Skip to content
Legal

Cookie policy

Three strictly necessary items, and Google Analytics only if you accept it. Here is exactly what is stored, the law that governs each part, how to change your answer, and how to check for yourself. This page is general information and not legal advice.

What this policy covers

1.1 This policy explains what gamechanger360.co.uk stores in your browser, or reads from it, and why. It covers cookies and every equivalent technology, including local storage, session storage, pixels and device fingerprinting.

1.2 The short version: this website sets one cookie that records nothing but your language, stores one further item if you start the Integrity Readiness Check, and keeps a record of the answer you give to the analytics question. Those three are strictly necessary. On top of them we ask whether you will accept Google Analytics. If you accept, two more cookies are set. If you refuse, or never answer, nothing Google-related loads at all. There is no advertising, retargeting or conversion cookie of any kind, and there never has been.

1.3 This policy sits alongside our privacy notice, which explains how we handle personal data more generally. Where this policy uses a term the privacy notice defines, it has the same meaning.

1.4 This page is general information and not legal advice.

The law that applies

2.1 Two instruments apply, and it is worth being precise about which does what.

2.2 The Privacy and Electronic Communications (EC Directive) Regulations 2003, known as PECR, govern the act of storing information on your device or gaining access to information already stored there. Regulation 6 requires clear information and your consent before that happens, unless the storage or access is strictly necessary for the provision of a service you have requested. PECR applies whether or not the information is personal data.

2.3 The UK General Data Protection Regulation and the Data Protection Act 2018 then govern any personal data involved: what it is used for, on what lawful basis, for how long and with what rights. Where consent is required by PECR, that consent must meet the UK GDPR standard, which means a clear affirmative act, freely given, and as easy to withdraw as to give.

2.4 The two categories in section 3 rest on different grounds, and we keep them apart. For the first three items we rely on the strictly necessary exemption in regulation 6(4) of the instrument described in clause 2.2, because each exists only to deliver the page you asked for, the tool you started, or the choice you made. For the two Google Analytics cookies we rely on nothing of the kind. They are not necessary to provide anything you have asked for, so we set them only with your consent under regulation 6, and the processing that follows rests on your consent under Article 6(1)(a) of the UK GDPR. Section 5 explains how that consent is asked for and how to take it back.

2.5 We do not treat legitimate interests as a fallback for analytics that need consent. If you refuse, Google Analytics does not run, and no other lawful basis is substituted for it.

What this website stores in your browser

3.1 Five items, in full. The first three are set whatever you choose. The last two exist only if you have accepted analytics:

  • NEXT_LOCALE is a first-party cookie written by the internationalisation layer that decides which language version of a page to serve. Purpose: to record which language you are being served, so the site stays in that language as you move around it. Contents: a language code and nothing else. Today it can only hold the value "en", because English is currently the only language on the site, and it holds no identifier, no reference to you and nothing about your visit. Lifetime: a session cookie, set with no expiry date, so your browser discards it when you close it. Attributes: Path=/, SameSite=Lax and, in production, Secure, so it is never sent to another website, never travels over plain HTTP and cannot be read by a third party. It is written on your first page response and then left alone.
  • gc360:readiness:v2 is session storage, not a cookie. It is never transmitted to us and never attached to a request. It is set only if you begin the Integrity Readiness Check, and it holds your answers so far so that a reload does not destroy your work. Lifetime: deleted when you close the tab, and deleted as soon as you request your report.
  • gc360-analytics-consent is local storage, not a cookie. It records the answer you gave to the analytics question and nothing else: your choice, the time you made it, and a version number identifying the question you were asked. It holds no identifier, nothing about your visit and no reference to you. It is never transmitted to us and never attached to a request. Lifetime: it stays until you change your answer or clear your site data. It is strictly necessary in the sense regulation 6(4) uses, because without it we cannot remember that you said no and would have to ask you again on every page.
  • _ga is the first of two Google Analytics cookies, and it is set only after you accept. It is first-party, written on our own domain rather than a Google one. Contents: a randomly generated identifier, which Google calls the client ID, together with the time it was first set. Purpose: Google documents it as used to distinguish users, which in practice means recognising that a later visit comes from the same browser rather than a new one. Lifetime: two years from when it is written. Google notes that browsers now cap first-party cookie lifetimes below that, at a maximum of 400 days in Chrome and seven days in Safari, so the real figure is shorter than the one Google sets.
  • _ga_50TMK90Y6L is the second, named after our measurement ID, G-50TMK90Y6L, with the prefix dropped; Google's documentation writes the pattern as _ga_<container-id>. It is set only after you accept, and it is first-party in the same way. Contents: session state, meaning an identifier for the visit in progress and the counters that go with it. Purpose: Google documents it as used to persist session state, which is what groups several page views made in one visit into a single session rather than counting each page as a fresh arrival. Lifetime: two years from when it is written, subject to the same browser caps.

