How It’s Me Grace uses cookies and similar technologiesLast updated: 8 July 2026 | Version 1.2Important before publication: replace every item in square brackets, run a live cookie/storage audit, confirm the consent banner behaviour, and remove this sentence. This draft is designed for a UK website and should be checked against the final technical setup and by a qualified legal adviser where required.
1. About This Cookie Policy
This cookie policy explains how the It’s Me Grace website uses cookies and similar technologies. It should be read together with the Privacy Policy, which explains how personal information is collected, used, shared and protected.
For the purposes of this policy, “cookies” also includes similar technologies that store information on, or access information from, a visitor’s device. This may include pixels, tags, scripts, software development kits, local storage, session storage, device identifiers and similar tools.
Website owner: GRACE BAKER trading as It’s Me Grace. Privacy contact: [email protected] or 45 The Churchills, Newton Abbot, TQ12 1QN.
2. What Cookies Are
Cookies are small files placed on your computer, tablet, mobile phone or other device when you visit a website. They can help a website work, keep it secure, remember choices, understand how people use it and support marketing or embedded third-party features.
Some cookies are deleted when you close your browser. These are often called session cookies. Others stay on your device for a set period or until you delete them. These are often called persistent cookies.
Cookies can be set by the website you are visiting, known as first-party cookies, or by another organisation whose technology is included on the website, known as third-party cookies.
3. The Legal Position In The UK
UK cookie rules sit mainly under the Privacy and Electronic Communications Regulations (PECR), alongside the UK GDPR and Data Protection Act 2018 where personal data is involved.
In plain English, the website must usually tell visitors what cookies and similar technologies are used, explain what they do, explain who else is involved, state how long they last, and obtain valid consent before setting non-exempt cookies.
Consent must be freely given, specific, informed and shown by a clear positive action. Non-essential cookies must not be pre-enabled, and refusing cookies must be as easy as accepting them.
4. Cookies That May Not Need Consent
Some cookies and similar technologies may be used without consent where a PECR exception applies. The main exceptions likely to matter for a small service business website are:
Communication cookies that are used solely to transmit a communication over a network.
Strictly necessary cookies that are essential to provide a service requested by the visitor, such as security, page loading, form submission, basket or login functionality.
Statistical or analytics technologies used solely to create aggregate statistical information about how the website is used so the website can be improved, provided the visitor is given clear information and a simple free way to object.
Appearance or preference technologies used solely to adapt the website’s appearance or functionality to the visitor’s preference, provided the visitor is given clear information and a simple free way to object.
These exceptions are narrow and purpose-specific. If the same technology is also used for another purpose, such as advertising, profiling, retargeting, identifying individuals or sharing data for a third party’s wider purposes, the exception may not apply and consent may be required.
5. Cookies That Need Consent
The website will ask for consent before using cookies or similar technologies that are not covered by an exemption. This may include, depending on the final website setup:
marketing, advertising, retargeting or campaign measurement pixels;
analytics tools that identify, track, profile or monitor visitors beyond aggregate statistical website improvement;
embedded content or third-party features that set non-essential cookies;
social media plugins or sharing tools that track visitors; and
any technology that accesses device information for a non-exempt purpose.
Non-essential cookies should be blocked until the visitor has made a clear choice through the cookie banner or settings panel.
6. Cookie Categories Used On This Website
The exact cookies must be confirmed once the live website, plugins, forms, analytics tools, embedded content and consent platform are finalised. The table below is written so the final website team can replace the bracketed rows with the actual cookie names and durations before publication.
