Cookie Policy

CP-001 v1.0 · Last updated 6 September 2026

Legal position as at September 2026

Cookies and similar technologies are governed by regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025. The DUAA amendments to PECR came into force on 5 February 2026, and the ICO published final guidance on 29 April 2026. The position is now:

The statistical exception is an exception to consent, not to transparency. To rely on it you must still (a) give clear information about the cookies before they are set, (b) offer a simple, free way to opt out, and (c) ensure the data is used only to improve the site and cannot be used to identify an individual visitor. Third-party analytics that feed advertising systems, or that build cross-site profiles, do not qualify and still need opt-in consent.

Note that DUAA also raised PECR penalties to UK GDPR levels — up to £17.5 million or 4% of global annual turnover.

Current status of the Wright Frameworks website

The website sets no cookies.

The site is a static page served by Azure Static Web Apps with a single form that posts to an Azure Function. It loads no third-party scripts, no analytics, no tag manager, no embedded media and no advertising or social media pixels. It does not use localStorage or sessionStorage. Azure Static Web Apps sets an authentication cookie only where its built-in authentication is used, and this site does not use it.

Consequently no cookie banner is required at present. A banner that asks for consent when nothing is being set is not merely unnecessary — it is misleading, and the ICO has criticised consent mechanisms that do not reflect what a site actually does.

Published policy text (for the website)

Cookies on this website

We do not use cookies on this website.

This site does not set cookies, does not use analytics or advertising trackers, and does not embed third-party content that would set cookies on your device. Nothing you do here is tracked across other websites.

Our hosting provider, Microsoft Azure, keeps standard technical logs of requests to the site — such as IP address and browser type — for security and reliability. This is explained in our Privacy Notice.

If we introduce cookies in future, we will update this page before doing so, and where the law requires it we will ask for your consent first.

Last reviewed: 6 September 2026

Change control — before adding any cookie or tracker

This is the part that matters operationally. Before adding analytics, a chat widget, an embedded video, a booking tool or a marketing pixel, complete the following:

1. Classify the cookie against the table above. Ask specifically: can this data identify an individual visitor, and does the vendor use it for their own purposes or for advertising? If yes to either, it needs opt-in consent.
2. Update this policy with a cookie table: name, provider, purpose, type, duration.
3. Implement the mechanism:
   • Consent-exempt statistical cookies — publish the information and provide a clear, free opt-out control. No banner needed, but the opt-out must be genuinely easy to find and use.
   • Consent-required cookies — a compliant banner: no pre-ticked boxes, reject must be as easy as accept, no cookie walls, no setting anything before a choice is made, and consent must be withdrawable as easily as it was given.
4. Record the decision in the change record and re-approve this document.

Common traps: Google Analytics in its default configuration shares data with Google for its own purposes and is generally treated as requiring consent; embedded YouTube players set cookies unless youtube-nocookie.com is used; and "essential" is a narrow category that does not cover anything done for the site owner's convenience.