Cookie policy
Please read this first. This policy is a thorough starting point, not finished legal advice. It should be reviewed by a solicitor or a data protection officer, and checked against the cookies this installation actually sets, before the site goes live. It is an ordinary page in the admin and can be edited like any other.
Last updated: the date this page was last saved in the admin. Replace this line with a fixed date when the policy is signed off.
What cookies are
A cookie is a small text file that a website asks your browser to store and to send back on your next request. It is how a site recognises that two requests came from the same browser, which is what makes staying signed in, or remembering a preference, possible at all.
Similar technologies do the same job by other means. Local storage and session storage keep data in the browser without sending it back automatically. A tracking pixel is a tiny image whose only purpose is that requesting it tells somebody you opened the page. Where this policy says "cookies", it means all of these.
First party and third party
A first party cookie is set by this site and is only ever sent back to this site. A third party cookie is set by somebody else whose code runs on the page, and is sent back to them. Third party cookies are the ones that make cross-site tracking possible, which is why they are treated differently and why none of them is set here until you say so.
What we do, and do not do, without asking
Cookies that are strictly necessary for a service you asked for do not require consent under the Privacy and Electronic Communications Regulations, and we set those without asking. Everything else waits for you.
Waiting means what it says. A script in a category you have not agreed to is written into the page in an inert form that the browser will not execute and will not fetch, so it cannot set a cookie before you decide. It is released only when, and only if, you agree to that category. If you have JavaScript switched off entirely, nothing non-essential ever runs and the site works normally.
The categories we use
Cookies on this site fall into four categories. The banner lets you decide about each of them separately, apart from the first, which cannot be switched off.
Strictly necessary
Needed for the site to work at all: keeping you signed in, remembering what you submitted on a form, protecting forms from abuse, and remembering the cookie choices you have already made. Without these the site cannot do what you asked it to. They are set on the basis of Regulation 6(4) of the Privacy and Electronic Communications Regulations, which exempts them from the consent requirement, and they are always on.
Functional
Remember choices you have made so the site behaves the way you left it. Refusing them will not stop anything working; it only means the site forgets a preference between visits. Set only with your consent.
Statistics
Help us understand which pages are read, how people move through the site and where they give up, so that we can improve it. The reporting we look at is aggregated. Set only with your consent, and refusing has no effect on anything you can do here.
Marketing
Used to measure the response to our advertising and, where relevant, to show you our advertising on other sites. These are the cookies people usually mean when they talk about being followed around the internet. Set only with your consent, and off unless you turn them on.
An administrator can rename these categories, rewrite these descriptions, or remove any of the last three entirely. If a category is not offered on the banner, no cookie in it is ever set.
The cookies this site sets
This is the full list for a standard installation. Check it against what is actually switched on before the site goes live, and update it whenever a new tag is added on the Privacy and cookies screen in the admin.
| Name | Category | What it is for | How long it lasts | First or third party |
|---|---|---|---|---|
rc_session |
Strictly necessary | Identifies your browsing session so that you stay signed in and so that what you type into a form survives the page reload after a validation error. It holds a random identifier and nothing else. | Until the browser is closed, or two hours of inactivity, whichever comes first | First party |
rc_session (CSRF token) |
Strictly necessary | The token that proves a form submission came from a page we served rather than from another site acting as you. It is held inside the session rather than in a cookie of its own, so no separate cookie is set for it. | As the session above | First party |
rc_consent |
Strictly necessary | Remembers the choices you made on the cookie banner, together with the version of the banner and of this policy that were in force, so that we do not ask you again and so that we honour what you chose. Not marked HttpOnly, because the script that enforces your choice has to read it. | 180 days by default, set by an administrator | First party |
__cf_bm |
Strictly necessary | Set by Cloudflare Turnstile, where the spam check on the public forms is switched on, to tell an automated submission from a person. It reads bot management signals, not your browsing. | 30 minutes | Third party, Cloudflare |
cf_clearance |
Strictly necessary | Set by Cloudflare Turnstile after a challenge is passed, so you are not challenged again on every request. Only present where the spam check is switched on. | Up to 1 year, depending on Cloudflare's configuration | Third party, Cloudflare |
Anything else
No analytics or advertising cookie is set by a standard installation, because no analytics or advertising tag is configured out of the box. If an administrator adds one on the Privacy and cookies screen, it is gated behind the category they assign it to and will not run until a visitor consents. When that happens, this table must be updated to name the cookies that tag sets: an accurate list is part of what makes the consent informed.
Changing or withdrawing your consent
You can change your mind at any time, and it is deliberately no harder than agreeing was in the first place.
The button above reopens the banner with your current choices already filled in. Turn a category off and save, and the site stops setting cookies in that category from that moment. Choosing to reject everything non-essential withdraws your consent completely.
The same control is available from every page on the site, as the small tab in the bottom corner, so you never have to come back here to find it.
What happens when you withdraw
We record the withdrawal in the same way we recorded the original consent, so that our records show both what you agreed to and when you took it back. Scripts in the category you have refused stop running from that point; ones that already ran on a previous page cannot be un-run, which is exactly why nothing runs before you have answered in the first place.
Withdrawing consent does not delete cookies already stored by your browser. Your browser controls those, and the next section explains how to clear them.
When we will ask you again
We ask again when the answer you gave no longer covers what we are doing: when we add a new purpose, when we change what a category is used for, or when this policy changes materially. Technically that is done by raising the banner or policy version, which retires every answer given against the old one. We also ask again once your stored answer expires, which by default is after 180 days.
Managing cookies in your browser
Your browser gives you control over cookies independently of anything this site offers, and that control is the final word. You can see what is stored, delete individual cookies, delete everything, block third party cookies, or block cookies entirely.
- Google Chrome: Settings, then Privacy and security, then Third-party cookies and Delete browsing data.
- Mozilla Firefox: Settings, then Privacy & Security, then Cookies and Site Data.
- Safari on macOS: Safari, then Settings, then Privacy, then Manage Website Data.
- Safari on iOS: Settings, then Apps, then Safari, then Clear History and Website Data.
- Microsoft Edge: Settings, then Cookies and site permissions, then Manage and delete cookies and site data.
Two things are worth knowing before you block everything. Blocking strictly necessary cookies will stop you signing in and will stop forms working, because those cookies are how the site knows one request is connected to the next. And clearing your cookies removes our record of your consent choices along with everything else, so the banner will ask you again the next time you visit; that is the system working, not a failure of it.
Do Not Track and Global Privacy Control
Some browsers can send a Do Not Track or Global Privacy Control signal on every request. Where an administrator has switched the option on, this site treats that signal as a refusal of everything non-essential and does not interrupt you with the banner, because you have already answered. The reopen control is still there if you want to change your mind on this particular site.
More about cookies generally
The Information Commissioner's Office publishes plain guidance on cookies and online tracking at ico.org.uk. How we use the data these cookies produce is covered in our privacy policy.