| Category | Purpose | Consent position | Examples | Typical duration |
| Strictly necessary | Keeps the website secure, loads pages, remembers essential choices, supports forms and enables the cookie-consent tool. | Usually no consent required, but visitors must still be told about them. | [Cookie names from hosting, security, consent banner and forms] | Session to 12 months |
| Preferences / appearance | Remembers choices about how the site looks or functions, such as display or accessibility preferences. | May be exempt only where the use fits the PECR appearance exception and visitors have a simple free way to object. Otherwise consent is required. | [Cookie names if used] | 6 to 12 months |
| Analytics / statistical | Helps understand how visitors use the website so content, navigation and performance can be improved. | May be exempt only if used solely for aggregate statistical purposes to improve the site, with clear information and a simple free way to object. If the analytics identifies, tracks, profiles, retargets or is used for wider purposes, consent is required. | [Google Analytics / Plausible / Microsoft Clarity / other – confirm] | upto 24 months |
| Marketing / advertising | Measures campaigns, builds audiences, retargets visitors, personalises adverts or tracks users across websites. | Consent required before use. These must not be set unless the visitor has chosen to accept them. | [Meta Pixel / Google Ads / LinkedIn Insight Tag / other – confirm or delete] | upto 13 months |
| Embedded content and third-party tools | Enables content or functionality supplied by another provider, such as videos, maps, booking tools, forms, payment tools or social media embeds. | Depends on the tool and purpose. Non-essential storage/access requires consent before use. | [Calendly / YouTube / Vimeo / Google Maps / payment provider / email platform – confirm] | session to 24 months |
7. Detailed Cookie List
Before this page goes live, the website should include a detailed list of the actual cookies and similar technologies used. This list should be generated from a live cookie audit and should include first-party and third-party tools.
Recommended final fields for each cookie or technology:
name of the cookie, pixel, tag, script or storage item;
provider or domain setting it;
purpose and category;
whether it is first-party or third-party;
whether it is session-based or persistent;
how long it lasts;
whether consent is required or an exception is relied on; and
a link to the provider’s privacy or cookie information where relevant.
Placeholder: [INSERT COOKIE AUDIT TABLE FROM LIVE WEBSITE].
8. How The Website Asks For Consent
Where consent is needed, the website should use a cookie banner or consent-management tool that allows visitors to accept, reject or manage non-essential cookies before those cookies are set.
The consent request should:
be clear, plain and separate from general terms and conditions;
explain the main purposes of the cookies;
provide granular choices where different non-essential purposes are used;
name or clearly identify third-party providers where required;
make rejecting non-essential cookies as easy as accepting them;
avoid pre-ticked boxes, implied consent or consent based only on continuing to browse;
record the visitor’s preference for an appropriate period; and
allow consent to be withdrawn or changed as easily as it was given.
9. How To Change Cookie Choices
Visitors should be able to change cookie choices at any time by using [COOKIE SETTINGS LINK / FLOATING COOKIE ICON / FOOTER LINK].
If the website uses analytics or appearance cookies under an exception that does not require consent, visitors can still object to them by using the Cookie Settings link in the website footer and turning off optional cookies. If a Cookie Settings link is not yet available, visitors can also contact us at [email protected] and we will explain how to manage their choices.
Visitors can also control cookies through their browser settings. Most browsers let users delete cookies, block cookies, or choose whether cookies can be set by particular websites. Browser controls vary, so visitors should check their browser’s help information for current instructions.
Blocking some cookies may affect how the website works. For example, forms, security features, embedded tools or preference settings may not function properly.
10. Third-Party Cookies And Embedded Services
The website may include services supplied by other organisations. These providers may set or read cookies and similar technologies when their features are loaded or used. Examples may include:
website analytics providers;
booking or scheduling tools;
contact-form, CRM or email-marketing tools;
payment or invoicing tools;
video, map or social-media embeds;
security, spam-prevention or performance tools; and
advertising or campaign-measurement platforms.
Before publication, list the actual providers used here: [PROVIDER LIST].
Where third-party tools are used, It’s Me Grace should understand what information is collected, what the provider does with it, whether the provider uses it for its own purposes, whether information is transferred outside the UK, and whether consent is needed before the tool loads.
11. Analytics
The website may use analytics to understand how visitors use the site, which pages are useful, where visitors come from, and where improvements may be needed.
If analytics are used solely for aggregate statistical information to improve the website, and visitors are given clear information plus a simple free way to object, the website may be able to rely on the PECR statistical-purposes exception. This must be confirmed against the actual analytics setup.
