What these technologies are
A cookie is a small value a website asks a browser to store and return. Similar storage or access can use local storage, tracking pixels, scripts, device fingerprinting or link decoration. The applicable privacy rule depends on the purpose and operation, not simply on whether a tool is called a cookie.
Current first-party inventory
| Name | When used | Purpose and controls | Duration | Category |
|---|---|---|---|---|
__Host-bc_csrf | Only when an enabled secure form requests a submission session | Matches the submitted anti-forgery token so another site cannot silently submit a form on your behalf. First party; Secure; HttpOnly; SameSite=Strict; Path=/; no Domain attribute. | 30 minutes at the current configured maximum session | Strictly necessary security |
__Host-bc_pricing | After you request access to the pricing guide using an email address or an authorised preview code | Remembers the authorised pricing session on this browser. It contains no email address or preview code, is not used for advertising, and is checked against an expiring server-side session. First party; Secure; HttpOnly; SameSite=Lax; Path=/; no Domain attribute. | Up to seven days, or until you choose to lock the guide or the session is revoked | Necessary access and security |
The anti-forgery cookie is issued when the browser requests a secure form session. The pricing-access cookie is issued only after the access request succeeds. You can lock the pricing guide to end that browser’s access without waiting for expiry.
Technologies deliberately absent
- No analytics, advertising, remarketing, conversion or cross-site tracking tags.
- No heatmaps, session replay, visitor profiling or device fingerprinting.
- No social feed, video, calendar or chat widget that silently contacts a third party.
- Live Google Maps frames appear on the Contact, London and Manchester pages. Opening one of those pages connects the browser to Google, which receives connection and device information and may apply its own browser-storage practices.
- No application use of
localStorageorsessionStorage. - No cookie is used to save answers entered into the browser-only Bid Strengthening Plan.
The navigation script changes only the current page’s menu state in memory. Ordinary hosting security/access logs are server records rather than browser storage; their handling belongs in the privacy notice.
Third-party map loading
The office-map frames load directly when their pages are opened so visitors can see and use each location immediately. This means the Google connection occurs before a visitor interacts with the frame. Bid Champions does not use the map connection for its own analytics or advertising.
The map integration and Google’s storage behaviour must be reviewed as part of website change control. If applicable rules require a consent mechanism for the technology in use, the implementation must be updated accordingly.
Your browser controls
You can remove or block cookies using your browser settings. Blocking security cookies prevents secure forms or remembered pricing access from working, but does not prevent you from reading the public website. You can contact Bid Champions directly if you cannot use the pricing-access form.
Change control
The inventory must be re-tested after any change to hosting, forms, analytics, CRM widgets, fonts, maps, video, social content or booking. The page must name each active technology, provider, purpose, information accessed, duration and control. A material change must be published before the tool is enabled.
Questions
Email info@bidchampions.com. The ICO’s current storage and access technologies guidance explains the regulatory framework; the link does not indicate ICO approval of this inventory.