3.2 That is the complete list. Google serves the Analytics script from googletagmanager.com, which is simply the address Google publishes it at; it is not a tag manager container, and we do not use one. Nothing is requested from that address until you accept.

3.3 The first three items are not used for analytics, advertising, personalisation or measurement, and none of them is shared with anyone. The two Google Analytics cookies are used for measurement and for nothing else. Section 4 says what is measured and by whom, and section 6 says what we do not do with it.

3.4 Our hosting provider processes your IP address and request headers in order to deliver each page and to defend the service, as any web server must. That is not storage on your device, so regulation 6 of PECR does not govern it. Section 7 of our privacy notice explains it.

How we measure use of this website

4.1 We measure two things: which pages are read, and whether the site performs. Two different tools do that. They work in different ways, and only one of them needs your consent. The distinction is the important part of this policy, so it is set out in full.

4.2 Vercel Web Analytics and Vercel Speed Insights run for every visitor. Both are provided by our hosting provider, and neither sets a cookie or reads one. They record aggregate information about a page view: the page, the referring source, approximate location at country level, device category, browser and operating system category, and performance measurements such as how quickly the page became usable. Unique visits are counted using a temporary identifier derived from request data, which is not written to your browser, is not stored against you and cannot be used to follow you to another website. Because nothing is stored on or read from your device, regulation 6 of PECR does not require consent for them, and the lawful basis for the personal data involved is our legitimate interests under Article 6(1)(f).

4.3 Google Analytics 4 runs only if you accept it. Our property's measurement ID is G-50TMK90Y6L. Until you click Accept, no request is made to Google, no Google script is loaded, and neither of the two cookies described in section 3 exists. Refusing leaves it that way, and so does ignoring the question. This is a statement about what is loaded, not a promise about what is done with data afterwards.

4.4 What Google Analytics records once you accept: the pages you view and when, how you arrived at the site, approximate location derived from your IP address, device category, browser, operating system, screen size and language, and interaction events such as page views, scrolls, outbound clicks, site searches and file downloads, which Google's enhanced measurement setting collects automatically. The two cookies in section 3 are what group several page views into one visit and recognise the same browser on a later one.

4.5 On IP addresses, Google's current position is narrower than the one people expect from the old Universal Analytics. Google states that it does not log or store IP addresses from visitors in the United Kingdom, the European Union or Switzerland. For that traffic the address is used on servers in those regions to derive coarse location, and is then discarded before the data reaches Analytics for processing. The result we see is a city, region and country, not an address. The IP anonymisation setting that Universal Analytics had does not exist in Google Analytics 4, so we neither claim to have switched it on nor could we: the handling described here is applied by Google, not configured by us.

4.6 We use the result in aggregate, to decide what to write and what to fix. We do not use it to build a profile of you, we do not combine it with the enquiry, newsletter or Readiness Check data described in our privacy notice, we do not create advertising audiences from it, and we do not share it with advertisers.

4.7 How long Google keeps it is a setting inside the Analytics property rather than code in this website, and it is set to the shortest period Google offers. Event level data is kept for two months. User level data is kept for two months as well. The separate option Google calls resetting user data on new activity, which would restart the two-month clock on user level data each time the same browser returned and so hold a regular reader's identifier indefinitely, is off, so two months runs from the activity itself. The fourteen-month default that Google applies to a new property is not what runs here. We will say so on this page if any of that changes.

4.8 Google Signals, and the advertising personalisation that goes with it, are off. That is set in this website's own code, on every request the tag makes, so it does not depend on anyone remembering a setting. The same two controls also exist inside the Analytics property, along with data sharing with Google's advertising products, and our position is that all three stay off there as well. Those are property settings and cannot be seen from this page, so if you need to know the state of any of them on the day you ask, email privacy@gamechanger360.co.uk and we will tell you what it is rather than point you back at this page.

