Cookie Notice
Last updated: 24 August 2026 · Consent policy version 1
What cookies and similar technologies are
Cookies are small text files stored on your device by a website. Similar technologies — such as localStorage, sessionStorage and tracking pixels — also store or read information on your device. This notice covers all of them.
What we actually use
This website currently runs no analytics, no advertising pixels, no tag manager, no session replay and no social-media trackers. The only technologies in use are the strictly necessary ones listed below, plus one functional cookie that exists only inside our private staff admin area.
If we ever add an optional technology, it is blocked by our consent manager until you switch on the matching category — it will not load, set storage, or send any request beforehand.
Categories we use
- Strictly necessary (no consent required): These technologies keep the website secure and working: remembering your privacy choice, keeping you signed in if you use the admin area, and restoring your scroll position. They are exempt from consent because the site cannot provide the service you asked for without them.
- Functional / preferences (consent required): Used to remember non-essential preferences (for example interface choices) so you do not have to set them again. The site works fully without them.
- Analytics / performance (consent required): We currently run no analytics tools at all. If we ever add one, it will not load, set storage, or send any request until you switch this on here.
- Advertising / marketing (consent required): We currently run no advertising pixels, remarketing tags or tracking pixels. If we ever add one, it stays blocked until you switch this on.
- Personalisation (consent required): Used to tailor content or recommendations. We currently do no profiling or personalisation of any kind.
Cookie and storage inventory
Compiled from a source-code audit and a live browser audit of cookies, localStorage, sessionStorage and outgoing network requests.
| Name | Provider | Purpose | Category | Duration | Type | Consent required |
|---|---|---|---|---|---|---|
| hje_consent | HJE Group (this website) | Stores your cookie choices per category, plus the timestamp and policy version, so we can respect and evidence your decision. | Strictly necessary | 6 months | HTTP cookie · First party | No |
| tsr-scroll-restoration-v1_3 | HJE Group (this website) | Restores your scroll position when you navigate back through pages. Set by the site's router. | Strictly necessary | Cleared when the browser tab closes | sessionStorage · First party | No |
| sb-<project>-auth-token | Supabase (backend provider) | Keeps a signed-in staff user authenticated in the private admin area. Only created after a successful sign-in. | Strictly necessary | Until sign-out or session expiry | localStorage · First party | No |
| sidebar_state | HJE Group (this website) | Remembers whether the admin sidebar is expanded. Only ever set inside the signed-in admin area, never on public pages. | Functional / preferences | 7 days | HTTP cookie · First party | No |
Third-party services that receive data
- Supabase — Database, authentication and API hosting for site content and enquiries. Data shared: Enquiry name, email, phone, service interest, message; staff account email; connection IP addresses in provider logs. Privacy information: https://supabase.com/privacy
- Lovable (hosting / CDN) — Website hosting, image asset delivery and TLS. Data shared: IP address, user agent and requested URL, in standard server logs. Privacy information: https://lovable.dev/privacy
- Unsplash — Stock photography image CDN. Data shared: Your IP address and browser user agent, as part of the image request. Unsplash sets no cookies on our domain and none were observed in the runtime audit. Privacy information: https://unsplash.com/privacy
Changing or withdrawing your consent
Use “Cookie settings” in the footer of any page, or the button below. Withdrawing consent is as easy as giving it. When you withdraw a category we stop using it immediately and delete the optional first-party cookies we control for that category. We cannot delete cookies set on another company's own domain from here — you can remove those through your browser settings.
Your choice is stored in the "hje_consent" cookie for 180 days, together with the time of your decision and the policy version, so we can respect and evidence it. It contains no identifier and no personal data. If we materially change how we process data we will raise the policy version and ask again.
If your browser sends a Global Privacy Control signal and you have not already made a choice, we record that as a rejection of all optional categories.
Limitations of this notice
This inventory is built from what we can verify in our own code and in a live browser audit. Some cookies can be set server-side, only in certain countries or browsers, or only after specific interactions. If you find something not listed here, please tell us using the contact details in our Privacy Notice and we will investigate and update this page.