Cookie Policy

Cookies are small text files that websites store on your device when you visit them. Their main purpose is to allow the server to recognise the visitor across sessions, enabling smoother navigation.

When cookies allow a person to be identified, they are considered personal data and are subject to GDPR. Consent must be explicit, prior and unambiguous, and may be withdrawn at any time.

Strictly necessary cookies

These are essential for the basic operation of the site. They do not require consent. They include the cookie that stores your consent preference (cookie_consent_v2), stored locally in your browser, with no fixed expiry and not transmitted to any server.

Measurement cookies (with consent)

Measurement and advertising are two separate purposes and are consented to independently: you may accept one and refuse the other. Until you choose, no third-party script is loaded and no connection is made to their servers.

Google Analytics 4

Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), acting as data processor. It tells us which pages are visited, from which device and browser, and how visitors reach the site.

Cookies set: _ga and _ga_<ID>, both lasting 2 years. They store a pseudonymous identifier that distinguishes visits without identifying the person.

If you accept measurement but refuse advertising, we disable Google Signals and ad personalisation, so this data is not used to build advertising profiles or for cross-device tracking. Google does not store full IP addresses in reports: it uses them to derive an approximate location and then discards them.

Data is retained for the period configured on the property (2 months by default, extendable to 14). Google LLC may process data in the United States under the EU–US Data Privacy Framework and standard contractual clauses.

More information: policies.google.com/privacy

Vercel Analytics

Provider: Vercel, Inc. Measures traffic in an aggregated, anonymised way, without persistent cookies or cross-site tracking, and does not link data to individual profiles.

Advertising cookies (with consent)

These are only set if you expressly accept the 'Advertising' purpose. If you refuse it, no advertising tag is loaded and we switch on advertising-identifier redaction (ads_data_redaction) for any request that still occurs.

Google Ads

Provider: Google Ireland Limited. It lets us know whether an advert we paid for ended in an enquiry or a security assessment, and show our adverts to people who have already visited the site.

Cookies set: _gcl_au, lasting 90 days, to attribute a conversion to the advert that produced it.

When you submit a form and have accepted this purpose, your email address may be sent to Google as a cryptographic hash (SHA-256) computed in your own browser, for the sole purpose of attributing the conversion. Google never receives the address in the clear.

We also store the ad click identifier (gclid) in your browser's local storage for 90 days, so that a conversion happening away from the website can later be attributed. It is our own first-party record: it is not shared with other sites.

We do not sell personal data, nor pass it to third parties for their own advertising purposes. What reaches Google is processed solely to measure and optimise our own campaigns.

You can change your preferences at any time by clicking 'Manage cookies' in the footer, accepting or withdrawing each purpose separately. Withdrawing measurement stops collection and deletes the analytics cookies already set; withdrawing advertising stops conversion data being sent and switches personalisation off.

You can also delete or block cookies from your browser settings. Note that blocking all cookies may affect site functionality.