Cookie policy

1. Cookies and similar technologies

Cookies are small text files stored on your device when you visit a website. Alongside cookies, this site uses two storage mechanisms provided by your browser:

• localStorage — keeps information until it is explicitly removed, either by the site or by you;
• sessionStorage — keeps information only until you close the tab or the browser.

We treat these under the same consent logic as cookies. What matters is the purpose the information serves, not the technical mechanism that holds it.

2. The three categories

The site uses exactly three categories. There are no sub-categories and no separate per-provider switches.

a) Necessary — always active

Required for the correct and secure operation of the site, and for remembering your decision about the other two categories. They cannot be switched off, because without them the site could not even remember a refusal.

This category includes nvm_consent, the localStorage value that holds your choice. It records the consent schema version, the fact that you made a decision, one yes/no value each for Analytics and Marketing, and when you decided. It contains no name, email address or other personal identifier.

b) Analytics — optional, off by default

Helps us understand how the site is used and improve the experience. This category controls audience measurement only. It switches on nothing related to advertising.

c) Marketing — optional, off by default

Helps us measure campaign effectiveness and understand which source brought a visitor to the site. This category controls the advertising signals, HubSpot's in-browser tracking, and the retention of campaign information.

Both optional categories are off until you switch them on. They are independent: you may accept Analytics without Marketing, Marketing without Analytics, both, or neither.

3. What each category switches on

Analytics

• Google Analytics 4 — audience measurement. Cookies: _ga, _ga_<identifier>, _gid.
• The Google signal analytics_storage is set to granted.
• Our own site-usage events (a form being shown or submitted, a click on a primary button) are sent to Google Analytics. Without Analytics consent, these events are not sent at all.

Marketing

• Google Ads — campaign measurement. The Google signals ad_storage, ad_user_data and ad_personalization are set to granted. Cookies: the _gcl_* family.
• HubSpot — the in-browser tracking script. Cookies: hubspotutk, __hstc, __hssc, __hssrc.
• Campaign information, described in section 4.

Without Marketing consent none of this is activated: the HubSpot script is not loaded, the advertising signals stay denied, and campaign information is not retained.

4. Campaign information (attribution)

When you reach the site from a campaign, the address may carry parameters describing the source: the utm_* parameters and advertising click identifiers such as gclid (Google), fbclid (Meta) and li_fat_id (LinkedIn).

Only with Marketing consent are these values retained in your browser, in two places:

• nvm_utm_first (localStorage) — the first source that brought you to the site. Written once and never overwritten.
• nvm_utm_last (sessionStorage) — the most recent source. Refreshed on each visit carrying parameters, and gone when the browser closes.

Stored alongside them are the address of the page you landed on, its title, and the moment of capture. The purpose is to understand which campaigns produce genuine enquiries.

If you have not given Marketing consent, these parameters may be read from the page address during the current visit, but they are not saved, not transmitted anywhere, and are lost when the page is reloaded or left.

5. Forms work regardless of your choices

This is an important distinction, and we treat it as a fixed rule of the site.

When you complete and submit a form — an enquiry, a request for a document, a flow assessment, or a newsletter subscription — that request is processed whether you refused Analytics, Marketing, or both. The data you deliberately entered reaches us, and you receive the reply, the material or the confirmation you asked for.

Optional consent changes one thing only: the additional information attached to the request. Without Marketing consent, the form does not transmit the HubSpot visitor identifier and does not transmit the campaign information described above. The request itself is transmitted exactly the same way.

Submitting a form does not change your cookie choices, and refusing cookies does not block any form.

6. Newsletter — your request, not a cookie setting

Subscribing to the newsletter is an explicit request you make by submitting the form on the subscription page. It is not derived from Marketing consent and does not depend on it.

The subscription form is hosted by us rather than loaded through an external provider's script, and it stays visible and usable in every situation, including when you have refused both optional categories. The subscription request is transmitted to HubSpot, the provider through which we manage the newsletter list.

You can unsubscribe at any time using the link in any email you receive. Unsubscribing and withdrawing cookie consent are different, independent actions.

7. Making and changing your choices

On your first visit, a bar appears at the bottom of the page. It does not block access to the content. Two actions are available directly: Accept all and Settings.

Under Settings you see all three categories and have three actions:

• Save preferences — applies exactly the combination you selected;
• Reject optional — Analytics and Marketing stay off, Necessary stays active;
• Accept all — both optional categories are switched on.

The Necessary category is shown as "Always active" and has no toggle, because it cannot be switched off.

Once you have decided, you can revisit that decision at any time through the Cookie settings link in the footer of every page. The panel reopens with your current choices, and any change takes effect immediately.

8. What happens when you withdraw consent

Withdrawal does not only stop what comes next; it also removes what was kept, to the extent the site can do so from the browser.

If you withdraw Marketing: the advertising signals are set to denied; the campaign information (nvm_utm_first, nvm_utm_last) is deleted and is no longer available to forms; the _gcl_*, hubspotutk, __hstc, __hssc and __hssrc cookies are removed; and if the HubSpot tracking script had been loaded, the page reloads once to clear it completely.

If you withdraw Analytics: the analytics_storage signal is set to denied, events to Google Analytics stop, and the _ga, _ga_<identifier> and _gid cookies are removed.

If you withdraw both: both sets of effects apply.

Withdrawing one category does not affect the other, and forms remain functional in every case.

Removal happens through the browser and is limited to what is technically reachable from there. Cookies marked HttpOnly, or set by third parties outside the page's reach, cannot be removed by the site. You can always clear cookies and site data manually in your browser settings.

9. Third-party services and the Google tag library

The providers that may receive data in the context of this site are Google (Google Analytics and Google Ads), HubSpot (in-browser tracking under Marketing and, separately, the processing of forms you submit) and Cloudflare (hosting the site and running the functions that process form submissions).

For transparency, one technical point: the Google tag library is loaded on pages regardless of your decision. However, before any initialisation, the site sends a set of consent signals in which all four signals — analytics_storage, ad_storage, ad_user_data, ad_personalization — are denied. They are set to granted only after your decision, and only for the corresponding category. The HubSpot tracking script, by contrast, is not loaded at all without Marketing consent.

Each provider also processes data under its own policies. For how we process personal data, see the Privacy policy.

10. How long information is kept

For the site's own storage, the position is as follows:

• nvm_utm_last exists only for the duration of the browser session;
• nvm_consent and nvm_utm_first have no expiry set in the site's code. They persist until you withdraw consent (at which point nvm_utm_first is deleted) or until you clear site data in your browser.

The lifetimes of the Google and HubSpot cookies are set by those providers, not by the site, and can be changed by them. We do not publish exact durations we do not control.