Cookie Policy

A cookie is a small text file a website asks your browser to store and return on later requests to that site. That is the only purpose it serves: it lets a site remember something about a visit without the site having to build a database entry for it.

The same legal rules are generally applied to a small number of other technologies, and this policy treats them the same way: localStorage and sessionStorage, which store data inside your browser rather than in a cookie; pixels and beacons embedded in images, which record that something was loaded; and device fingerprinting, which derives an identifier from the characteristics of your browser and operating system.

This site uses none of these either. It has no third-party embeds, no embedded video players, no live chat widget, no font or map or social plugin served from another company’s domain. Every asset that makes up a page — stylesheet, script, icon — is served from webnuvexa.com itself.

• One cookie is set, and it is essential. It is the standard PHP session identifier. Without it the forms cannot submit safely, so it is exempt from consent.
• No analytics cookies. There is no analytics script on this site. We do not know how many pages you have read or where you came from.
• No advertising cookies. No ad networks, no remarketing, no interest-based advertising, no ad exchange.
• No third-party cookies at all. Nothing we load is served by another company, so nothing another company can set.
• No cookie banner. Because there is nothing optional to ask about. That will change only if an optional cookie is introduced, and the banner will ship first.

How it is protected

• HttpOnly is set, so page scripts cannot read the cookie and a cross-site scripting flaw cannot exfiltrate it.
• SameSite=Lax is set, so it is not attached to cross-site requests, which is what blocks cross-site request forgery.
• Secure is set automatically whenever the page is served over HTTPS, so it is not transmitted over an unencrypted connection.
• The cookie contains only an opaque random identifier. It carries no name, no email address, no identifier that means anything outside our own server, and no tracking payload.

Strictly necessary

Cookies required for the site to deliver a function you have asked for: keeping you signed in, remembering a form you have partly filled in, carrying a security token, remembering your cookie choices. These cannot be switched off without breaking the feature they support, which is why they do not require consent.

On this site: the session cookie in section 3. That is all of it.

Analytics

Cookies that measure how people use a site: which pages are read, which are ignored, what someone searched for, roughly where traffic came from. Useful for deciding what to write about next. Not required for the site to work.

On this site: none. If analytics were ever added — [ANALYTICS PROVIDER, IF ANY] — they would be configured to respect consent, and this section would list the cookie names, purposes and retention before it was deployed.

Advertising and marketing

Cookies used to build a profile of you across different websites so that advertising can be targeted, to measure whether an advert led to a visit, or to limit how often you see the same advert.

On this site: none. WebNuvexa does not run advertising pixels, does not use remarketing, and does not buy or sell behavioural data. See the Privacy Policy for the wider statement on that.

5.1 Today: nothing to consent to

Because the only cookie this site sets is strictly necessary, no consent is required and no consent banner is displayed. Showing one would be theatre: it would ask you to agree to something we are already entitled to do, and it would train you to dismiss the banner without reading it — which is the opposite of what consent is for. We would rather not have one until it means something.

5.2 If that changes

The rule is simple and we are committing to it in writing:

1. A real consent mechanism ships before any non-essential cookie is deployed — not in the same release, and not afterwards.
2. Until you actively opt in, non-essential cookies are blocked. Loading them anyway and offering a “reject” button later is not consent, and we will not do it.
3. You are asked separately about each purpose, with a genuine “reject all” option that is as easy to use as “accept all”, and a way to change your answer afterwards.
4. Your choice is recorded so we can demonstrate it, and it is kept only as long as needed to honour it plus prove we honoured it.
5. This policy and the Privacy Policy are updated before the cookie appears, with the vendor, the cookie names and the purposes named explicitly.

The mechanism we would use is not yet confirmed: the consent mechanism actually in use. It is not deployed, and this section describes the standard we will meet rather than a system you can currently interact with.

Today there is no consent to withdraw, because nothing optional is in use. Consent to strictly necessary cookies is not withdrawable in any practical sense: refusing it means the contact forms, the request-a-quote form and the form error handling do not work.

If optional cookies are ever introduced, the following will apply from day one:

• Withdrawal is as easy as granting consent: a control on this page, plus a link in the footer of every page, both of which reopen the banner. Neither is buried more than one click away.
• Withdrawing consent stops the relevant processing from that moment forward. It does not and cannot retrospectively make processing that already happened unlawful, and we will not pretend otherwise.
• Some features may stop working when you withdraw — for example, content personalised using an optional storage mechanism. We will say which ones, before you withdraw.
• Withdrawing does not affect your ability to browse, to read, or to send us an enquiry. Nothing essential is gated behind a marketing decision.
• Your email preferences are separate and independent. Unsubscribe from marketing in any email we send; that is unrelated to cookies and unrelated to any service message about work you have asked us about.

7.1 Clearing or blocking cookies for this site

Every current desktop and mobile browser lets you see and delete cookies for a specific site, and lets you block them. Look in the browser’s settings under a heading similar to “Privacy and security”, then “Cookies and other site data”, “Site settings” or “Permissions”.

7.2 What happens if you block the one cookie we set

Expect the forms to fail. The anti-forgery token lives in the session, so blocking the session cookie means the server cannot recognise the submission and will reject it with a message asking you to reload and try again. Rate limiting and the “thank you” message after a submission will not work either.

Nothing else on the site depends on it. Every page, every article and every legal document renders and reads normally with the cookie blocked, because the content is generated on the server rather than assembled by JavaScript.

Blocking all cookies, or using a private or incognito window, will also stop you being able to submit a form successfully. If you are reading this from a private window and want to contact us, email hello@webnuvexa.com instead.

Do Not Track (DNT) was proposed as a universal browser switch asking sites not to track users across sites. It never became a standard the web adopted: browsers ship the setting and few sites act on it, and there is no agreed behaviour for what a site should do when it is enabled.

Global Privacy Control (GPC) is the same idea with more momentum, principally in US states with specific privacy legislation. It is legally significant in the jurisdictions that recognise it.

What we do: we do not track you across websites, so there is nothing for either signal to switch off. We do not currently treat either header as a consent decision, because we are not asking for consent to anything optional. If optional cookies or analytics are ever introduced, the default will be off for everyone and a signal such as GPC will be honoured as “do not enable optional cookies”. We will not treat a signal as “enable”, because silence cannot be consent.

If you believe a signal was not honoured when it should have been, tell us at hello@webnuvexa.com. See also the Acceptable Use Policy, which explains how we handle automated traffic generally.

This policy changes when the technology changes. When we add or remove a cookie we will update the table in section 3, change the “Last updated” date at the top of the page, and — where the change adds a new non-essential cookie — put the consent mechanism in place before the cookie ships, as set out in section 5.

We review this policy at least once every 12 months, and whenever the site’s technology stack changes materially. A review that finds nothing has changed does not need to produce an edit.

To confirm the current state yourself rather than trusting this page: open your browser’s site-data panel for webnuvexa.com while the tab is open. That shows what is actually stored, which is the version that matters.

• Operator: not yet confirmed: the registered legal entity name, established in not yet confirmed: the country of establishment
• Email: hello@webnuvexa.com
• Full data rights: see Privacy Policy, section 8

If you found a cookie on webnuvexa.com that is not in the table in section 3, that is a bug worth telling us about — please include the cookie name and the page you saw it on. Cookie questions about your data generally, including access and deletion requests, belong with your Privacy Policy enquiry.