Cookie policy.

“Cookies” is the everyday shorthand for a family of technologies that let a website or application remember something about your device or your visit. In this policy, when we say “cookies” we mean all of the following, and we treat them the same way for consent purposes:

Cookies

Small text files placed on your device by your browser when you visit a website. They can be read back by the site that set them (and, in the case of third-party cookies, by other domains embedded in the page) on later visits.

localStorage and sessionStorage

Browser storage mechanisms that work like cookies but are not sent with every network request. We use localStorage, for example, to remember your cookie choice under the key thornbridge.cookie-consent. sessionStorage works the same way but is cleared automatically when you close the browser tab.

Pixels and tags

Tiny, often invisible, images or snippets of code that record that a page or email was opened. We do not currently deploy tracking pixels on the public website; if that changes, this policy and the cookie table below will be updated first.

SDKs

Software libraries embedded in an application (for example, in the secure client dashboard) that can read and write device storage or make network calls on our behalf. Any SDK we use is governed by the same consent choices described in this policy.

Fingerprinting

A technique for inferring a probable identity from characteristics of your device and browser (such as screen size, fonts and time zone) without storing anything locally. We do not use fingerprinting to identify or track visitors, and we do not intend to.

We use cookies and the technologies above for four purposes only:

• To make the site and platform work. Keeping you signed in, remembering your cookie choice, and protecting forms and sessions from tampering.
• To understand how the site is used. Aggregated, non-identifying measurement of which pages are useful and which are confusing, so we can improve them.
• To remember your preferences. Small quality-of-life settings such as dismissed messages or saved filters, so the site feels consistent between visits.
• To measure whether marketing activity works. Understanding whether a campaign, referral or advert led to a demo request, so we know where to invest.

We do not use cookies to build advertising profiles for sale to third parties, and we do not sell personal data.

We also apply a “privacy by default” approach to how we design these technologies in the first place. Wherever there is a choice between a cookie-based and a cookie-free way of achieving the same outcome, we prefer the option that stores less on your device. Where a cookie is genuinely required, we scope it as narrowly as we can, for example, storing a category flag rather than a detailed profile, and we avoid combining data across categories unless you have separately consented to each one. This means that, in practice, most visitors who decline every optional category will experience a site that stores almost nothing beyond the record of that decision itself.

In the United Kingdom, cookies are regulated by two overlapping regimes, and we apply both:

Regulation 6 of the Privacy and Electronic Communications Regulations (PECR)

PECR reg 6 says that, subject to a narrow exemption, you must consent before we store or access information on your device. It also requires that you are given clear and comprehensive information about what the cookie does before you consent.

The UK GDPR standard of consent

Where PECR requires consent, that consent must meet the UK GDPR standard: it must be freely given, specific, informed and unambiguous, expressed by a clear affirmative action. Silence, pre-ticked boxes, or inactivity do not count as consent, which is why our banner never pre-selects optional categories.

ICO guidance

We have designed our banner and preference centre with reference to the Information Commissioner’s Office’s guidance on the use of cookies and similar technologies, including its expectations that rejecting non-essential cookies should be no harder than accepting them, and that continuing to browse should never be treated as consent.

The strictly necessary exemption

PECR contains a narrow exemption for cookies that are strictly necessary to provide a service you have explicitly requested, for example, a cookie that keeps you signed in once you have logged in, or one that remembers the cookie choice you have just made. We rely on this exemption only for the strictly necessary category set out below; everything else requires your consent.

How PECR and UK GDPR fit together

PECR is the specific rule about storing or accessing information on your device, and it borrows the UK GDPR’s definition and standard of consent when consent is the route we rely on. Once information collected through a cookie relates to an identified or identifiable person, the UK GDPR also applies in its own right to how we process that information afterwards, for example, the principles of purpose limitation, data minimisation and storage limitation set out in our privacy policy. We treat both regimes as complementary rather than a choice between one or the other: PECR governs the act of placing or reading the cookie, and the UK GDPR governs what we then do with any resulting personal data.

Accountability and evidencing consent

Both regimes place the burden of proof on us, not on you: it is our responsibility to be able to demonstrate, if asked by the ICO or a visitor, that a particular consent was validly given, what it covered, and when it was withdrawn if applicable. That accountability principle is the reason the consent record keeping described in section 7 exists, it is not optional bookkeeping, it is how we discharge a legal obligation that sits on us rather than on you.

