Legal · Working draft for solicitor review

Cookie Policy

Draft dated 12 October 2026 · Not solicitor-approved · Do not publish until the implementation and this draft have been checked.

Implementation note for review

The preview includes a consent banner, preference panel, browser storage of choices, and a footer Cookie Settings control. PostHog initialization is gated by analytics consent; the Wistia iframe is withheld until embedded-media consent; HubSpot application forms remain available as a requested application service so a visitor can apply even when optional analytics are rejected. HubSpot and Google reCAPTCHA/Enterprise may process information for form rendering, security and bot prevention, and HubSpot may also process tracking data. The site loads HubSpot form-rendering code, but does not separately load HubSpot’s website tracking-code script. In a preview browser audit, the form requested HubSpot endpoints on forms-eu1.hsforms.com, including /embed/v4/render-definition/ssr/, /embed/v4/visitor/, /embed/v4/feature-control/ and /embed/v3/counters.gif. It also loaded Google reCAPTCHA Enterprise resources from google.com/recaptcha/enterprise and www.gstatic.com/recaptcha (including the script, challenge frame and related resources observed during the test). The browser recorded __cf_bm on the HubSpot/Cloudflare domain and _GRECAPTCHA on Google. These form and reCAPTCHA requests, and the two observed cookies, remained present after optional analytics were rejected; the form fields continued to render. The separate HubSpot tracking-code script (typically used for general page-view tracking) was not detected. This is not a claim that every third-party request or security cookie is strictly necessary or exempt from consent. We have not independently verified a successful submission during the rejection test, nor confirmed HubSpot account-level consent settings, cookie purposes or retention. Confirm these points and the appropriate PECR treatment with HubSpot and the solicitor before treating this draft as final.

1. Who we are and what this policy covers

This policy explains how Carter Connects uses cookies and similar technologies, including local storage, pixels, scripts and embedded content, on www.carterconnects.com. It should be read with our Privacy Policy.

Carter Connects is the trading name of Trevor Carter, a sole trader. Our contact details are set out at the end of this policy. This is a working draft for review by our UK solicitor and is not a statement of legal approval.

2. What cookies and similar technologies do

A cookie is a small text file that a website may store on your device. Similar technologies can store or access information in a browser or device, or send information back to a website or service. They can support security and site functions, remember a choice, measure performance, or support embedded media and forms.

Some technologies are set by Carter Connects and others may be set by a service embedded in, or linked from, a page. A service may use cookies, local storage, pixels or requests to its own servers. The precise technology and retention period depend on the service and its current configuration.

3. Essential and non-essential technologies

Strictly necessary

Strictly necessary technologies are used only where needed to provide a service you request, maintain security, route a form submission, or remember a privacy choice. They are not intended for advertising or optional analytics. The site should not describe a technology as essential merely because it is convenient to operate.

The consent manager stores the visitor’s category choices in browser localStorage under the key cc_cookie_consent and reads them on subsequent visits. Necessary site operation and this preference record are always active.

Analytics and other non-essential technologies

PostHog analytics initializes only where configured and only after the visitor has saved analytics consent. The Wistia video iframe is not assigned a source until embedded-media consent is saved. HubSpot form functionality is available on application routes when opened because it is needed to provide the application service. Optional HubSpot analytics behavior within or associated with the form has not yet been independently isolated and remains an item for technical and solicitor review.