If analytics data is used to identify visitors, track them across websites, make decisions or inferences about them, support advertising, create profiles, or is retained at individual level for longer than necessary, consent is likely to be required before the analytics technology is used.
12. Marketing And Advertising Technologies
The website should not use advertising, profiling, retargeting or behavioural tracking cookies unless the visitor has given valid consent first.
If tools such as Meta Pixel, Google Ads tags, LinkedIn Insight Tag or similar campaign tracking technologies are used, this policy must name them and explain their purpose, the data they may collect, how long they last and how visitors can withdraw consent.
At present, this website does not use marketing, advertising, retargeting or behavioural tracking cookies. If this changes in future, this policy will be updated and visitors will be asked for consent before those technologies are used.
13. Local Storage, Session Storage, Pixels, Tags And Scripts
The law applies to more than traditional browser cookies. It can also apply where the website stores information on, or accesses information from, a visitor’s device using other methods. This may include local storage, session storage, tracking pixels, scripts, tags, link decoration, device fingerprinting or similar tools.
This policy uses the word “cookies” as a shorthand for cookies and similar technologies unless stated otherwise.
14. Cookie Duration And Review
Cookies and similar technologies should not last longer than needed for their purpose. The website owner should confirm the duration of each cookie during the cookie audit and remove or shorten anything unnecessary.
Cookie use should be reviewed:
before the website launches;
whenever a new plugin, platform, form, embedded tool, analytics provider or marketing tool is added;
whenever a provider changes how its technology works;
whenever the website purpose or services change; and
at least every 6 months.
15. Personal Data Collected Through Cookies
Some cookies and similar technologies may involve personal data, such as IP address, device identifiers, online identifiers, usage data, location-derived information or information linked to a visitor’s enquiry or account.
Where personal data is collected, the Privacy Policy explains the lawful basis, purposes, recipients, retention periods, international transfers and rights that may apply.
Cookie consent under PECR is separate from the UK GDPR lawful basis for any personal-data processing that follows. Where consent is relied on for both, the website must be able to demonstrate valid consent and allow it to be withdrawn.
16. International Transfers
Some third-party cookie, analytics, advertising, booking, form, hosting or security providers may process information outside the UK. Before publication, confirm whether any cookie-related information is transferred internationally and ensure the Privacy Policy explains the relevant safeguards.
Some providers used by this website may process cookie-related information outside the UK, for example where analytics, hosting, security, booking, form or embedded-content tools rely on international systems. Where this happens, we will take reasonable steps to ensure appropriate safeguards are in place, such as using providers with UK adequacy arrangements, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other safeguards recognised under UK data protection law.
17. Children’s Privacy
The website is intended for business users and is not aimed at children. If the website is changed in a way that is likely to attract children, cookie and privacy information should be reviewed against the ICO Children’s Code and any other applicable requirements.
18. Changes To This Cookie Policy
This cookie policy may be updated when the website, services, legal requirements, consent mechanism or technology providers change. The updated version should be published on this page with a new “last updated” date.
Where a change affects non-essential cookies or introduces a new purpose, visitors may need to be asked for fresh consent before the new technology is used.
19. Contact
Questions about this cookie policy or the website’s use of cookies should be sent to:
It’s Me Grace / Grace Baker
45 The Churchills
Newton Abbot
TQ12 1QN
For wider information about personal-data rights, please see the Privacy Policy.
20. Pre-Publication Checklist
Run a cookie and storage audit on the final live or staging website.
Confirm every cookie, pixel, tag, script, local-storage item and third-party embed.
Delete any cookies or tools that are not needed.
Confirm whether each item is exempt, requires consent, or can be used only with a simple free objection route.
Configure the cookie banner so non-essential technologies are blocked before consent.
Make reject, accept and manage choices equally clear and easy.
Add the live cookie settings link to this policy.
Check that the Privacy Policy covers any personal data collected through cookies.
Confirm third-party provider names, purposes, retention periods and international transfer information.
Remove all square-bracket placeholders before publication.