Cookie Policy

Last updated: 13 October 2026

This Cookie Policy explains cookies and similar technologies associated with dataprivacyservices.co.uk, what they do, the organisations involved and how you can control them. Read it with our Privacy Policy.

1. Who operates this website

Data Privacy and Data Security Services Limited, trading as Data Privacy Services (DPS), is registered in Cyprus with company number HE 432380.
Registered address: Griva Digeni, 51 Athineon Court, Office 202, 8047, Paphos, Cyprus.
UK operating address: 124 City Road, London, EC1V 2NX, United Kingdom.
Privacy contact: info@dataprivacyservices.co.uk.

2. What cookies and similar technologies are

A cookie is a small item of information stored by a website or service in your browser. Some cookies last only for a session; others remain until their expiry or until you delete them. First-party cookies are associated with the website you visit. Third-party cookies may be associated with an embedded service or another provider.

Similar technologies include local storage, session storage, tracking pixels, tags and techniques that read information from your browser or device. Cookie rules can apply even when a technology is not called a cookie or does not contain a person’s name. Identifiers, IP addresses and information linked to a browser or device may be personal data; we do not assume that all cookie information is anonymous.

3. How to make and change your choices

We use CookieYes to present preferences and record your selection. The controls include Accept All, Reject All and Customise. In the preference panel you can review categories and select Save My Preferences. Reopen the panel using the website’s Consent Preferences button.

Necessary technologies remain available where a legal exception applies. Optional technologies require the relevant choice; refusing them should not prevent ordinary access to information about our services. A third-party feature may be unavailable if the permissions needed for that feature are declined, but you can contact our team directly instead.

You can withdraw or change an optional choice through the same controls. This stops future use dependent on that choice but does not reverse processing already undertaken. Some previously stored third-party cookies may also need to be removed through your browser settings. Clearing cookies or using another browser or device may cause the banner to ask again. Continuing to browse, closing a banner or accepting this policy is not, by itself, consent.

4. Our approach to consent and legal exceptions

We apply PECR where relevant to UK users, applicable Cyprus and EU rules on device storage and access, and data protection law where personal data is involved. A technology is not exempt merely because it is convenient, labelled “necessary” by a provider, or used for website performance.

Strictly necessary storage or access may be permitted without consent where it is essential to provide an online service you request, or another applicable legal exception is satisfied. The purpose and conditions must be assessed for the actual use. Our policy is to obtain consent for optional analytics and advertising rather than assume that a UK statistical exception automatically applies to a commercial analytics or advertising service. A UK exception does not automatically authorise the same activity for EEA users.

Where cookies or related identifiers are personal data, the applicable processing also needs a GDPR lawful basis. Consent is used for optional analytics or advertising where required. Necessary security and service operation may rely on legitimate interests or another appropriate lawful basis. Detailed processing information is in our Privacy Policy.

5. Purposes and categories

• Necessary and security: remembering privacy choices, protecting forms against abuse and providing essential requested functions. These are not used as a general permission for advertising.
• Functional: optional enhancements or third-party features. The current Functional declaration has no cookies listed; this may change when features change.
• Analytics: measuring visits, page usage and interactions to understand and improve the website. The website uses Google Analytics integration through MonsterInsights.
• Performance: optional measurement or feature support. A label does not determine the legal purpose: advertising identifiers remain advertising technologies even if grouped under a performance label.
• Advertising: recognising a browser, measuring advertising outcomes or supporting remarketing, including relevant Microsoft/Bing identifiers.

The preference panel currently uses the labels Necessary, Functional, Analytics, Performance and Advertisement. The purpose descriptions below explain the technologies rather than treating their category label as a guarantee of necessity or anonymity.

6. Cookie and storage inventory

The following inventory reflects the website’s published cookie declaration at the date above. Not every item is set on every visit: some relate to third-party booking or payment features, login use, prior choices or a particular browser. Names may include variable suffixes. Durations are the currently declared browser-storage lifetimes; provider changes and browser limits may affect the actual lifetime.

Name and provider	Purpose and context	Declared duration
cookieyes-consent CookieYes / DPS website	Remembers the selection made in the cookie banner and preference panel.	1 year
elementor Elementor / DPS website	Technical browser storage associated with the WordPress page-building framework. Its actual necessity depends on the feature involved; “persistent” does not mean permission for unrelated tracking.	Persistent; no automatic expiry declared. Can be removed by clearing relevant browser storage.
wpEmojiSettingsSupports WordPress / DPS website	Stores an emoji-display capability check.	Session
_ga and _ga_* Google Analytics / DPS website	Analytics identifiers and measurement of visits or sessions. A pseudonymous identifier is not a guarantee of anonymous processing.	1 year, 1 month and 4 days
_uetsid Microsoft/Bing / DPS website	Advertising-related session identification and measurement. Currently listed in the Performance declaration.	1 day
_uetvid Microsoft/Bing / DPS website	Advertising-related browser identification and measurement across visits. Currently listed in the Performance declaration.	1 year and 24 days
MUID Microsoft/Bing	Browser identification for Microsoft advertising and related measurement.	1 year and 24 days
_calendly_session Calendly	Supports the embedded meeting-booking session where that feature is used.	21 days
OptanonConsent OneTrust / Calendly	Remembers the consent choices associated with the third-party booking service.	1 year
__cf_bm Cloudflare / Calendly	Bot-management protection associated with the third-party service.	1 hour
_cfuvid and __cfruid Cloudflare / Calendly context	Security and rate-management information associated with the third-party service.	Session
m Stripe, m.stripe.com	Provider fraud-prevention or device information where a relevant payment-related feature loads. Its inclusion in the declaration does not mean DPS collects full card details through every website visit.	1 year, 1 month and 4 days