4. Services and technologies identified on the website

Service	Purpose / observed use	Consent status to verify
PostHog	The shared layout includes a PostHog integration. Its script initializes the analytics library only if a public PostHog key is configured at runtime. Analytics may be used to understand use of the site and improve it.	PostHog initialization is gated on analytics consent. No PostHog public key is currently configured in the website environment, so analytics do not initialize in this preview. If a key is added later, initialization still requires explicit analytics consent.
Wistia	The homepage contains a Wistia video player (media ID d8yflknzci). Its iframe source is assigned only after embedded-media consent, to prevent the player from requesting content before that choice.	The iframe is withheld until embedded-media consent is granted. Wistia may then use its own playback technologies and tracking; its exact cookies and retention should be confirmed with a browser audit and vendor documentation.
HubSpot	HubSpot form embeds are used on the Networking Partner and Business Leader application journeys. They support form rendering, validation, security and submission; associated provider scripts and reCAPTCHA resources may also be requested.	The HubSpot form is loaded as a requested application service and remains available after rejection of optional analytics. The embed may communicate with HubSpot and Google reCAPTCHA/Enterprise for rendering, validation, bot prevention and submission. The page does not separately load HubSpot’s site tracking-code script. In the preview audit, HubSpot form-rendering/visitor/feature-control/counter requests and Google reCAPTCHA Enterprise loaded as part of the form service; the browser recorded __cf_bm and _GRECAPTCHA security cookies. They were not prevented by rejecting optional analytics because the form and its anti-abuse controls must remain available. The exact provider cookie classification and retention require confirmation from HubSpot settings and solicitor review.
Outseta and Stripe	Outseta and Stripe are intended for membership/account and payment operations. The current public website source reviewed for this draft does not load their scripts or provide those flows on these pages; any separate member or checkout domains require a separate cookie and consent review.	Not detected in the public-page source reviewed. Do not classify their cookies as active or strictly necessary on this website without auditing the separate account and payment journeys, domains and provider settings.

No definitive cookie-name or expiry inventory is stated here because the live browser inventory, vendor configuration and retention periods have not yet been confirmed. The inventory should be checked against the production site and the providers' current documentation before publication.

5. How consent should work

On a first visit, the preview displays Accept All, Reject Non-Essential Cookies and Manage Preferences. The preferences panel lets visitors control PostHog analytics and Wistia embedded media independently. Rejecting optional categories keeps PostHog from initializing, Wistia from loading. HubSpot application forms remain available because they are requested form services; optional HubSpot tracking behavior remains unverified as described above.

Visitors can revisit and change their choice through the footer Cookie Settings control. Withdrawing consent should stop future non-essential tracking and, where technically appropriate, clear or disable related browser storage. Withdrawal does not make prior processing unlawful, but it applies going forward.

Limitations requiring verification: PostHog is not configured in the current preview environment. The embedded form makes HubSpot form-service and Google reCAPTCHA Enterprise requests even after analytics rejection. The preview browser observed requests to HubSpot forms-eu1.hsforms.com form-rendering, visitor, feature-control and counter endpoints, plus Google reCAPTCHA Enterprise resources; it recorded __cf_bm and _GRECAPTCHA. The separate HubSpot tracking-code script was not detected. Confirm the purpose, retention and legal classification of the form-related requests/cookies and the account configuration with HubSpot and the solicitor before publication.

6. Managing cookies in your browser

Most browsers allow you to view, delete or block cookies and clear site storage. Browser controls operate separately from a website consent manager. Blocking all storage may affect functions such as form completion, authentication or payment where those functions are provided through a relevant service. Browser controls may not prevent all similar technologies or server-to-server requests.

7. Third-party services and changes

When a third-party embed or link is used, that provider may process information under its own terms and privacy information. We do not control a provider's systems. The services and their technologies can change as the website and service configuration changes; this policy should be kept in step with any change.

This draft does not assert that a particular provider sets a named cookie, for a particular duration, unless that has been verified in the deployed configuration. A current cookie and network-request audit is needed to complete that inventory.

8. Contact

Questions about cookies, tracking or this draft can be sent to info@carterconnects.com.

Carter Connects (trading name of Trevor Carter, sole trader)
Bartle House
Oxford Street
Manchester
M2 3WQ
United Kingdom

Solicitor review required before publication, including confirmation of the lawful basis/consent position, the final cookie inventory and the site’s consent-management behaviour.