KIST / LEGAL
Cookie policy
[TBD — date on publication]
1. The short version
No optional cookie is set on this site until you say yes.
Advertising signals are refused permanently, whatever you choose. There is no setting on this site that turns them on.
If you say no, or change your mind later, the analytics cookies are deleted.
2. How the consent works, in order
Before any script runs, the page tells Google’s tag system that storage for analytics and for all three advertising signals is denied, and to wait half a second for a decision. That is the default state, and it applies to a first-time visitor who never interacts with the banner at all.
If you have never made a choice, the banner appears. Nothing loads while it sits there.
If you accept, the analytics tag loads and analytics storage is granted. The three advertising signals stay denied. They are written as denied on every consent update, including the accept path, so an accept is an accept for measurement only.
If you decline, analytics storage stays denied and any cookie whose name begins _ga is expired immediately.
Your choice is remembered in your browser’s local storage under gw-consent-v1, not in a cookie. It never leaves your device and it identifies nobody.
Consent first, then cookies. That is the whole design.
3. What is actually set
Strictly necessary. These are needed for the site to work and do not need consent. Our hosting and network providers may set a small number of security and routing cookies.
[TBD — strictly-necessary cookie list]
This list must be produced from a live page load with a clean browser profile before publication, not from the repository. The repository shows our own code sets none, which is not the same as none being set at the hosting/network layer.
Analytics, only after you accept.
| Cookie | Set by | What it does | Lifetime |
|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes one browser from another so a return visit is not counted as a new person | 2 years (vendor-published) |
_ga_<container> | Google Analytics 4 | Keeps session state for that property | 2 years (vendor-published) |
[TBD — GA4 cookie lifetimes]
The table carries Google’s published defaults. Confirm against the live property’s retention configuration before publication.
Advertising. None. Not conditionally, not after acceptance. The three advertising signals are denied in code on every path.
Session recording. None on this website. Microsoft Clarity appears in Kist as a connector a customer can enable on their own site; it is not running here.
4. Withdrawing consent
Two ways, and both work.
Use the cookie choice control on the site. Declining expires the _ga cookies straight away and tells the tag system that analytics storage is denied.
Or clear cookies and site data in your browser. That removes the stored choice too, so the banner comes back on your next visit and you start from denied.
5. Who sees the analytics data
Google, as the provider of Google Analytics. It is listed in the sub-processors document with its location and transfer safeguard.
We look at page and event totals to work out which pages are doing a job. We do not use this site’s analytics to build a profile of you, and no advertising signal leaves the page.
6. Do Not Track and Global Privacy Control
Our default is denied for everyone, which is the same outcome a Do Not Track signal asks for. So the position is: we do not read those signals, because we already behave as though every visitor sent one until they tell us otherwise.
7. Changes
If we add a cookie, this page changes before the cookie ships, not after.