4.9 Google Ireland Limited provides Google Analytics for visitors in the United Kingdom and the European Union, and acts as our processor under the Google Ads Data Processing Terms, which are the Article 28 terms for Google Analytics and which we have accepted for this property. Google engages its own affiliates as sub-processors, including Google LLC in the United States, so data collected through Analytics can be processed outside the United Kingdom. Section 10 of our privacy notice lists Google alongside our other processors, and section 11 of it explains the transfer safeguards we rely on.

What we do not do

6.1 So that there is no ambiguity, this website does not:

  • set advertising, retargeting or conversion cookies, or any marketing pixel
  • use a tag manager, an ad-tech platform, or a consent-management platform bought from a vendor; the banner described in section 5 is our own code and reports to nobody
  • attempt to identify you across other websites or across devices; the Google Analytics cookies are first-party, set on our domain and readable only on it, and clause 4.8 covers the Google setting that would otherwise join a visit to a Google account
  • use device fingerprinting
  • embed third-party video players, social media widgets, chat widgets, comment systems, maps or share buttons
  • sell, rent or share information about your visit with advertisers or data brokers
  • run A/B testing or behavioural personalisation on visitors
  • treat silence, scrolling or continued browsing as consent, or make any part of this website conditional on accepting analytics

6.2 There is exactly one thing on this website to consent to, and it is the Google Analytics described in clause 4.3. Everything else in section 3 falls within the strictly necessary exemption in regulation 6(4), so we ask for no consent to it and none is needed.

Fonts and other third-party content

7.1 The website uses two typefaces, Space Grotesk and Manrope. They are downloaded once when we build the site and are served from our own domain. Your browser makes no request to Google or to any other font host for them, so no third party learns of your visit through a font. If you have accepted analytics, your browser does contact Google, for that and only for that, as clause 4.3 describes.

7.2 Images, icons, illustrations and video on the website are served from our own domain. Structured data for search engines is embedded in the page itself and loads nothing from anywhere else.

7.3 Links to news publications, partner organisations and social platforms take you to websites we do not control, and those websites set their own cookies once you arrive. Nothing is set on our side by the presence of a link.

Our product applications are separate

8.1 360 Academy, 360 Report, 360 Sentinel and 360 Intelligence run on their own subdomains and are separate applications, not part of this website. They are authenticated services, and an application that keeps you signed in necessarily sets at least a session cookie.

8.2 This policy does not describe them, and the answer you give to the banner on this website does not travel to them. Each application publishes its own cookie and privacy information, and where an application is deployed by a federation, league, club, regulator, university or player association, that organisation is the controller of the data in it. Section 3 of our privacy notice explains that split.

How to control what is stored

9.1 You are in control of your own browser. Every current browser lets you view, block and delete cookies and site storage, either for all sites or for one site, usually under Settings, then Privacy, then Cookies and site data. Private or incognito browsing discards site storage when you close the window.

9.2 Blocking storage for this website costs you almost nothing. Pages, insight, the newsletter and the contact form all work normally. Blocking the language cookie means the site simply serves English, which it does today in any event. Blocking session storage means the Integrity Readiness Check can no longer remember your answers, so a reload will start it again. Refusing analytics, or blocking the analytics cookies outright, changes nothing you can see.

9.3 The quickest way to remove the analytics cookies from a browser where you accepted them is the Cookie settings control in the footer, which deletes them as clause 5.3 describes. Clearing site data in the browser removes them too, along with the record of your answer.

9.4 A tracker blocker or an ad blocker will usually block Google Analytics whether or not you accepted it. That is fine by us. We do not work around blockers, we do not serve the script from our own domain to disguise it, and the site behaves identically either way. There is no advertising identifier here to reset, because we set none.

9.5 If you want to know what a page has stored, your browser's developer tools will show you, under Application or Storage.

If this changes

10.1 This policy changed on the date shown with it because we added Google Analytics, and it changed before the first analytics cookie was set rather than after. That is the rule we hold ourselves to. If we ever want to store something further that is not strictly necessary, we will update this policy first, ask for consent before the storage happens, and raise the version on the consent record so that an answer given to an earlier question is not treated as an answer to a new one.

10.2 The date shown with this page is the date of the current version. We review this policy when the website changes and at least once a year.

10.3 Questions about this policy, or about anything the site has stored, should be emailed to privacy@gamechanger360.co.uk.

We would like to use Google Analytics to see how this site is used. Nothing is loaded and no cookie is set unless you accept. Read the cookie policy