Cookie Policy

1. What cookies are

A cookie is a small text file that a website asks your browser to store and to send back on subsequent requests. They are how a site remembers that you are logged in, what is in your basket, or which options you selected. Similar technologies — local storage, session storage, pixels, fingerprinting scripts — do comparable things by other means, and the law generally treats them the same way.

Under the ePrivacy Directive as implemented across the EEA, and under the equivalent UK regulations, a website may store or access information on your device without consent only where it is strictly necessary to provide the service you have requested. Everything else — analytics, advertising, personalisation, social widgets — requires your prior, informed, freely given consent, obtained before the technology loads.

2. What this site sets

Nothing. yachtwebsite.com is a static website. It sets no first-party cookies of any kind: no session cookie, no preference cookie, no consent cookie. It runs no analytics platform, no tag manager, no advertising pixel, no heat-mapping tool, no A/B testing script and no social media widget.

This is a deliberate design decision rather than an oversight. It means we cannot tell you how many people read a particular page, and we accept that trade. It also means you will not see a consent banner here, because there is nothing to consent to — and a banner that asks permission for nothing is theatre rather than compliance.

Category	Used on this site	Consent required
Strictly necessary	None	—
Functional / preference	None	—
Analytics and performance	None	—
Advertising and targeting	None	—
Social media embeds	None	—

3. No third-party requests

Most sites that claim to set no cookies still leak data, because a cookie is not the only way a visitor is disclosed to somebody else. Every request your browser makes to another company’s server hands that company your IP address, the page you are reading, and your browser and operating system — whether or not a cookie is involved. An IP address is personal data under the GDPR, so those requests matter.

This site makes none of them. Specifically, and deliberately:

• No hosted web fonts. The typefaces here are the ones already installed on your device. Nothing is fetched from Google Fonts, Adobe Fonts or any other font service. This is the single most common way an otherwise clean site discloses its visitors, and a German court has held that embedding hosted fonts without consent can infringe the GDPR.
• No content delivery network. No jQuery, no icon library, no framework pulled from a public CDN. The two asset files this site loads — one stylesheet and one script — are served from this domain.
• No embedded maps, video or chat. An embedded map or video player loads third-party code that can identify a logged-in user before they click anything.
• No fonts, images or icons hotlinked from elsewhere. Every image on this site is a vector file served from this domain.

The practical result is that reading this site tells nobody but our own host that you were here. That is a deliberate engineering choice with a real cost — it rules out a number of convenient tools — and it fits an educational site that values reader privacy.

4. Local storage and similar technologies

This site uses no localStorage, no sessionStorage, no IndexedDB and no service worker. The small amount of JavaScript that runs here handles animation, the mobile menu, the accordions and client-side validation of the enquiry form. It stores nothing on your device and transmits nothing anywhere.

The enquiry form on our contact page transmits the information you type only when you submit it, and only to us. It does not save drafts, and it does not report on what you typed and then deleted.

5. Server logs

Separately from cookies, our hosting provider records standard access logs for every request: IP address, timestamp, the resource requested, HTTP status, referrer and user agent. This is not tracking — it is how any web server operates, and it is how we identify outages and abuse.

We rely on our legitimate interest in keeping the site available and secure (Article 6(1)(f) GDPR). Logs are retained for 90 days and then deleted. They are not combined with any other data set, not used to build profiles, and not shared with anyone except where we are legally compelled to disclose them.

6. The categories, defined

Because the table in section 2 reads as a list of absences, it is worth setting out what each category would mean if it were present. These are the definitions we would apply, and they follow the classification used by most European supervisory authorities.

• Strictly necessary. Required to deliver a service you explicitly asked for — keeping you logged in, remembering a basket, balancing load across servers, or recording that you dismissed a consent banner. Exempt from the consent requirement, but only genuinely so; a cookie is not strictly necessary merely because the site owner finds it useful.
• Functional or preference. Remembers a choice you made — language, region, dark mode, a closed notice. Improves the experience but the site works without them, so consent is required.
• Analytics and performance. Counts visitors, measures which pages are read and how far people scroll. Consent is required even where the data is aggregated, unless the analytics is genuinely anonymous, first-party and configured so that no individual can be singled out — a narrow exemption that most implementations do not meet.
• Advertising and targeting. Builds a profile across sites in order to select advertising, measure campaigns or exclude existing customers. Always requires consent, and typically involves transfers to a large number of third parties.
• Social media embeds. An embedded video, feed or share button loads code from the platform, which can identify a logged-in user before they interact with anything. Treated as third-party tracking and requires consent.

Cookies also differ by lifespan. A session cookie is deleted when you close the browser; a persistent cookie survives until its expiry date, which may be minutes or years. Supervisory authorities generally expect consent to be refreshed at least every twelve months, and expect persistent cookies to have a lifespan proportionate to their stated purpose rather than a default of two years because that is what the vendor shipped.

7. Cookies you may meet elsewhere

Two things on this site take you off it, and once you leave, this policy stops applying.

The social media icons in the footer are ordinary links, not embeds — no platform code runs on this site and nothing is loaded from Instagram, LinkedIn or YouTube until you actually click. When you do, you are on their property and subject to their cookie and privacy practices, which are considerably more extensive than ours.

Similarly, if a broker sends you a link to a central agent’s listing, a vessel brochure hosted elsewhere, or a document-signature platform, those services set their own cookies under their own policies. We choose counterparties with reasonable data practices where we have a choice, but we do not control them and cannot make representations on their behalf.

8. Controlling this

Because we set nothing, there is nothing here for you to switch off. You retain full control regardless:

• Every major browser lets you block or delete cookies for individual sites or globally, under Settings — Privacy. Blocking cookies entirely will not affect this site.
• Private or incognito browsing discards all storage at the end of the session.
• A content blocker or a browser extension that blocks third-party requests will prevent the Google Fonts connection described in section 3. The site is designed to degrade gracefully: the layout, colour and spacing are unaffected, and the text falls back to high-quality system typefaces.
• We honour the Global Privacy Control and Do Not Track signals by default, in the sense that there is no tracking here to disable.

9. If this changes

If we later add anything that stores or accesses information on your device beyond what is strictly necessary, we will update this page, raise the version number, and implement a consent mechanism that meets the standard the law actually requires: no non-essential technology loading before consent; reject as easy as accept; granular choice by category; and withdrawal as straightforward as the original agreement. We will not use a banner that treats continued scrolling as agreement, because that is not consent.

This policy should be read alongside our Privacy Policy and GDPR & Your Rights page. Questions to info@yachtwebsite.com.