UKAAS legal information
Storage and Access Technologies Notice
How UKAAS uses cookies, local storage and related technologies under PECR and UK data-protection law.
Version 1.0 · Effective 13 August 2026
Scope
This Notice covers technologies that store information on, or access information from, a user's device, including cookies, local storage, pixels, link decoration and similar identifiers. UKAAS applies the Privacy and Electronic Communications Regulations 2003 as amended and applicable UK data-protection law.
Strictly necessary technologies
These technologies are used only for the exempt purpose and limited to what is necessary. Consent is not required where the PECR communication or strictly-necessary exception applies, but clear information remains available here. Blocking them may prevent sign-in, security or a requested preference from working.
- Authentication-session and token fragments needed to keep a requested account signed in securely.
- OAuth state, PKCE verifier, callback and anti-forgery values needed to complete Google or Microsoft sign-in safely.
- Security, rate-limit, load-delivery and request-integrity values needed to provide and protect the requested online service.
- A consent or preference record needed to remember a choice you have asked the site to apply.
Optional technologies
UKAAS does not currently activate advertising or optional analytics technologies. Before introducing an optional category, UKAAS will document the provider, purpose, data, first- or third-party status and duration, and obtain valid prior consent where PECR requires it. Continuing to browse, inactivity or a pre-ticked control will not be treated as consent.
Cookie settings
Only strictly necessary storage is currently active, so there is no optional category to enable or reject. If optional technologies are introduced, equally prominent accept and reject choices and granular settings will be available before they run. Withdrawal will be as easy as consent and apply to future access.
Browser controls and complaints
You may remove or block storage through your browser, but doing so may sign you out or break authentication. Session values expire when no longer needed; persistent security or preference values use a duration proportionate to purpose. UKAAS audits technologies and removes those no longer necessary.
Questions may be sent to contact@ukaas.org. A complaint about personal data is handled under the Privacy Notice and may also be raised with the Information Commissioner's Office.