1. Scope
This Policy covers cookies, local storage, SDKs, pixels and similar technologies. It must be updated from a production cookie scan; never publish invented cookie names.
2. Categories
| Category | Purpose | Consent |
|---|---|---|
| Strictly necessary | Login, security, load balancing, fraud prevention, preferences and consent records. | Usually exempt, but disclosure is required. |
| Functional | Enhanced preferences and embedded functions. | Consent where not strictly necessary. |
| Analytics | Usage, performance and error analysis. | Prior consent where required. |
| Advertising | Campaign measurement or cross-service profiling. | Prior consent; avoid unless commercially necessary. |
3. Production cookie register
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| [COOKIE NAME] | [PROVIDER] | [EXACT PURPOSE] | [CATEGORY] | [DURATION] |
4. Consent design
- Block non-essential technologies before consent where required.
- Make Accept and Reject equally prominent.
- No pre-ticked boxes or deceptive design.
- Provide granular choices and easy withdrawal.
- Record timestamp, version, categories and region.
- Re-consent after material vendor or purpose changes.
5. Preference management
Provide a persistent “Cookie Settings” footer link. Browser controls supplement but do not replace a legally required consent platform.
6. Third parties and transfers
List every third party, link to its notice and review contracts and transfer safeguards. Prevent unapproved tags through tag-management systems.
7. Opt-out signals
State how Do Not Track and Global Privacy Control are handled and recognise valid legal opt-out signals where required.
8. Contact
Questions: [INSERT PRIVACY CONTACT / DPO EMAIL].