Skip to content
Legal

Cookie policy

One strictly necessary cookie, one session storage entry, and nothing else. Here is exactly what is stored, the law that governs it, and how to check for yourself. This page is general information and not legal advice.

What this policy covers

1.1 This policy explains what new.gamechanger360.co.uk stores in your browser, or reads from it, and why. It covers cookies and every equivalent technology, including local storage, session storage, pixels and device fingerprinting.

1.2 The short version: this website sets one cookie, which records nothing but your language, and stores one further item if you start the Integrity Readiness Check. Both are strictly necessary, neither tracks you, and there is no advertising or analytics cookie of any kind. That is why you have not been asked to accept anything.

1.3 This policy sits alongside our privacy notice, which explains how we handle personal data more generally. Where this policy uses a term the privacy notice defines, it has the same meaning.

1.4 This page is general information and not legal advice.

The law that applies

2.1 Two instruments apply, and it is worth being precise about which does what.

2.2 The Privacy and Electronic Communications (EC Directive) Regulations 2003, known as PECR, govern the act of storing information on your device or gaining access to information already stored there. Regulation 6 requires clear information and your consent before that happens, unless the storage or access is strictly necessary for the provision of a service you have requested. PECR applies whether or not the information is personal data.

2.3 The UK General Data Protection Regulation and the Data Protection Act 2018 then govern any personal data involved: what it is used for, on what lawful basis, for how long and with what rights. Where consent is required by PECR, that consent must meet the UK GDPR standard, which means a clear affirmative act, freely given, and as easy to withdraw as to give.

2.4 We rely on the strictly necessary exemption in regulation 6(4) for both of the items described in section 3, because each of them exists only to deliver the page or the tool you asked for. We ask for no consent because we store nothing that requires it. If that ever changes, section 9 explains what we will do first.

What this website stores in your browser

3.1 Two items, in full. One is a cookie and one is not:

  • NEXT_LOCALE — the only cookie this website sets. A first-party cookie written by the internationalisation layer that decides which language version of a page to serve. Purpose: to record which language you are being served, so the site stays in that language as you move around it. Contents: a language code and nothing else. Today it can only hold the value "en", because English is currently the only language on the site, and it holds no identifier, no reference to you and nothing about your visit. Lifetime: a session cookie, set with no expiry date, so your browser discards it when you close it. Attributes: Path=/, SameSite=Lax and, in production, Secure, so it is never sent to another website, never travels over plain HTTP and cannot be read by a third party. It is written on your first page response and then left alone.
  • gc360:readiness:v2 — session storage, not a cookie. It is never transmitted to us and never attached to a request; it stays in your browser. Set only if you begin the Integrity Readiness Check, and nothing is stored if you never start it. Purpose: to hold your organisation profile, your answers so far, your position in the questionnaire and anything you have typed, so that reloading or navigating away does not destroy your work. Without it the tool loses your answers on every reload, which is why we treat it as strictly necessary to the service you asked for. Lifetime: deleted when you close the tab, and deleted by us as soon as you request your report.

3.2 That is the complete list. Neither item is used for analytics, advertising, personalisation or measurement, and neither is shared with anyone.

3.3 Our hosting provider processes your IP address and request headers in order to deliver each page and to defend the service, as any web server must. That is not storage on your device, so regulation 6 of PECR does not govern it. Section 7 of our privacy notice explains it.

What we do not do

4.1 So that there is no ambiguity, this website does not:

  • set advertising, retargeting or conversion cookies, or any marketing pixel
  • use a tag manager or any consent-management or ad-tech platform
  • profile you, or attempt to identify you across other websites or across devices
  • use device fingerprinting
  • embed third-party video players, social media widgets, chat widgets, comment systems, maps or share buttons
  • sell, rent or share information about your visit with advertisers or data brokers
  • run A/B testing or behavioural personalisation on visitors

4.2 There is no cookie banner on this website. That is not an oversight and it is not a dark pattern: both items in section 3 fall within the strictly necessary exemption, so there is nothing here for you to consent to. A banner asking you to accept a language preference would be theatre.

Analytics without cookies

5.1 We do want to know which pages are read and whether the site performs, so we use Vercel Web Analytics and Vercel Speed Insights. Both are provided by our hosting provider and neither sets a cookie.

5.2 They record aggregate information about a page view: the page, the referring source, approximate location at country level, device category, browser and operating system category, and performance measurements such as how quickly the page became usable. Unique visits are counted using a temporary identifier derived from request data, which is not written to your browser, is not stored against you and cannot be used to follow you to another website.

5.3 We use the result only in aggregate, to decide what to write and what to fix. It is not combined with the enquiry, newsletter or Readiness Check data described in our privacy notice, it is not used to build a profile, and it is not shared with advertisers. The lawful basis for it is our legitimate interests under Article 6(1)(f), and because nothing is stored on or read from your device, regulation 6 of PECR does not require consent for it.

5.4 [TO CONFIRM: the current Vercel Web Analytics and Speed Insights data-collection description and retention period, verified against the provider's documentation at launch, so that clause 5.2 states the mechanism exactly.]

Fonts and other third-party content

6.1 The website uses two typefaces, Space Grotesk and Manrope. They are downloaded once when we build the site and are served from our own domain. Your browser makes no request to Google or to any other font host when you visit a page, so no third party learns of your visit through a font.

6.2 Images, icons, illustrations and video on the website are served from our own domain. Structured data for search engines is embedded in the page itself and loads nothing from anywhere else.

6.3 Links to news publications, partner organisations and social platforms take you to websites we do not control, and those websites set their own cookies once you arrive. Nothing is set on our side by the presence of a link.

Our product applications are separate

7.1 360 Academy, 360 Report, 360 Sentinel and 360 Intelligence run on their own subdomains and are separate applications, not part of this website. They are authenticated services, and an application that keeps you signed in necessarily sets at least a session cookie.

7.2 This policy does not describe them. Each application publishes its own cookie and privacy information, and where an application is deployed by a federation, league, club, regulator, university or player association, that organisation is the controller of the data in it. Section 3 of our privacy notice explains that split.

How to control what is stored

8.1 You are in control of your own browser. Every current browser lets you view, block and delete cookies and site storage, either for all sites or for one site, usually under Settings, then Privacy, then Cookies and site data. Private or incognito browsing discards site storage when you close the window.

8.2 Blocking storage for this website costs you almost nothing. Pages, insight, the newsletter and the contact form all work normally. Blocking the language cookie means the site simply serves English, which it does today in any event. Blocking session storage means the Integrity Readiness Check can no longer remember your answers, so a reload will start it again.

8.3 Because we set no tracking cookies, there is nothing here for a tracker blocker or an ad blocker to remove, and no advertising identifier to reset.

8.4 If you want to know what a page has stored, your browser's developer tools will show you, under Application or Storage. We would rather you checked than took our word for it.

If this changes

9.1 If we ever want to store something that is not strictly necessary, we will not simply start doing it. We will update this policy first, and we will put a consent mechanism in place before the storage happens, with a genuine choice to refuse, no pre-ticked boxes, and withdrawal made as easy as consent.

9.2 The date shown with this page is the date of the current version. We review this policy when the website changes and at least once a year.

9.3 Questions about this policy, or about anything the site has stored: privacy@gamechanger360.co.uk.