Cookie statement
This site sets no cookies of its own and runs no analytics, so there is no consent banner. Two things still reach beyond the page, and both are described here rather than omitted.
The short answer
This website sets no cookies of its own. There is no analytics, no advertising, no tracking pixel and no session recording.
There is no consent banner, because there is nothing here that requires consent.
Two things still reach beyond the page: a strictly necessary security cookie our hosting provider may set, and a request to Google's font servers. Both are described below.
The rule this answers to
The operative rule is regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, read with the UK GDPR. Storing information on a user's terminal equipment, or gaining access to information already stored there, requires clear information and consent.
Regulation 6 is technology neutral. It catches local storage, session storage, IndexedDB, pixel tags and device fingerprinting exactly as it catches cookies, so a site that avoids the word "cookie" while doing the same thing has not avoided the rule.
The one exemption
Consent is not required where the storage or access is strictly necessary for a service explicitly requested by the user. The Information Commissioner's Office reads this narrowly: it covers a load balancing or security mechanism, and it does not stretch to analytics, however anonymous the analytics claims to be.
Why there is no banner
A banner exists to collect permission for storage that is not strictly necessary. This site has none, so a banner would be asking you to consent to nothing.
That is worse than leaving it out. It teaches people to dismiss a control that matters elsewhere, and it implies the site is doing something it is not.
If anything outside the exemption is ever added here, we will ask before it loads, make refusing exactly as easy as accepting, record the consent with a timestamp and the wording agreed, and update this page and its effective date first.
Everything this site may store
Two cookies, neither set by us.
- __cf_bm, set by Cloudflare, our hosting provider. Distinguishes automated traffic from human traffic so abusive requests can be blocked. Lives 30 minutes, refreshed on activity. Strictly necessary, so no consent is required.
- cf_clearance, set by Cloudflare only if you are shown and pass a challenge. Records that the challenge was passed so you are not asked again. Lives up to 30 days. Strictly necessary.
That is the complete list. Neither is readable by us as an identifier of you.
What this site does not do
- No Google Analytics, Plausible, Fathom, Matomo or any other analytics.
- No advertising and no advertising cookies.
- No Meta pixel, LinkedIn Insight tag or conversion tracking.
- No session recording, heatmapping or scroll tracking.
- No embedded video, map, chat widget or social widget.
- No local storage, session storage or IndexedDB written by our code.
- No fingerprinting and no attempt to recognise a returning visitor.
- No visitor identification service resolving your IP address to your employer for a sales pipeline. That practice is common on engineering supplier websites and it is worth naming rather than merely omitting.
All of this is checkable. Open the Application and Network panels in your browser's developer tools and compare them with this list.
The one outbound request
This site loads its typefaces from Google Fonts, at fonts.googleapis.com and fonts.gstatic.com. Making that request discloses your IP address, your user agent and the referring page to Google's servers. Google states that the Fonts service sets no cookies and does not use the requests for advertising or profiling.
Self hosting the font files would remove the request entirely and it is on our list. Until it is done this is the honest description rather than an omission, and blocking those two hosts leaves the site fully readable in a system font.
Server logs are not cookies
Every web server records the requests it receives. Our hosting provider logs the IP address, timestamp, path, user agent and response code for each request. Nothing is stored on your device, so regulation 6 is not engaged, but an IP address is personal data under the UK GDPR and it belongs in an honest account of what this site collects.
The lawful basis is our legitimate interest in delivering the site and defending it from abuse, under Article 6(1)(f). The logs sit with the provider on its own retention cycle, currently under 30 days, and are not combined with anything else.
Controlling storage yourself
Every major browser lets you block cookies, delete them, and inspect what a site has set. Blocking the two listed above may mean Cloudflare challenges you more often, but the site will work.
- Chrome: Settings, then Privacy and security, then Third-party cookies and Site data.
- Safari: Settings, then Privacy, then Manage Website Data.
- Firefox: Settings, then Privacy and Security, then Cookies and Site Data.
- Edge: Settings, then Cookies and site permissions.
Do Not Track and Global Privacy Control
Both signals are honoured, which is easy because there is nothing here to switch off. If either is present in your request, no additional storage or processing occurs, which is also true if neither is.
We say so anyway. A site that ignores these signals and stays silent about it has made a choice it would rather you did not notice.
Client engagements
This page describes this website. It says nothing about a system we build for a client.
Where we build something that sets cookies, the client is the controller and decides. What we will do is tell the client, in writing and before launch, which of the cookies their system sets fall inside the strictly necessary exemption and which do not, and refuse to describe a non-essential cookie as essential in their banner. That is a professional position, not a legal opinion, and a client wanting the latter should take advice.
Changes, questions and complaints
If anything that stores information on your device is added beyond what is listed here, this page and its effective date change before it goes live, and consent is collected where regulation 6 requires it.
Questions go to hello@vivanlabs.co.uk and are answered within five working days. A data protection request is answered within one month, as Article 12(3) of the UK GDPR requires.
If our answer does not satisfy you, you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk. There is no fee and you do not need our agreement.