Legal · Cookies

Cookie policy

Last updated: 6 October 2026. This policy lists every cookie and similar item that tamazia.co.uk stores in your browser, what each one is for, how long it lasts, and whether we need your consent for it. "Similar items" means local storage and session storage, which work like cookies but are kept by your browser rather than sent with each request. It also names the scripts that run on our pages whatever you choose, including on the audit report pages we prepare for individual firms.

How we use personal data in general is explained in our privacy notice.

1. Your choice

When you first visit, a banner offers Accept all, Reject all and Manage preferences. Reject all is as easy as Accept all. There is one optional category, Analytics, and it is off until you switch it on.

If you choose Reject all, or make no choice, Google Analytics 4 and PostHog do not load on pages built from our main site template. What can still be stored in your browser is your choice and the security items in section 2, the display preference in section 3 if you use the pricing switch, and the items in section 6. Cloudflare Web Analytics still runs, and audit report pages still send some records to PostHog, as section 5 explains. The booking calendar is not part of the banner: it asks you separately, in its own place on the page, as section 7 explains.

You can change your choice at any time from Manage cookies in the site footer. If you withdraw consent, we tell the analytics tools to stop and we delete the analytics cookies and storage listed in section 4 from your browser. We keep the record of your choice, because that record is what keeps analytics off.

If your browser sends a Global Privacy Control signal and you have not yet made a choice, we record Reject all.

We ask again after 13 months.

2. Your choice and site security

We set or allow these items whatever you choose in the banner. Their purpose is to record your choice and to protect the site. These items do not need your consent, because their only purpose is to record your choice or to protect the site and the information you send us.

Name	Type	Set by	What it does	How long
`tamazia-cookie-consent`	Local storage	Us (first party)	Records your banner choice: accept or reject, which categories, and when	Until you clear it. After 13 months we treat it as expired and ask again
`__ph_opt_in_out_<project key>`	Local storage	PostHog's code, on our domain	Records whether you allowed PostHog. It exists only if PostHog has loaded at least once, and it is kept after you withdraw because it is what keeps PostHog off	Until you clear it
`__cf_bm`	Cookie	Cloudflare, on our domain	Tells people from automated traffic, to protect the site	30 minutes
`cf_clearance`	Cookie	Cloudflare, on our domain	Set only if Cloudflare shows you a security check, to record that you passed it	Up to 30 minutes

Our site footer holds a form, the briefings sign-up, so every page that shows the footer loads the Cloudflare Turnstile script from challenges.cloudflare.com, whichever choice you make. Turnstile is meant to check that a person, not a script, is sending a form. Today our server still accepts a form that arrives without a Turnstile result. Cloudflare's Turnstile privacy addendum explains what Turnstile collects.

3. Display preference

Its only purpose is to make the pricing section show what you chose. It is stored only when you click the pricing term switch, whatever you chose in the banner. This item does not need your consent, because its only purpose is to make the site show what you chose, and you can object free of charge as this section explains.

Name	Type	Set by	What it does	How long
`tamazia_pilot`	Local storage	Us (first party)	Remembers whether you chose the six-month or the rolling view of our prices	Until you clear it

If you do not want it stored, do not use the switch. You can delete it at any time, free, by clearing site data for tamazia.co.uk in your browser.

4. Analytics, only with your consent

None of these loads until you choose Accept all or switch Analytics on.

Name	Type	Set by	What it does	How long
`_ga`	Cookie	Google Analytics 4, on our domain	The identifier Google Analytics gives this browser so a returning visit is counted as the same device.	400 days
`_ga_<stream>, one per data stream`	Cookie	Google Analytics 4, on our domain	Session state for one Google Analytics data stream. Compliance Radar and tamazia.co.uk each have their own stream and their own cookies.	400 days
`ph_<project key>_posthog`	Cookie	PostHog, on our domain	The identifier PostHog gives this browser, so a return visit is the same person rather than a new one.	365 days
`ph_<project key>_posthog`	Local storage	PostHog, on our domain	The same identifier, plus the session timeout and the properties registered for this visit.	Until you clear it, or the moment you switch Analytics off
`ph_<project key>_window_id, _primary_window_exists, _session_registered_properties`	Session storage	PostHog, on our domain	Tells one browser tab from another within a single visit, so two open tabs are not counted as two people.	The browser tab session

Google Analytics runs in Google's Consent Mode v2. Until you accept, every Google storage type other than security is set to denied, and when you withdraw, analytics storage is set back to denied. We tell Google that advertising storage and advertising use of the data are refused. Google Analytics data is processed by Google, and PostHog data in PostHog's EU cloud.

5. Analytics that runs whatever you choose

Cloudflare Web Analytics loads on every page built from our main site template, whatever you choose in the banner. It stores nothing in your browser: Cloudflare states that it uses no cookies or local storage and does not fingerprint visitors. It sends Cloudflare a record of each page load and how long the page took to load.

