Cookies Policy

This policy explains what cookies and similar technologies are used on kat-i.com, and what choices you have about them.

It does not cover the personal data we research on behalf of our clients. That is a different activity, governed by a different lawful basis, and it is explained in the privacy policy and the compliance page. Nothing on this page has any bearing on how contact research is carried out.

A cookie is a small text file that a website asks your browser to store, so that the site can recognise your browser on a later visit. Related technologies do the same job by other means: local storage, session storage, tracking pixels in emails or pages, and browser fingerprinting.

They divide broadly into two kinds. Strictly necessary ones make a site work at all, for example by keeping you signed in or remembering a security token. Everything else exists for the operator's benefit rather than yours: measuring visits, testing layouts, building advertising profiles, or following you between sites.

Under UK and EU rules, only the strictly necessary kind may be set without asking you first. For every other kind, consent must be obtained before the cookie is placed, not after.

That is the whole answer, and it is unusual enough to be worth stating plainly.

There is no analytics package on this site. No advertising network. No tag manager. No session cookie, because there is nothing to sign in to. No pixel in any page. Nothing is written to local storage or session storage.

Because there is nothing to consent to. A consent banner exists to obtain permission for cookies that are not strictly necessary. Where none are set, a banner would be theatre: it would ask you to agree to something that is not happening, and it would make the site worse to use.

We are aware that the absence of a banner reads to some visitors as an oversight rather than a decision. It is a decision. A company that asks other organisations to take data handling seriously should be able to run its own website without following people around the internet.

We expect to want to understand which pages are useful. There is more than one way to do that, and they are not equivalent in law, so this section sets out in advance what we will and will not do.

5.1Reading our own server logs, which is the route we prefer

Every web server records the requests it receives. Analysing those records tells us which pages are read and where visitors arrive from, and it involves no storage on, and no access to, your device. The rules on cookies bite on storing or reading information on your equipment. Where nothing is stored and nothing is read, they do not apply, and no consent banner is required or appropriate.

Server logs still contain your IP address, which is personal data, so data protection law applies even though the cookie rules do not. If we do this, IP addresses will be truncated or hashed at the point of collection, logs will be kept for a short and stated period, and the lawful basis will be legitimate interests, which you may object to at any time using the contact details below.

5.2Anything that stores or reads something on your device

This includes conventional analytics cookies, local storage, tracking pixels and device fingerprinting, whether or not the vendor describes the product as cookieless. If we ever use any of them, all of the following will be true before a single request is made to your device:

1. This page will be updated first, with the name, purpose, type, duration and provider of everything set out in a table.
2. The data will be used only by us, and only to improve this website. It will not be passed to any provider for that provider’s own purposes, and it will not be used for advertising or profiling. That restriction is what keeps the measurement lawful without a consent banner in the United Kingdom.
3. You will be told clearly what is collected, and given a simple, free way to object, honoured immediately and remembered.
4. Visitors in the European Union will be asked for consent before anything is stored or read, because the European rules have not changed and still require it. Refusing will be exactly as easy as agreeing, on the same screen, with equally prominent controls.
5. Declining or objecting will not degrade the site. Every page will work identically either way.
6. The effective date at the top of this page will change, so you can tell that it has.

5.3What we will not do, in any territory

Pre-ticked boxes. Cookie walls. Consent implied from continued scrolling. Legitimate interest toggles for advertising. Advertising networks, retargeting pixels, cross-site tracking, session recording, or selling anything about visitors to this site to anybody. None of them are things we want, and several of them are not lawful.

Typefaces on this site are served from Google Fonts. Requesting a font file transmits your IP address and browser details to Google as an unavoidable consequence of any request to any server. Google Fonts does not set cookies on the visiting browser. If you would rather it did not happen at all, most browsers and extensions can block third-party font requests, and the site remains fully readable in a fallback typeface.

There is no embedded video, no social media widget, no live chat, no advertising tag and no third-party script of any other kind. Those are the usual sources of cookies people do not expect, and none of them are present.

If you submit an enquiry form, the information you type is sent to us and handled as described in the privacy policy. The form does not set a cookie in order to work.

The first time you arrive, this site asks before it stores anything. Until you answer, nothing analytical is set on your device: no measurement cookie, and nothing sent to Google Analytics. That is the default state, and it applies whether or not the country you are reading from requires it of us.

Accept and Decline are presented identically, in the same size and the same style, with neither one highlighted. A consent choice that has been nudged is not really a choice, and we would rather carry a smaller number of accepted measurements than a larger number we could not defend.

Advertising storage is refused permanently and is not part of the choice at all. We run no advertising, so accepting measurement never quietly enables it.

Your answer is remembered in your own browser rather than on our servers, which means it applies to that browser on that device only. To change it at any time, reopen the choice, or clear this site's data in your browser settings and you will be asked again on your next visit.

The only thing this site can set is the measurement cookie described above, and the choice in the previous section already controls it. The browser controls below exist anyway and are worth knowing about for the rest of the web.

• Chrome Settings, then Privacy and security, then Third-party cookies and Site settings
• Safari Settings, then Privacy, where Prevent cross-site tracking is on by default
• Firefox Settings, then Privacy and Security, where Enhanced Tracking Protection can be set to Strict
• Edge Settings, then Cookies and site permissions

Blocking all cookies everywhere will break sites that genuinely need them, such as anything you sign in to. Blocking third-party cookies rarely breaks anything and removes most cross-site tracking.

Do Not Track is a header some browsers send asking sites not to track the visitor. It was never widely honoured and most browsers have removed it. We do not track visitors, so the request is satisfied whether or not it is sent.

Global Privacy Control is a newer signal that carries legal weight in some jurisdictions and is treated as a valid opt-out from the sale or sharing of personal information. We do not sell or share information about visitors to this website, so there is nothing for the signal to opt out of. Were we to add measurement in future, a GPC signal would be honoured as a refusal without a banner needing to be shown.

This policy is reviewed whenever the site changes and at least once a year. The effective date at the top is the only reliable indication of the current version. Any change that introduces a cookie will be made before the cookie appears, never after.