When you first visit the site, or whenever the notice version changes, you will see a banner offering three choices: Accept all, Reject non-essential, and Manage preferences. Rejecting is exactly as easy as accepting, a single click, in the same size and prominence, in the same step. There is no separate page you have to navigate to in order to say no.

The preferences dialog shows each optional category with a toggle switch that starts in the off position. Strictly necessary cookies are shown for transparency but cannot be switched off, because the site cannot function without them. No box is ever pre-ticked on your behalf; every optional category defaults to off until you actively turn it on.

You can reopen this dialog at any time, from this page, from the site footer, or from anywhere the “manage cookie preferences” control appears:

We group every cookie and similar technology we use into one of four categories, mirroring the structure of our consent banner and preference centre. Only the first is exempt from consent; the other three are always off until you switch them on, and each can be switched on or off independently, accepting analytics does not imply accepting marketing, and vice versa.

Strictly necessary

These keep the site and the secure client platform working: signing you in, protecting forms from cross-site attacks, load-balancing, and remembering the cookie choice you have just made. They cannot be switched off in our preference centre because there is no way to provide the service without them. If you block them at browser level instead, sign-in, the demo request form, and other core functions will stop working correctly.

Analytics

Off by default. When switched on, these help us understand aggregated usage patterns, which pages are visited, in what order, and whether a visit results in a demo request, so we can make the site more useful. If you decline this category, we simply have less visibility into how the site performs; nothing on the site stops working for you.

Preferences

Off by default. When switched on, these remember small quality-of-life choices, for example, a message you have dismissed or a filter you have saved, so you don’t have to repeat yourself on every visit. If you decline this category, the site will still work, but it will not remember these small choices between visits.

Marketing

Off by default. When switched on, these help us measure whether a campaign, referral or advert led to a demo request, so we know which channels are worth continuing to invest in. If you decline this category, you will see exactly the same content and pricing; we simply won’t be able to attribute your visit to a particular campaign.

Summary: what happens if you decline

In every optional category, declining means the same three things: the cookie or storage item in question is never set on your device; nothing about your visit is added to the relevant aggregate measurement; and no functionality that a reasonable visitor would expect from a marketing website is lost. The only category where declining has a functional effect is strictly necessary, and even then only if you block it at browser level rather than through our preference centre, since we do not offer a way to disable it from our side.

This table lists the storage items we currently use. We keep it up to date; if a new cookie is introduced, it will appear here before it is set (or, for optional categories, before it can be set).

To demonstrate compliance to a regulator, and to make sure we honour the choice you actually made, we keep a server-side audit log of consent decisions in addition to the copy stored in your browser under thornbridge.cookie-consent. Each log entry records:

• A pseudonymous consent identifier, generated on your device, not your name, account or email address.
• The decision itself: which categories you accepted (accept all, reject non-essential, or a custom combination saved from the preference centre), or that consent was withdrawn.
• The timestamp of the decision.
• The notice version you were shown when you made the decision, so we can always reproduce the exact wording you agreed to.
• A truncated IP address and user agent string, used solely to detect abuse of the consent logging endpoint and to support the audit trail, not to identify you individually.

Where you withdraw consent for a category you had previously accepted, that withdrawal is logged as its own record rather than silently overwriting the earlier entry, so a refusal is never hidden inside a later decision.

We keep these audit records for as long as reasonably necessary to demonstrate compliance with PECR and UK GDPR, typically for the life of the consent plus a limited retention period afterwards, and then delete or anonymise them. Full detail on how we handle personal data generally, including these records, is in our privacy policy.

Why we log the notice version

Cookie notices are not static; wording is clarified, new purposes are added, and providers change over time. If we only recorded “analytics: yes” without also recording which notice you were reading when you said yes, we would have no way of proving what you were actually told, and a consent recorded against out-of-date wording is not a valid consent at all. Tying every decision to a specific, immutable notice version lets us reconstruct, at any later date, precisely what a visitor saw and agreed to.

Why we truncate the IP address and user agent

A full IP address, combined with other information, can identify an individual or a household. We do not need that level of precision to run an audit trail or spot abuse of the consent logging endpoint (for example, a script submitting large volumes of fake consent events), so we truncate the IP address and store only enough of the user agent string to distinguish broad categories of device and browser. This is a deliberate data minimisation choice: we collect the least amount of information that still lets us meet our accountability obligations under PECR and the UK GDPR.

Why the consent identifier is pseudonymous

The consent identifier is generated on your device and stored alongside your cookie choice; it is not derived from your name, account, email address or any other directly identifying attribute. Its only job is to let us link together the sequence of decisions made from the same browser (for example, an initial reject followed by a later opt-in to analytics) without needing to know who you are. If you use a different browser or device, or clear your storage, a new identifier will be generated the next time you make a choice.