Audit report pages, which we prepare for individual firms, are built separately and show no cookie banner. When you press send on the form on one of them, your browser sends PostHog your email address, sector and the website you entered, and, if the form is accepted, your name as well. This happens whatever you chose in the banner on our other pages. Our privacy notice explains this in section 4.

6. Items we set that nothing on our site uses

We set these two items today, but no part of our site reads them, so they do nothing for you. You can delete them at any time by clearing site data for tamazia.co.uk in your browser.

Name	Type	Set by	What is in it	How long
`tz-consent`	Cookie	Us (first party)	A copy of your banner choice, accept or reject. Nothing else is in it	390 days
`tamazia_last_request_id`	Cookie	Us (first party), when you send the contact form, an audit request or the briefings sign-up	The reference number of your form. It cannot be read by scripts on the page	30 days

7. The booking calendar, which is a third party and is not loaded until you ask

Every page on this site that offers a calendar offers it as an inline frame served by Cal.com, Inc. While that frame is open your browser is talking to Cal.com directly, and Cal.com sets cookies on its own domain that this site never sees and cannot read.

Until 20 September 2026 that frame loaded on every one of those pages whether you had been asked anything or not, including after you pressed Reject all. It was measured doing so in a browser on 20 September 2026 on five routes across both sites. That is fixed rather than explained: the calendar now loads only when you press the button in its own place on the page, that press is recorded in your browser as tz-booking-embed-consent and lasts for that visit only, and every one of those pages also carries a plain link that opens the same calendar on cal.com and leaves this site instead. If you withdraw consent while the calendar is open it is removed from the page at once.

What Cal.com puts in your browser

Name	Where it is stored	Set by	What it does	How long
`__cf_bm`	Cookie on cal.com	Cal.com, Inc., through Cloudflare	Bot management for the booking calendar embedded on the demo page.	30 minutes
`__Secure-next-auth.csrf-token`	Cookie on cal.com	Cal.com, Inc.	Cross-site request forgery protection inside the booking calendar.	The browser session
`__Secure-next-auth.callback-url`	Cookie on cal.com	Cal.com, Inc.	Where the booking calendar returns you after a sign-in step, if you take one.	The browser session

This site cannot delete these. A page can only expire a cookie on its own domain, so nothing written here can remove a cookie on cal.com, and a notice that implied it could would be untrue. What this site can do is not cause them without asking you, which is now the case, and stop the frame the moment you withdraw, which is also now the case. To remove the three above, clear site data for cal.com in your own browser. Everywhere else on this page, where the storage is on this site's own domain, withdrawing consent does delete it.

What the frame contacts, which is not the same as what this site contacts

app.cal.com · Cal.com, Inc.. The booking calendar frame itself, and the small loader script that mounts it.
cal.com · Cal.com, Inc.. The calendar page the frame navigates to, and the page the plain link opens if you would rather leave this site.
o574544.ingest.us.sentry.io · Functional Software, Inc., trading as Sentry, acting for Cal.com. Cal.com's own error reporting, raised from inside the Cal.com frame. It is not this site's error tracking: no Sentry key is bound on this build, and nothing in this repository loads Sentry. It appears only while the booking calendar is open, and only because you opened it.

8. Audit report pages and paying

Audit report pages are built separately from the rest of the site. The plan section of a report loads the same booking calendar described in section 7 as soon as that section is open, and the page loads it again with your answers passed in after you send the plan enquiry form, in both cases without the button described in section 7. The cookies named in section 7 apply there too.

If you pay for an add-on from an audit report page, you are taken to a checkout page run by Stripe. Nothing from Stripe loads on our pages, and Stripe's own privacy policy covers its checkout page.

9. What we do not use

We use no advertising cookies, no retargeting and no social media tracking pixels.

10. The law, and our legal basis

The law says we must ask for your consent before we store anything on your device or read anything from it, unless an exception applies. The law does not require consent for storage that is strictly necessary to provide the service you asked for, for example to protect the information you send, to prevent fraud or to keep a record of the choices you make on a site. Nor does it require consent for storage whose only purpose is to make a site look or work the way you chose, as long as you are told clearly what it is for and given a simple, free way to object.

You can withdraw your consent at any time, and withdrawing is as easy as giving it.

Where analytics data is personal data, our legal basis for Google Analytics 4 and PostHog is your consent (UK GDPR Article 6(1)(a)). For the items in sections 2 and 3 and for Cloudflare Web Analytics, it is our legitimate interest in running a secure site that remembers the choices you made and loads quickly (UK GDPR Article 6(1)(f)). For the booking calendar in section 7, it is the consent you give by loading it (UK GDPR Article 6(1)(a)). The two items in section 6 serve no purpose today, so we do not claim a legal basis for them.

11. Clearing cookies yourself

You can delete cookies and site data at any time in your browser settings. If you clear tamazia-cookie-consent, the banner appears again on your next visit.

12. Contact

Questions about this policy: email contact@tamazia.co.uk or write to Tamazia Ltd, 124 City Road, London, EC1V 2NX.

Tamazia Ltd is registered in England and Wales, company number 17295579, registered office 124 City Road, London, EC1V 2NX.