Cookie & Storage Notice

Google Analytics 4 is optional and uses Basic Consent Mode. Before Allow analytics is selected, the Google tag is not loaded, no Google Analytics request or cookieless ping is sent, and no Google Analytics cookie is created. Rejecting analytics keeps it unloaded and does not restrict free tools, downloads, enquiries or checkout.

The seven free utilities keep entries in transient React/browser memory only. Information is cleared when the page is refreshed or the session ends and is not written to local storage or submitted to Workforce Toolbox.

The hosting platform uses security technologies to deliver and protect the public website. The unauthenticated public-domain audit observed Cloudflare’s __cf_bm security cookie. It is an HTTP-only security cookie with a short lifetime of about 30 minutes and is controlled by the hosting layer rather than the Workforce Toolbox application. The former owner-only access boundary is no longer present on the public customer hostname.

wt_analytics_consent is a first-party preference cookie used only to remember whether the visitor selected accepted or rejected. It contains no name, email, tool input or browsing history. It uses Path=/, SameSite=Lax and Secure on HTTPS, and expires after approximately six months.

Analytics settings in the footer reopens the choice. Changing from accepted to rejected stops future analytics transmission, removes application-accessible Google Analytics cookies where technically possible, and reloads the page into the rejected state. Information already transmitted before withdrawal is not deleted by that action.

After affirmative consent, Google Analytics may set _ga and a measurement-container cookie in the form _ga_6L4V0ZB3DY. Google may vary its supporting technology. These cookies distinguish browser activity for analytics trend measurement and are configured with a maximum lifetime of approximately six months. The exact production cookie set is reviewed on the HTTPS customer hostname when this notice is materially updated.

Workforce Toolbox sends only sanitised canonical pathnames and controlled non-sensitive events. Query strings, URL fragments, workplace-tool entries and outputs, enquiry content, customer details, payment identifiers, order references and download credentials are excluded. Advertising storage, advertising user data and ad personalisation are denied.

The software-enquiry form sends completed submissions to Workforce Toolbox through Resend’s server-side HTTPS API. No Resend script or widget is embedded in the browser. Draft content is not persisted. The form adds no application cookies, localStorage, sessionStorage, external embeds, CAPTCHA, tracking or analytics. Its anti-abuse controls use a honeypot, strict validation, a request-size limit and a short-lived per-runtime request bucket; they do not create browser storage.

Workforce Toolbox does not embed Stripe.js, Stripe Elements or a Stripe tracking script. Customer checkout redirects to Stripe-hosted Checkout. Cookies or storage used on Stripe’s separate checkout domain are controlled by Stripe. The Workforce Toolbox pages do not add Stripe browser storage.

Secure delivery links carry the download credential in the URL fragment. The fragment is captured in transient page state, removed from the visible URL, and sent in the body of a same-site request to prepare the authorised download. The credential is not stored in an application cookie, localStorage or sessionStorage. The recovery form also uses transient form state only.

This notice and the technical audit will be reviewed before any future advertising, personalisation or other material optional browser technology is introduced.

• ICO: Cookies and similar technologies
• ICO: Storage and access technologies guidance