Cookie notice

A cookie is a small text file placed on your device when you visit a website. Similar technologies include local storage, session storage, software development kits inside a mobile application, pixels and device identifiers. This notice covers all of them and uses the word "cookie" for convenience.

Cookies let a site remember that a request came from the same browser, which is what makes a signed-in session possible. They can also be used to measure how a site performs and, in some cases, to build a profile across sites. We do not use cookies to build advertising profiles.

European Union. Article 5(3) of the ePrivacy Directive, as transposed in each member state, requires your prior consent before any non-essential cookie is stored on or read from your device. Consent must be freely given, specific, informed and unambiguous, and must be as easy to withdraw as it is to give. Where a cookie processes personal data, the General Data Protection Regulation also applies.

United Kingdom. Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 applies the same consent requirement, alongside the UK General Data Protection Regulation and the Data Protection Act 2018.

United States. State privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act, and the comparable laws of Virginia, Colorado, Connecticut, Utah and other states, give you the right to opt out of the sale or sharing of personal information and of targeted advertising. We honour the Global Privacy Control signal where your browser sends it.

Elsewhere. Where local law sets a different standard, we apply the standard that gives you the greater protection.

Strictly necessary. Required for the service to function. These maintain your signed-in session, bind your session to the device you approved, protect against cross-site request forgery, balance load and enforce rate limits. They cannot be switched off, because without them the product cannot authenticate you or protect your account. Typical lifetime is the browser session, up to a maximum of thirty days for a remembered device.

Functional. Remember choices you have made, such as display language, currency display order and whether you have dismissed an informational message. Typical lifetime is up to twelve months. These are set only with your consent where consent is required.

Performance and analytics. Measure aggregate usage — pages viewed, errors encountered, time to complete a task — so we can find and fix problems. Data is aggregated and is not used to make a decision about an individual. Typical lifetime is up to thirteen months. These are set only with your consent where consent is required.

Advertising. We do not set advertising or cross-site tracking cookies, and we do not sell or share personal information for cross-context behavioural advertising.

Some cookies are set by service providers acting on our instructions, for example a content delivery network that serves static files and a service that measures reliability. Each provider is bound by contract to process data only for the purpose we specify, to apply appropriate security measures and to delete data at the end of the engagement.

Where a provider processes data outside the United Kingdom or the European Economic Area, the transfer is protected by an adequacy decision or by standard contractual clauses supplemented by a transfer risk assessment, as described in the Privacy notice.

When you first visit the site you are asked to accept or reject non-essential cookies. Rejecting is one action, not a series of them, and the choice is remembered. You can change your choice at any time from the cookie settings link in the site footer.

You can also manage cookies in your browser: every major browser lets you block or delete cookies, block third-party cookies, and clear stored data when you close the browser. Blocking strictly necessary cookies will prevent you from signing in.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Deleting cookies from a device does not delete records we hold about your account.

We review this notice at least annually and whenever we add or remove a technology. Material changes are notified in the product or by email, and the consent banner is presented again where a new non-essential purpose is introduced.

Questions about this notice, or requests relating to your privacy rights, can be sent through the Contact page. Complaints about cookie practices can also be made to your national data protection authority — the Information Commissioner's Office in the United Kingdom, or the supervisory authority of your member state in the European Union.