Legal · Cookie policy · Version 1.0
Cookie Policy
This site sets no analytics and no advertising cookies. Here is exactly what is set, why there is no banner, and how to control it anyway.
Effective 5 August 2026PECR / UK GDPRVersion 1.0
1. About this policy
This policy explains what is stored on your device when you visit volunos.uk, operated by Volunos Labs Ltd. It sits alongside our privacy notice, which explains how we handle personal data generally, and our terms.
The short version: this website is a set of static files with no analytics, no advertising technology, no tracking pixels, no embedded social media, no session recording and no chat widget. The only cookie that may be set is a strictly necessary security cookie placed by our content delivery network. Nothing is written to local storage.
2. What cookies are
A cookie is a small text file that a website asks your browser to store and send back on subsequent requests. It lets a site recognise the same browser between page loads — which is how a shopping basket survives a click, and equally how an advertising network follows someone across unrelated sites.
A first-party cookie is set by the site you are visiting. A third-party cookie is set by another domain whose content is embedded in the page, which is the mechanism behind most cross-site tracking. A session cookie is deleted when you close the browser; a persistent cookie has an expiry date and survives until then.
3. Local and session storage
Browsers also offer localStorage and sessionStorage, which store data on your device in larger amounts and are not sent automatically with each request. The law treats them the same way as cookies: storing or accessing information on a user's device requires consent unless it is strictly necessary.
This website writes nothing to local storage or session storage. The one piece of interactive behaviour on the site — the navigation index that expands on small screens — holds its state in memory only and forgets it when the page is closed.
4. The consent standard
Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 — PECR — requires that a user is given clear and comprehensive information about, and consents to, the storage of or access to information on their device. Regulation 6(4) exempts storage or access that is strictly necessary for the provision of a service explicitly requested by the user.
Where consent is required, PECR takes its meaning of consent from the UK GDPR: it must be freely given, specific, informed and unambiguous, given by a clear affirmative act. Continuing to scroll is not consent. A pre-ticked box is not consent. Making refusal harder than acceptance undermines "freely given". Cookies cannot be set before consent is obtained.
"Strictly necessary" is a narrow test. It covers security, load balancing and remembering what is in a basket. It does not cover analytics, however anonymous the analytics provider claims to be.
5. Cookies used on this site
The table below lists every cookie that may be set when you visit volunos.uk. There are no others.
| Name | Set by | Type | Purpose | Duration | Consent required |
|---|---|---|---|---|---|
| __cf_bm | Cloudflare, Inc. (our CDN and security provider) | Strictly necessary | Distinguishes human visitors from automated traffic so that bot management can protect the site. It does not store personal information and is not used to identify or profile you. | 30 minutes, refreshed on activity | No — exempt under PECR reg. 6(4) |
| cf_clearance | Cloudflare, Inc. | Strictly necessary | Set only if you are shown a security challenge, to record that the challenge was passed so you are not challenged repeatedly. Most visitors never receive it. | Up to 1 year, depending on configuration | No — exempt under PECR reg. 6(4) |
Both cookies belong to the security layer in front of the site rather than to the site's content. We do not read them, do not receive their values in any usable form, and cannot use them to recognise you. Cloudflare's own documentation describes them in more detail.
6. Why there is no banner
Because there is nothing to consent to. Every cookie in the table is strictly necessary and exempt from the consent requirement. A banner asking permission for exempt cookies would be theatre, and the ICO has been clear that consent mechanisms should not be used where consent is not needed, nor designed to nudge people into accepting things they do not want.
If we ever set a cookie that is not strictly necessary, a banner will appear, refusing will be exactly as easy as accepting, and nothing will be set until you have made a choice.
7. What we do not use
To be explicit, this website does not use: analytics of any kind, including privacy-focused or self-hosted analytics; advertising or retargeting cookies; conversion or tracking pixels from any advertising network; social media buttons, share widgets or embeds; session recording, heat mapping or scroll tracking; A/B testing tools; live chat or chatbot widgets; consent management platforms, which themselves set cookies; or fingerprinting of any description.
