Skip to main content

Cookie policy

Manage your cookie preferences

You can review and change your cookie consent choices at any time. Use the button below to open the consent panel.

1. What are cookies?

Cookies are small text files that a website stores on your device when you visit. They allow the site to recognise your device on subsequent visits, remember your preferences, and measure how the site is used.

Under the Privacy and Electronic Communications Regulations 2003 (PECR) and UK-GDPR, we are required to tell you what cookies we use, why we use them, and to obtain your consent before setting any non-essential cookies.

2. Cookie categories

We group cookies into the following categories in line with ICO guidance:

Strictly necessary

These cookies are essential for the website to function and cannot be switched off. They are set in response to your actions — for example, logging in to the staff dashboard. They do not store personally identifiable information beyond what is required for the session. These cookies are exempt from consent under PECR Regulation 6(4).

Analytics

These cookies help us understand how visitors use the website — for example, which pages are most visited and whether visitors encounter errors. All data is aggregated. These cookies are only set after you give consent via the cookie banner.

Marketing

We do not use marketing cookies in v1 of this website. If this changes, we will update this policy and the cookie banner categories accordingly before any marketing cookies are set.

3. Cookies we set

The following table lists the cookies currently set by this website.

Strictly necessary cookies

These are set by our authentication system (Auth.js v5). The exact cookie name prefix depends on the Auth.js configuration — the default prefix is authjs. but this may be changed during setup. Always verify the current names in your browser's developer tools.

Cookie namePurposeDuration
authjs.session-tokenStores the authenticated session token for staff admin access. Without this cookie, a logged-in user would be signed out on every page load.Session / 8 hours
authjs.csrf-tokenCross-site request forgery protection token. Prevents malicious third-party sites from making authenticated requests on your behalf.Session
authjs.callback-urlStores the URL to redirect to after a successful login, so you are returned to the page you were trying to reach.Session
mvp_consentRemembers your cookie choices so we do not ask again on every page, and so nothing you declined is loaded. It records only which categories you allowed and when — no identifier, and nothing that identifies you personally. This one is strictly necessary: without it we could not honour your decision.12 months

Note: Auth.js v5 may use a different prefix (e.g. next-auth.) depending on the project configuration. The cookies listed above reflect the default Auth.js v5 naming convention. Verify at deployment.

Analytics cookies (consent required)

Analytics cookies are only set after you accept them via the cookie banner. The provider in use will be confirmed once the analytics decision (G-4) is finalised and cluster 4.11 is shipped.

Cookie nameProviderPurposeDuration
plausible_ignorePlausible AnalyticsIf using Plausible (self-hosted), this cookie is set to exclude your own visits from analytics counts. Plausible is cookie-free by default in its cloud offering — no other Plausible cookies are set.1 year
_gaGoogle Analytics 4Distinguishes unique users for traffic measurement. Only set if GA4 is chosen (pending G-4).2 years
_gidGoogle Analytics 4Distinguishes unique users within a 24-hour period. Only set if GA4 is chosen (pending G-4).24 hours
_gat_*Google Analytics 4Throttles the request rate to Google Analytics. Only set if GA4 is chosen (pending G-4).1 minute

The analytics cookie rows marked “pending G-4” will be updated to reflect only the chosen provider once that decision is made. The unused provider's cookies will be removed from this table.

Marketing cookies

We do not set any marketing cookies in v1. If this changes in a future version, we will update this policy before any such cookies are placed.

4. reCAPTCHA cookies

We use Google reCAPTCHA v3 on our public forms (enquiry, test-drive booking, trade-in valuation) to detect and prevent automated bot submissions. reCAPTCHA sets its own cookies as part of this process.

Google classifies reCAPTCHA cookies as functional/analytics in nature. We gate the reCAPTCHA script load behind the analytics cookie category in our consent banner, so reCAPTCHA cookies are only set after you consent to analytics cookies.

Please refer to Google's privacy policy for details of how Google processes reCAPTCHA data.

5. How to manage your cookie preferences

You can review and change your cookie consent preferences at any time. When you first visit our website, a cookie banner gives you the option to accept or reject non-essential cookies by category. Rejecting non-essential cookies is as easy as accepting them.

To update your preferences after you have already made a choice, use the button below to re-open the consent panel:

Please note that withdrawing consent for strictly necessary cookies is not possible as they are required for the site to function. If you block strictly necessary cookies in your browser, parts of the site (including the staff admin area) may not work correctly.

6. Managing cookies in your browser

In addition to using our consent banner, most web browsers allow you to control cookies through their settings. The links below take you to the cookie-management help page for each major browser:

Please be aware that disabling cookies in your browser may affect the functionality of many websites, not just ours.

7. Changes to this cookie policy

We will update this policy when we change the cookies we use or when the law requires it. The “Last updated” date below will reflect the most recent revision. If changes are significant, we will reset consents so you can review the new categories before they take effect.

Last updated

This cookie policy was last updated on .

Document version: draft-2026-04-18. Pending solicitor review (G-5).

Changed your mind? You can update your cookie preferences at any time.