Cookies

1. The short version

This website sets no cookies of its own. It runs no analytics, no tag manager, no advertising pixel, no social media widget, no session tracking and no consent banner. Nothing here follows you between sites, and nothing here builds a profile of you.

Two things do involve a third party, and both are described in full below: this site is served through Cloudflare, and its two typefaces are loaded from Google Fonts. Neither is advertising, and neither is optional in the sense of being switchable on this page, because both are part of how the page is delivered.

2. What a cookie is, and what the law requires

A cookie is a small text file a website asks your browser to store and send back on later requests. It is how a site remembers a login, a basket or a preference, and it is also how advertising networks recognise the same browser across different sites.

In the United Kingdom, storing information on your device or gaining access to information already stored there is governed by regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, usually called PECR. The rule is that you must be given clear information about the storage and must consent to it, with one exception: consent is not needed where the storage is strictly necessary for a service you have explicitly requested.

Where cookies or similar storage also involve personal data, the UK GDPR applies on top, and consent under PECR has to meet the UK GDPR standard: freely given, specific, informed, and a clear affirmative action.

3. Cookies this website sets

None. There is no first party cookie on trakcorp.uk.

The reason is structural rather than virtuous. The site is a set of static HTML files with one stylesheet and one small JavaScript file. There is no server side session, no login, no basket, no personalisation and no form that posts anywhere, so there is nothing for a cookie to remember. Every contact route on the site opens your own email client instead of submitting to a script.

The JavaScript file does three things: it opens and closes the navigation on small screens, it adds a rule under the header once you have scrolled past the hero photograph, and it reveals sections as they enter the viewport. It reads nothing about you, stores nothing, and sends nothing anywhere. All three behaviours are switched off if your browser reports a preference for reduced motion.

4. Cloudflare, which serves this site

trakcorp.uk is hosted on Cloudflare Pages and served through Cloudflare's network. Cloudflare sits between your browser and the files, delivers them from a nearby location, and filters malicious traffic.

Two consequences follow, and we would rather state them than let you discover them in a developer console.

Connection records. Cloudflare receives your IP address, the page you asked for, your user agent string and a timestamp, because it cannot serve a request without them. Those records are held under Cloudflare's own retention policy, which on the plan we use is a matter of days. We use them for nothing beyond diagnosing errors and blocking abuse. They are covered by the website server logs row of the controller inventory in our privacy notice.

Security cookies. Cloudflare's security features can set a cookie in specific circumstances, chiefly __cf_bm, a bot management cookie with a lifetime of around 30 minutes, and cf_clearance, which is set if you are shown and pass a challenge. We have not enabled a managed challenge for ordinary visitors, so in normal browsing you should see neither. If your traffic is flagged as automated, one may appear. Both are strictly necessary security cookies under regulation 6(4) of PECR, set to protect the service you asked for, and neither is used for analytics or advertising.

[TO CONFIRM: if we later enable a Cloudflare feature that sets an additional cookie, it will be named and described in this section before that feature is switched on.]

5. Google Fonts

This site uses two typefaces, Archivo for headings and Inter for text, loaded from fonts.googleapis.com and fonts.gstatic.com. That is a real third party request: your browser connects to Google, and Google therefore receives your IP address, your user agent and the fact that a page on this site asked for those fonts.

Google states that requests to the Fonts API do not set cookies, and that requests for the font files themselves are served from a cookieless domain. We have checked that no Google cookie appears when loading this site. What we cannot do is promise anything about what Google does with the connection record at its end, so we tell you the request happens and let you decide.

If you would rather not make that request, a content blocker set to block fonts.gstatic.com will stop it. The site is built so that it stays completely readable in your system's default sans serif typeface; the fonts are loaded with display=swap for that reason, so text is never invisible while they load.

[TO CONFIRM: whether the two typefaces will be self-hosted from trakcorp.uk instead, which would remove the third party request entirely. This page will be updated if that change is made.]

6. Other storage on your device

Cookies are not the only way a site can store data locally, and PECR covers the others too. For completeness, this site uses none of the following: localStorage, sessionStorage, IndexedDB, Web SQL, service workers, cache storage written by script, canvas or font fingerprinting, browser or device fingerprinting of any kind, ultrasonic beacons, or tracking pixels in images or email.

Your browser will cache the HTML, the stylesheet, the script, the favicon and the photographs, exactly as it does for any website. That is ordinary HTTP caching controlled by your browser, not storage we write, and clearing your browser cache removes it.

7. Why there is no consent banner

A consent banner exists to obtain permission for storage that is not strictly necessary. This site sets no such storage, so a banner would be asking you to consent to nothing.

We think putting one up anyway would be worse than useless. It would train you to dismiss a dialogue that carries no information, it would make the site look as though it were doing something it is not, and it would add a cookie to record that you had dismissed it, which is the only cookie the site would then have. If we ever add analytics or anything else requiring consent, we will add a real consent mechanism with a genuine reject option, and we will update this page before that happens rather than after.

8. The platform and the mobile applications

The TRAKCORP tracking platform is a separate application from this website, and it is in build. It will require a login, and a login requires a session, so it will use a strictly necessary session cookie or token to keep you signed in and to protect against cross site request forgery. That is storage without which the service you asked for cannot work, and it falls within the regulation 6(4) exemption.

The mobile applications are not published on the Apple App Store or Google Play at the effective date of this page. When they are, what they store on your device and what permissions they ask for is documented in section 12 of the privacy notice, and this page will link to the platform's own detail once it exists.

We do not operate advertising, and we do not use analytics that follow a user between our own product and anyone else's. That position is stated for the applications in section 13 of the privacy notice.

9. Controlling storage in your browser

You do not need to change anything for this site, but every major browser lets you inspect, block and delete cookies and site data:

• Safari: Settings, then Privacy, then Manage Website Data.
• Chrome: Settings, then Privacy and security, then Third-party cookies and Site data.
• Firefox: Settings, then Privacy and Security, then Cookies and Site Data.
• Edge: Settings, then Cookies and site permissions.

Blocking all cookies will not break this site, because it does not use any. It will break most sites that need a login, so a site by site exception list is usually more practical than a blanket block.

10. Do Not Track and Global Privacy Control

Some browsers send a Do Not Track header or a Global Privacy Control signal. Neither has any effect here, for the straightforward reason that there is nothing to opt out of: we do no tracking, run no advertising and share nothing with data brokers, whether or not you send a signal. We honour both by default, in the sense that our behaviour is already what the signal asks for.

11. Changes, and how to check this page is true

This is version 1.0, effective 7 August 2026. If we add anything that stores data on your device, we will update this page and the version above before the change goes live, not afterwards.

You do not have to take our word for any of it. Open your browser's developer tools, look at the Application or Storage panel while browsing this site, and the cookie list will be empty. Look at the Network panel and you will see requests for this domain, for Cloudflare, and for the two Google Fonts hosts, and nothing else. That check takes about ten seconds and is worth more than a paragraph of assurance from us.

Questions about this page, or a report that something on it is wrong, go to [email protected]. We aim to reply within three working days. Your rights over any personal data involved, including the right to complain to the Information Commissioner's Office, are set out in section 10 and section 20 of the privacy notice.