Authorised WordPress administrators may also encounter login, authentication and administration preference cookies. These arise from an administrative login or editing session, rather than ordinary anonymous browsing. The client portal and DPS Compliance Hub are separate services with their own notices and technical settings; following a link does not mean that this website’s consent automatically applies there.

Google Ads measurement for DPO services

Subject to both Analytics and Advertising consent, DPO service pages use Google Ads to attribute successful DPO enquiries and brochure link requests to advertising. Google receives technical advertising and event information. Our conversion event does not include form contact details, messages or AI chat content. Enhanced conversions and advertising personalisation are disabled for this integration. Brochure measurement records selection of the PDF link, not confirmation that it was saved or read.

Name and provider	Purpose and consent category	Typical duration
_gcl_aw — Google Ads / DPS	Stores advertising click information for conversion attribution. Analytics and Advertising consent required.	90 days
_gcl_au — Google Ads / DPS	Supports advertising conversion measurement. Analytics and Advertising consent required.	90 days

These cookies are not necessarily set on every visit; an advertising click and browser settings may affect what is used. The Google Ads measurement tag is loaded only after both Analytics and Advertising are accepted, because the website’s shared Google loader is also gated by Analytics consent. Withdrawing either choice stops further measurement by this integration and reloads the page. Previously stored identifiers can also be removed through browser controls. See Google’s cookie information and our Privacy Policy for provider processing and transfers.

7. Embedded services and third-party processing

Some pages provide a Calendly booking feature. Interacting with an embedded service can send technical information to its provider and involve that provider’s own cookies and privacy choices. Technologies that are essential to complete a booking you request must be distinguished from optional provider analytics or advertising; embedding a service is not a blanket exemption for all of its technologies.

Google and Microsoft identifiers may support analytics or advertising as described above. CookieYes supports preference management. Provider processing may involve countries outside the UK or EEA. Our Privacy Policy explains international transfer requirements and how to request information about relevant safeguards.

When you follow a link to another website, its operator’s privacy and cookie information applies to that site. You can also arrange an appointment or make an enquiry by contacting DPS directly.

8. Cloudflare Turnstile on forms

Our forms use Cloudflare Turnstile to distinguish legitimate use from automated abuse. Verification may complete automatically or ask you to interact. The form integration receives a short-lived verification token and validates it as part of submission.

Turnstile is a security service, not an advertising consent control. It may process technical browser, device and network information even where a traditional cookie is not set. A verification token in a form field is not itself a browser cookie. Any security storage or access must remain limited to the applicable purpose and legal conditions. Read Cloudflare’s Turnstile privacy information for provider details.

9. Ask DPS consent is separate

Cookie consent does not authorise the processing of messages by Ask DPS. The assistant separately requires an unticked processing-consent checkbox and Agree and start before a question can be sent to OpenAI.

The current assistant keeps a limited conversation and consent token in the current webpage’s memory, rather than using an analytics or advertising cookie to store the chat. Its server-side consent grant expires after 24 hours; that is not a 24-hour cookie or a promise that all provider information is deleted after 24 hours. The website application does not save chat transcripts in its database, while OpenAI has separate provider retention arrangements.

Withdraw consent and clear chat revokes the grant and clears the assistant’s local conversation. Clear chat alone does not withdraw consent. The Ask DPS section of our Privacy Policy explains messages, recent context, ICO-source searches, OpenAI retention, international transfers and your choices.

10. Browser controls and deleting storage

Most browsers let you inspect, delete or block cookies and remove local or session storage. Use your browser’s privacy or site-data settings. Blocking all storage can affect essential functions, remembered preferences, administrative login or an embedded service you request. Removing a preference cookie may cause the banner to reappear.

Changing a browser setting does not necessarily remove information already received by a provider or delete every form of browser storage. Use the website preference controls as well as appropriate browser settings, and contact us if you need help understanding a choice.

11. Your data protection rights and complaints

Where information associated with these technologies is personal data, you have the applicable rights described in our Privacy Policy. Our Data Subject Access Request and Individual Rights Policy explains requests. Information held solely by an independent provider may require a request to that provider; we will explain our role where relevant.

For concerns, email info@dataprivacyservices.co.uk or follow our Data Handling Complaints Policy and Process. You may also complain to the ICO, the Cyprus Commissioner for Personal Data Protection, or another competent authority where applicable.

12. Keeping this information current

We review the inventory and policy when providers, features, purposes or applicable requirements change. We update descriptions and durations where needed and obtain renewed consent where a material change requires it. The date at the top identifies the latest revision. Further information on UK rules is available in the ICO’s storage and access technologies guidance.