KIST / LEGAL
Cookie policy
Last updated 26 September 2026
1. The short version
In the UK, the EU and the EEA, and Switzerland, and wherever we cannot tell where you are, no optional cookie is set on this site until you say yes. Everywhere else the site starts with them allowed, and the same banner lets you turn them off.
“Accept all” means all: analytics and advertising. No advertising tag runs on this site today, so accepting sets no advertising cookie. If we add one, this page changes first.
If you say no, or change your mind later, the analytics cookies the page can reach are removed straight away, and the one set by our tagging server expires on its own. Section 4 explains how.
2. How the consent works, in order
Before any script runs, the page tells Google’s tag system that storage for analytics and for all three advertising signals is denied, and to wait half a second for a decision. That is the default state in the UK, the EU and the EEA, in Switzerland, and wherever we cannot tell where you are, and it applies to a visitor who never interacts with the banner at all. Everywhere else the default is granted, and the banner offers the same choices. The page learns only your country, from our host, and keeps it in a short-lived gw_geo cookie so it can pick that default.
Google’s tag then loads. While analytics storage is denied it sets no cookie and sends only cookieless measurement: no identifier, nothing that recognises you on a later visit.
If you choose “Accept all”, analytics storage and the three advertising signals are all granted. To allow one and not the other, choose “Let me choose”, turn on the switch you want and save.
If you decline, analytics storage stays denied, the analytics cookies the page can reach are removed and FPID expires on its own, as section 4 describes.
Your choice is remembered in your browser’s local storage under gw_consent_v1 for twelve months, and copied to a gw_consent_state cookie so the site can respect it. It identifies nobody. “Cookie settings” in the footer changes it at any time.
Consent first, then cookies. That is the whole design.
3. What is set
Strictly necessary. These are needed for the site to work and do not need consent. Both are ours. Our hosting provider sets none of its own.
| Cookie | Set by | What it does | Lifetime |
|---|---|---|---|
gw_geo | Kist | Holds the country our host reports, so the page can pick the right consent default | Until you close the browser |
gw_consent_state | Kist | Remembers your cookie choice so the site can respect it | 12 months |
Web fonts. The typefaces on this site are files served from this site, not from a font service. Loading them sets no cookie, stores nothing in your browser and sends nothing to anyone else, so they count as strictly necessary and load before any choice is made.
Analytics, only after you accept.
| Cookie | Set by | What it does | Lifetime |
|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes one browser from another so a return visit is not counted as a new person | Up to 2 years. Browsers can shorten it, and Chrome keeps it for 400 days. |
_ga_<container> | Google Analytics 4 | Keeps session state for that property | Up to 2 years. Browsers can shorten it, and Chrome keeps it for 400 days. |
FPID | Google Analytics 4, through our own tagging server | The same browser identifier as _ga, kept by our server so a browser that blocks script cookies is still counted once | 400 days |
FPLC | Google Analytics 4, through our own tagging server | Carries that identifier across to a linked site, if you follow one | 20 hours |
Advertising, only if you allow it. “Accept all”, or the Marketing switch, grants the three advertising signals. No advertising tag runs on this site today, so no advertising cookie is set either way.
4. Withdrawing consent
Two ways, and both work.
Use “Cookie settings” in the footer and choose “Reject all”, or turn a switch off and save. The page tells the tag system that analytics storage is denied and removes _ga, _ga_<container> and FPLC straight away. FPID is set by our tagging server in a form a script on the page cannot read or delete, so it stays until it expires, at most 400 days after it was set. We plan to have the tagging server remove it too, and will update this page when it does. Turning Marketing off also removes any advertising cookie, though none is set today.
Or clear cookies and site data in your browser. That removes the stored choice too, so the banner comes back on your next visit and you start from denied.
5. Who sees the analytics data
Google, as the provider of Google Analytics. It is listed in the sub-processors document with its location and transfer safeguard.
We look at page and event totals to work out which pages are doing a job. We do not use this site’s analytics to build a profile of you, and no advertising tag runs on this site.
6. Do Not Track and Global Privacy Control
We do not read either signal. In the places where our default is denied, listed in section 2, you get the outcome a Do Not Track signal asks for without sending one. Elsewhere, use “Reject all” on the banner or in “Cookie settings”.
7. Changes
If we add a cookie, this page changes before the cookie ships, not after.