Cookie policy

What cookies are

Cookies are small text files stored by your browser. Similar browser storage can perform related functions. Some are necessary for a requested service or website security; optional cookies require your choice.

Strictly necessary cookies

The website uses a first-party session cookie (its exact name is configured for the deployment), XSRF-TOKEN for cross-site request-forgery protection, and bd_consent to link your browser to the privacy preference recorded by the website. Authentication features may also use short-lived first-party cookies needed to sign in securely, confirm an account or remember an intended page. These cookies do not provide advertising and cannot be disabled through our preference control where they are strictly necessary. Their duration is limited by the application session and consent configuration.

Google Analytics cookies

Google Analytics 4 is not loaded unless you actively accept Analytics. If accepted, Google may set cookies including _ga (commonly retained for up to two years) and a property-specific _ga_<container-id> cookie (commonly retained for up to two years) to distinguish browsers and sessions and produce usage reports. We disable Google signals, advertising storage and personalised advertising in our implementation. Analytics is optional and the website continues to work if you reject it.

External media

The External media preference allows optional third-party content that may make requests or store information on your device. The Website Carbon badge is shown only after this category is accepted; before then, a locally hosted fallback is used. We do not load live social-media feeds. Future external media must be assessed and kept blocked until the required preference is provided.

Services that do not rely on this preference

Submitting the newsletter form sends the information you enter directly to Mailchimp because you requested that service; it does not enable analytics cookies on this website. The external green-hosting verification image may receive ordinary request information such as an IP address and browser headers when displayed, but it is not used by us as an optional analytics cookie.

Form abuse prevention

Google reCAPTCHA v3 is loaded on our enquiry and support forms as a strictly necessary security measure. It processes interaction, IP address, browser and device signals and may use cookies such as _GRECAPTCHA to distinguish genuine submissions from automated abuse. We use the resulting score only to secure form submissions, not for advertising or general website analytics.

Changing or withdrawing your choice

Use the permanent Cookie settings control in the footer to accept, reject or change Analytics and external media independently. Accept and reject controls are equally available. A new preference replaces the categories used on later page loads. You can also delete cookies using your browser settings; deleting bd_consent will cause the website to ask for your choice again.

Policy records and changes

We record the categories chosen, the policy version, time and a one-way IP-derived security hash so we can demonstrate the preference applied. We may ask again when this policy or the services covered by it change. Cookie names and lifetimes can also change when browsers or service providers update their technology.