Cookie Policy and Report
Last updated: 13 October 2026
This report explains cookies and similar technologies on the public DPS Compliance Hub website. Read it with our Website Privacy Policy. It does not describe cookies or account storage in separately hosted client workspaces or showcase services.
1 Who operates the website
Data Privacy and Data Security Services Limited, trading as Data Privacy Services, is registered in Cyprus with company number HE 432380. Registered address: Griva Digeni, 51 Athineon Court, Office 202, 8047, Paphos, Cyprus. UK operating address: 124 City Road, London, EC1V 2NX. Privacy contact: info@dataprivacyservices.co.uk.
2 Cookies, device storage and personal data
Cookies are small items stored by a website or service in your browser. Session cookies expire with the relevant session; persistent cookies remain until expiry or deletion. Local storage, session storage, pixels and similar technologies may also store or access device information. Cookie rules concern their actual purpose, not merely their name. A browser identifier or consent record can be personal or pseudonymous data even if it does not contain your name.
3 Current cookie report
The public site uses CookieYes for consent preferences, navigation and enquiry scripts, Ask DPS, and separately consent-gated Google Analytics and Google Ads measurement. This report covers the public website, not separately hosted workspaces.
| Technology / provider | Purpose and category | Lifetime / storage |
|---|---|---|
cookieyes-consentCookieYes, DPS Compliance Hub | Necessary preference storage. Remembers accepted or rejected categories and a consent identifier so choices can be respected. A consent identifier may be pseudonymous personal data. | CookieYes's standard consent-cookie lifetime is one year, unless reset, deleted or a different site setting applies. The preference may be renewed when you make a new choice. |
| Ask DPS conversation and consent token DPS Compliance Hub | Current-page memory for follow-up answers and proof of the active grant. This is not an analytics cookie or a persistent browser transcript. | Cleared from the page when chat is cleared, consent is withdrawn, or the page is reloaded or left. Closing the panel does not clear it. |
| Ask DPS consent grant DPS server | Server-side agreement time, notice version and expiry, associated with a hashed token. This is a server record, not a browser cookie. | Grant expires after 24 hours; expired files are removed during routine request-triggered cleanup. Withdrawal revokes it immediately. |
| Enquiry fields and security records DPS / hosting | Form data is submitted when you send an enquiry. Spam and rate controls help protect the service. Server records and enquiry emails are separate from browser cookies. | Form content, correspondence and security records follow the retention criteria in the Privacy Policy. |
_gcl_aw, _gcl_au and related _gcl_* identifiersGoogle Ads | Optional Advertisement measurement. Associates eligible ad clicks with completed ISMS Workspace enquiries and brochure-link requests. Loaded only after advertising consent; not required for access or enquiries. | Google click/conversion cookies normally persist for up to 90 days unless deleted or refreshed by another consented visit. Actual cookies depend on whether an eligible advertising click occurs. Browser settings may shorten storage. |
_ga and _ga_7TZXGCRPETGoogle Analytics 4 | Optional Analytics measurement. Distinguishes visits and sessions and measures page views, successful enquiries and PDF-link selections. Set only after Analytics consent. No enquiry fields or AI messages are sent. | Configured for up to one year; consented activity may renew expiry. Browser controls may shorten storage. Event-level Analytics retention is two months; aggregate reports are separate. |
This report identifies storage used by the public implementation, including cookies that depend on an eligible ad click. A scanner may not show every conditional cookie; the consent preference itself is also storage.
4 Categories and optional technologies
The current preference panel presents Necessary, Functional, Analytics, Performance and Advertisement. The presence of a category does not mean the site currently uses cookies in that category. Google Analytics 4 is an optional Analytics technology and Google Ads conversion measurement is an optional Advertisement technology. Each destination remains blocked until you accept its own category. No Google measurement request is sent when both categories are refused. We disable Google signals, enhanced conversions, automatic enhanced measurement and personalised advertising in this implementation.
Necessary technologies are used without consent only where an applicable legal exception is satisfied. A vendor's label does not make a technology exempt. We apply PECR where relevant to UK visitors and applicable Cyprus/EU device-storage and data protection requirements; a UK exception does not automatically authorise the same activity for EEA visitors. Continuing to browse is not consent.
5 Make, reject or change a choice
CookieYes provides Accept All, Reject All and Customise. The preference panel allows category choices and Save My Preferences. Reopen it using the Consent Preferences button. Necessary preference storage remains active where legally exempt. You can refuse optional technologies without losing ordinary access to public product and service information.
Change or withdraw optional permission through the same controls. This affects future use; it does not undo processing already completed. Withdrawing Analytics or Advertisement consent reloads the page to remove active measurement code; the remaining category operates only if still consented. You can also delete previously placed Google cookies through your browser settings. You can remove browser cookies and other site data through your browser settings. Removing the preference cookie or using another browser or device may cause the banner to ask again. Blocking necessary storage can prevent preferences being remembered.
6 Ask DPS and OpenAI are a separate choice
Accepting cookies does not authorise AI message processing. Ask DPS requires an unticked processing-consent checkbox and Agree and start before a message is sent to OpenAI. General product questions do not require personal information. Do not enter confidential information or workspace records.
Withdraw consent and clear chat revokes the grant and clears the local conversation. Clear chat alone does not withdraw consent; closing the panel does neither. The 24-hour grant lifetime is not a promise that every provider record is deleted after 24 hours. OpenAI has separate processing and retention arrangements, described in the Ask DPS section of our Privacy Policy.
7 Providers, transfers and separate services
CookieYes supplies the consent-management service and may process a consent identifier and relevant technical information. Website hosting, email delivery and AI processing can involve personal data independently of cookies. The Privacy Policy explains recipients and international transfers, including appropriate safeguards for restricted transfers. Do not infer that public-site consent transfers automatically to ISMS Workspace, PIMS Workspace, Data Privacy Workspace, a showcase or another linked website; use their own notices and controls.
8 Rights, complaints and updates
For personal data rights, read our DSAR Policy. For concerns, contact our privacy contact or follow our Data Handling Complaints Process. You may complain directly to the Cyprus Commissioner, the ICO or another competent supervisory authority as applicable.
We update this report when the implementation, providers or purposes change. Where a material change requires renewed consent, we obtain it before relying on that change. Further information is available in ICO guidance on storage and access technologies and CookieYes preference guidance.
Optional Calendly demo calendar
The workspace demo pages offer a Calendly calendar that loads only after you select “Load demo calendar”. No Calendly script or embedded calendar is requested by that page before this action. Loading it connects your browser to Calendly. Calendly may use storage or cookies for its booking service and provides its own privacy and cookie controls. Those cookies are managed by Calendly and can vary with its implementation and your choices; they are not represented as a fixed first-party cookie inventory here. Read Calendly’s Privacy Notice before loading the calendar, or contact DPS to arrange a demo without using the embedded service.
Existing Analytics and Advertisement choices continue to control DPS website measurement. A confirmed Calendly booking can generate a consent-gated lead event. Booking names, email addresses, answers and the Calendly event payload are not forwarded to Google measurement services.