1. What cookies are
Cookies and similar technologies may store information on a browser or device. The site owner must inventory actual cookies, local storage, pixels, SDKs and other access technologies before publication.
COOKIES & DEVICE STORAGE
Cookie Policy
This policy describes cookie and similar-technology governance. The final inventory must be verified against the deployed site and its third-party requests.
2. Current implementation
This static build uses browser JavaScript and a local preference for the cookie banner. It should not load non-essential analytics or advertising tags without an appropriate disclosed choice.
3. Strictly necessary storage
Storage strictly needed for a service the user expressly requests may be treated differently under applicable law. Convenience or business analytics is not automatically essential.
4. Consent before non-essential cookies
Where required, do not activate analytics, advertising or other non-essential technologies before valid consent. The banner alone is not sufficient if scripts already fire.
5. Accept and reject choices
Where consent is required, offer clear accept and reject options with comparable prominence. Do not make rejection unreasonably harder than acceptance.
6. Granular preferences
Where relevant, let users choose categories such as analytics, personalization and advertising separately rather than requiring an all-or-nothing choice.
7. No pre-ticked choices
Do not use pre-ticked boxes, implied consent or continued browsing as consent where an affirmative action is required.
8. Purpose explanations
Explain each cookie category in plain language, including what it does, why it is used and whether it is first-party or third-party.
9. Cookie inventory
List actual cookie or technology names, providers, purposes, categories, durations and data recipients. Do not publish guessed vendor names or durations.
10. Lifespan and review
Use the shortest reasonable duration and review the inventory when vendors, site code or regulatory guidance changes.
11. Third-party tags
Audit embedded maps, videos, fonts, chat widgets, payment buttons, social plug-ins and analytics tags for storage and data transmission.
12. Google Fonts and external assets
External fonts and assets may disclose technical data such as IP address to their provider. Self-host assets where practical and disclose any external requests that remain.
13. Analytics
If analytics is added, document the provider, collected events, IP handling, retention, international transfers and consent requirements before activation.
14. Advertising and retargeting
Advertising pixels and cross-site tracking must remain disabled until the necessary consent and opt-out mechanisms are implemented.
15. Payment provider technologies
A payment provider may set its own cookies or device storage on its checkout domain. Provide appropriate notice and link to the provider’s current policy.
16. Preference storage
A cookie banner may store a minimal choice so the same question is not shown on every page. Record the choice and policy version only as needed.
17. Withdrawal
Users must be able to change or withdraw non-essential cookie consent later through an accessible settings link.
18. Consent records
Where required, record the time, banner version and selected categories, without creating excessive tracking.
19. Banner timing
The banner should appear before any non-essential technology runs, not after tracking has already occurred.
20. Accessibility
The consent interface should be keyboard accessible, screen-reader understandable, readable on mobile and operable without a mouse.
21. Equal prominence
Accept and reject options should be presented fairly, without deceptive colors, confusing wording or manipulative layout.
22. Necessary category default
Only technologies genuinely necessary for the requested service may be enabled by default where local law allows.
23. Analytics category default
Analytics should remain off by default in regions requiring opt-in consent, unless a documented legal exemption applies.
24. Marketing category default
Advertising and marketing trackers should remain off until valid consent where required.
25. Cross-border rules
Cookie and device-access requirements differ by country. Apply region-specific behavior where the service targets or monitors people in those jurisdictions.
26. UK and EU users
Assess applicable ePrivacy, PECR, GDPR and local rules. Consent for non-essential device storage is commonly required; exemptions must be assessed narrowly.
27. India users
Assess applicable Indian privacy and information technology requirements and the phased commencement of relevant provisions; do not assume cookie consent alone satisfies all privacy duties.
28. US state privacy rules
Assess whether applicable state laws require opt-out signals, sale/sharing controls, disclosures or other mechanisms for tracking technologies.
29. Global Privacy Control
If applicable law requires recognition of Global Privacy Control or another opt-out signal, implement and test it for the relevant data uses.
30. Do Not Track
Browser Do Not Track signals are not universally standardized as a legal opt-out. State clearly what the site actually honors and comply with binding requirements.
31. Device fingerprinting
Do not use fingerprinting or similar identification to bypass cookie choices or reconstruct a user’s identity without a lawful basis and required disclosures.
32. Session storage
Review session storage and similar APIs because cookie laws can cover technologies other than traditional cookies.
33. Local storage
Local storage may be used for a preference only as described. It must not be used to store client documents, sensitive data or hidden tracking identifiers.
34. Clearing browser data
Explain that clearing browser storage may reset preferences, and users may be asked to make a new choice where permitted.
35. Shared devices
On shared devices, avoid displaying personal service details in a cookie preference interface and consider whether the choice should be refreshed periodically.
36. Vendor contracts
Use appropriate agreements and configuration with analytics, advertising and other vendors, including instructions on retention, security and use of data.
37. No sale or sharing claim
Do not claim that the site never sells or shares data until actual vendor and tracking behavior has been assessed under relevant legal definitions.
38. Security
Protect consent records and preference data from unauthorized access or alteration.
39. Change in technology
When a new tag, analytics tool, marketing pixel or embedded service is added, reassess the inventory, disclosures, consent and scripts before release.
40. Policy changes
Update the policy and, where required, seek fresh consent when purposes or cookie use materially changes.
41. Retention of choices
Keep preference records only as long as needed to respect the user’s choice and demonstrate compliance.
42. Testing
Test the banner in a clean browser profile, after accept, after reject, after preference changes, and across mobile and desktop layouts.
43. No dark patterns
Do not hide rejection, repeatedly pressure users, or make essential content conditional on unrelated tracking consent.
44. Consent does not authorize everything
Cookie consent does not automatically authorize unrelated processing of personal data; the privacy notice and lawful basis must also be addressed.
45. Third-party policy links
Link to relevant provider notices where helpful, but the site owner remains responsible for its own disclosures and configuration.
46. Contact route
Provide a contact route for questions about cookies and device storage, linked to the general privacy request process.
47. Policy ownership
Assign a person to review the cookie inventory and consent configuration at regular intervals and whenever site code changes.
48. Implementation warning
A banner is a user interface, not a complete consent-management platform. If analytics or advertising is later added, technical blocking and region-specific consent management must be implemented.
49. Final verification
Before launch, compare this notice with the actual deployed site, browser network requests, third-party scripts and hosting configuration; remove statements that are not true.
50. No sensitive client records in preferences
Cookie preference storage is not a document vault. Never store client names, instructions, document contents, account numbers or other sensitive information in browser local storage.
Questions or requests should be sent through the website's Contact page. Do not send sensitive identity, financial, health, privileged or confidential records until the approved secure submission channel and handling arrangements are confirmed.