuse. The lines live on the provider's own rotation, counted in days, and they are not combined with anything else or exported to us. Record 01 of the privacy notice traces the same flow in full.

Back to contents

Part 07

Verifying all of this yourself

A claim about storage is checkable in a way a promise never is, so here is the check rather than a request to believe us.

1. Open your browser's developer tools on this page, usually with F12 or the equivalent menu item.
2. In the storage or application panel, expand cookies, local storage and session storage for this domain. Compare what is listed against the table in Part 1.
3. In the network panel, reload the page and read the list of hosts contacted. Two font hosts and this domain should be the whole of it.

Anything you find that is not written down above is a defect in this page, and reporting it to the address in Part 11 will get it fixed and acknowledged.

Back to contents

Part 08

Taking control at your end

Every current browser can block storage, delete what is already there and show you what a site has set. Blocking the two entries in Part 1 may mean the network challenges you more often before releasing a page, and the site itself will still work.

• Chrome keeps them in Settings under Privacy and security, across the Third-party cookies and Site data panels.
• Safari keeps them in Settings under Privacy, behind the Manage Website Data button.
• Firefox keeps them in Settings under Privacy and Security, in the Cookies and Site Data block.
• Edge keeps them in Settings under Cookies and site permissions.

Back to contents

Part 09

Preference signals

Global Privacy Control is honoured, as is the older Do Not Track header. Honouring them here is trivially easy, since there is no measurement to switch off and no sale of data to opt out of, and the outcome for a request carrying either signal is identical to the outcome for a request carrying neither.

Saying so is still worth the two sentences. Plenty of sites receive those headers, ignore them, and stay silent about having done so.

Back to contents

Part 10

Cookies inside a client's system

This page describes this website and says nothing about a system built for somebody else. There, the client is the controller and the decisions are theirs.

What we contribute is the trace. Before a client system goes live we set out in writing which of the things it writes to a device fall inside the strictly necessary exemption and which do not, with the reasoning attached to each. Where a non-essential item is being described as essential in a banner, we say so and decline to write it up the other way. That is an engineering position rather than legal advice, and a client who wants the latter should take it from somebody qualified to give it.

Back to contents

Part 11

Changes, questions, complaints

Adding anything that stores information on your device changes this page and its effective date before it goes live, and collects agreement where regulation 6 requires it.

Questions belong at [email protected]. Anything that is a data protection request under the UK GDPR gets the statutory month set out in Part 14 of the privacy notice.

Unsatisfied with the answer, take it to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, or through ico.org.uk. Our agreement is not required and coming to us first is optional.

Back to contents