Your consent choice is stored locally and is tied to the version of the consent notice you were shown. If we materially change the purposes, categories or wording of that notice, the stored notice version number changes, and the banner will appear again on your next visit so that your consent always matches what you were actually told. Simply rewording a sentence without changing the substance does not usually trigger a re-prompt; adding a new category or provider does.

Aside from a notice-version change, your consent otherwise persists in your browser until you clear your browser storage, use a different device or browser, or actively change your choice through the preference centre.

On this site

The quickest way to withdraw or change consent is through our own preference centre, available at any time from this page or the site footer:

Turning a category off there stops any further cookies in that category being set and is recorded as a withdrawal in our consent log, as described above.

Through your browser

You can also block, delete or be notified about cookies directly in your browser. Because this operates below our preference centre, it will not update our records, but it will prevent the cookies from being stored on your device. Broadly:

• Chrome (desktop): Settings → Privacy and security → Cookies and other site data, where you can block third-party cookies, delete existing cookies, or add site-specific exceptions.
• Safari (macOS): Safari → Settings → Privacy, where you can manage website data and choose to block all cookies.
• Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data, where you can clear data or set enhanced tracking protection to block third-party cookies.
• iOS (Safari): Settings app → Safari → Advanced → Website Data, or Settings → Safari → Block All Cookies.
• Android (Chrome): Chrome app → menu → Settings → Privacy and security → Clear browsing data, or Cookies to manage site-specific permissions.

Because menu names change between browser versions, treat the above as a starting point rather than exact wording, and consult your browser’s own help pages if the labels differ. Remember that blocking strictly necessary cookies at browser level will prevent sign-in and the demo request form from working correctly, even though we cannot turn that category off from our side.

What withdrawal does and does not undo

Withdrawing consent takes effect immediately going forward: no further cookies in that category will be set, and the change is recorded in our audit log as described in section 7. It does not, by itself, retroactively delete aggregated statistics that have already been generated from earlier, consented activity, because those statistics no longer identify you individually once aggregated. If you would like us to consider a specific request relating to personal data collected before you withdrew consent, you can contact us using the details in section 16, or exercise your rights as described in our privacy policy.

Some browsers send a “Do Not Track” (DNT) signal, and some send a Global Privacy Control (GPC) signal, indicating that you do not wish to be tracked. There is no single agreed technical or legal standard for how sites should respond to these signals, and our platform does not currently parse or act on them automatically. The most reliable way to express your choice on this site is through our preference centre described above, which we do read and respect immediately.

Most of the cookies described in this policy are first party, set directly by us, or by a processor operating strictly on our instructions and under contract. Where a page embeds third-party content (for example, a video or a scheduling widget), that provider may set its own cookies once you interact with the embedded content, under its own privacy and cookie notices, which we encourage you to review. We do not embed third-party advertising content on the public site.

Where we do use a processor to help operate an optional category, for example, to store or process analytics events on our instructions, that processor acts solely on our behalf, under a written contract that restricts it to our purposes, and is subject to the safeguards described in our data processing agreement. We do not permit a processor to use cookie data collected on our site for its own independent purposes, and we do not currently rely on any third-party advertising network to serve or measure cookies on the public website.

This policy covers both our public marketing website and the secure, authenticated client platform. The two use cookies for slightly different reasons:

• On the public website, cookies are mostly about your cookie choice itself, plus, if you opt in, analytics and marketing measurement.
• On the authenticated platform, session and authentication cookies are strictly necessary to keep you signed in securely and to protect your organisation’s data; optional categories operate under the same consent choices described here.

For how we handle account and customer data more broadly within the platform, see our privacy policy, our data processing agreement, and our security page.

Our site and platform are intended for business users and are not directed at children. We do not knowingly set marketing or analytics cookies in connection with children’s use of the service.

We will update this page whenever the cookies we use, or the law that governs them, changes. Material changes to the underlying consent notice will also trigger a fresh banner, as described in “Consent lifetime and re-prompting” above, so your recorded consent always matches what you were told at the time.

If you are unhappy with how we use cookies, please contact us first using the details below so we can put it right. You also have the right to complain to the UK’s independent regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or on 0303 123 1113.

Questions about this policy, or about a specific cookie, can be sent to hello@thornbridgesolutions.com. For related documents, see our privacy policy, our data processing agreement, and our security page.