Prepared for review: 30 September 2026. Status: draft, not effective.
1. Scope
This policy covers this marketing website’s supplied code. Hosting-provider cookies and additional tools must be audited before publication. The site is designed to work without optional analytics. Continuing to browse is not treated as consent.
2. Essential preference storage
sw-consent-v1 is a first-party localStorage entry recording version, analytics choice and choice time. The site treats it as expired after 180 days and asks again. It contains no name, email or employee identifier. Browsers do not automatically delete localStorage after that period; the implementation ignores expired data.
sw-currency is written only when you explicitly select a display currency. It records the currency code and selection time, is ignored after 180 days, and is not a tracking identifier. Clearing browser data removes both entries. When storage is unavailable, the site continues to work but may ask for your preference again.
3. Optional Google Analytics
No Google Analytics script is requested by the supplied code unless the operator has configured it and you choose Accept analytics or enable it in Customize. No advertising tags, social-media pixels, session replay, heatmap service or newsletter tracker is included.
When enabled, Google Analytics may set _ga and a measurement-specific _ga_ cookie. The supplied configuration requests a 180-day cookie life without renewing that lifetime on every page view. Actual cookies and provider account settings must be verified in a production browser audit. The implementation disables Google advertising signals and ad personalisation and avoids deliberately sending contact fields or query strings.
4. Make or change a choice
The initial banner gives Reject optional, Customize and Accept analytics choices. Analytics is off by default. The footer’s Cookie settings button lets you change your choice at any time without losing access to the website.
On withdrawal the implementation disables the configured measurement ID, attempts to remove accessible analytics cookies and reloads the page when necessary to stop the loaded library. This stops further analytics in this implementation; it does not automatically erase information already processed by the provider. Data-deletion requests are handled through the privacy contact.
5. Browser privacy signals and controls
A browser Global Privacy Control signal suppresses optional analytics here even when a previous local preference allowed it. Browser cookie blocking or storage clearing is also supported, although choices may not persist. This is a technical precaution, not a claim that all privacy-signal obligations in every jurisdiction have been satisfied.
6. No covert location or media capture
The marketing website does not access GPS, a camera, microphone, contacts or biometric sensors. A country suggestion, when configured, comes from the hosting provider’s network-derived country signal rather than device location permission. Future mobile or attendance features require separate notices and controls.
7. Provider review and updates
Before adding any tool, review its storage, purposes, recipients, retention, geography and consent requirements, and update both this inventory and the consent implementation. Do not load an advertising or replay tag through a tag manager under an analytics-only consent. Questions can be sent to info@staffworkspace.com.
Official references for review
ICO storage and consent guidanceReferences are provided for verification. They do not endorse StaffWorkspace. Check the current official version and its applicability before adoption.