We do not know how many people visit this site beyond what our provider's server logs show, and we are content with that. Those logs are described in section 4 of the privacy notice.
8. Web fonts
Typefaces are requested from Google Fonts. This does not set a cookie — Google states that Google Fonts sets no cookies — but your browser does make a request to fonts.googleapis.com and fonts.gstatic.com, which necessarily discloses your IP address and user agent to Google. We mention it here because people reasonably want to know about every third-party request a page makes, not only the ones that involve cookies.
Blocking those two hosts in your browser or with an extension causes the site to fall back to typefaces already on your device. Everything remains readable and every link still works.
9. If anything changes
If we introduce a cookie or storage mechanism that is not strictly necessary, we will: update this policy and the table before deployment; add the cookie's name, provider, purpose and duration; obtain consent through a mechanism where refusing is as easy as accepting; set nothing before consent is given; provide a way to withdraw consent that is as easy as giving it; and record consent so that we can demonstrate it.
We will not introduce third-party advertising cookies on this site.
10. Controlling cookies in your browser
You can block or delete cookies at any time, independently of anything a site offers. Blocking all cookies breaks many websites; blocking third-party cookies is a sensible default and will not affect this site at all. Menu paths change between versions, so treat these as a guide.
Google Chrome (desktop)
Settings → Privacy and security → Third-party cookies, to choose a blocking level; and Settings → Privacy and security → Delete browsing data, to clear what is already stored. Site-specific controls are behind the icon at the left of the address bar.
Apple Safari (macOS)
Safari → Settings → Privacy, where you can block all cookies and see which sites store data; Manage Website Data lets you remove data for a specific site. Prevent cross-site tracking is on by default.
Mozilla Firefox
Settings → Privacy & Security → Enhanced Tracking Protection, choosing Standard, Strict or Custom; and Cookies and Site Data → Manage Data to remove stored data for individual sites.
Microsoft Edge
Settings → Cookies and site permissions → Manage and delete cookies and site data, where you can block third-party cookies and remove data per site; tracking prevention is under Settings → Privacy, search, and services.
iOS and iPadOS (Safari)
Settings → Apps → Safari → Advanced → Block All Cookies, and Settings → Apps → Safari → Clear History and Website Data. On older iOS versions, Safari appears directly in the Settings list rather than under Apps.
Android (Chrome)
Chrome → ⋮ → Settings → Site settings → Cookies, to choose a blocking level; and Chrome → ⋮ → Settings → Privacy and security → Delete browsing data, to clear what is stored.
Other browsers
Every mainstream browser offers equivalent controls under privacy or security settings. Independent guidance is available at ico.org.uk.
11. Do Not Track and Global Privacy Control
Do Not Track (DNT) is a browser header asking sites not to track the user. It was never standardised, is widely ignored, and has been removed from several browsers. We do not track anyone, so a DNT signal changes nothing about how this site behaves — the outcome you would want from it is already the default.
Global Privacy Control (GPC) is a more recent signal expressing an objection to the sale or sharing of personal information, and in some jurisdictions it must be honoured as a legally binding request. We do not sell or share personal data with anyone for their own purposes, and we set no cookies requiring consent, so there is nothing for a GPC signal to switch off here. If we ever introduced non-essential cookies, we would treat a GPC signal as a refusal of consent and would not set them.
12. Applications
We have not published any mobile or desktop application. If we do, the equivalent technologies — local storage on the device, software development kits, device identifiers — are covered in Part F of our privacy notice, which states that we will not use advertising identifiers, will not embed advertising or attribution SDKs, and will not track users across applications or websites.
13. Changes to this policy
This is version 1.0, effective 5 August 2026, and supersedes nothing. We will update it whenever the cookies used on this site change, and always before the change takes effect rather than afterwards. The effective date and version number at the top of this page tell you which version you are reading.
14. Contact
Questions about this policy, or about anything stored on your device by this site, go to research@volunos.uk. We reply within two working days.
You may also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk.
Volunos Labs Ltd, registered in Northern Ireland, company number NI741243. Registered office: City East, 72 Newtownards Road, Belfast, Northern Ireland, BT4 1GW.