DRAFT — for solicitor review; not yet in force.
Property Inspector — Cookie Policy
1. Introduction
1.1 This policy explains how MBGW Limited (MBGW) uses cookies and similar technologies on our website, the subscriber portal, workspace offices and the customer portal (together, the Sites), and how you can control them. It is written to meet the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and the UK GDPR.
1.2 The Property Inspector mobile app does not use cookies. It stores sign-in tokens and offline data on the device, as described in the Privacy Notice.
2. What cookies are
2.1 A cookie is a small text file that a website places on your device so that it can recognise your browser and remember information between pages or visits. Similar technologies include local storage in your browser, which we use in the same way and treat the same way.
2.2 Cookies may be session cookies (deleted when you close your browser) or persistent cookies (kept until they expire or you delete them). They may be first-party (set by the Site you are visiting) or third-party (set by another domain).
3. Cookies that are strictly necessary
3.1 These cookies are essential for the Sites to work and do not require your consent under PECR. You can block them in your browser, but the Sites will not function without them.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
session_id |
Each Site | Identifies your signed-in session so you stay logged in as you move between pages. | Session, renewed while active [TBC: confirm Odoo session lifetime as configured] |
csrf_token (form field and cookie where used) |
Each Site | Protects forms against cross-site request forgery. | Session |
frontend_lang |
Website and portals | Remembers your language preference. | 1 year [TBC] |
tz |
Workspace office | Remembers your time zone so dates display correctly. | Session [TBC] |
cids |
Workspace office | Remembers which company is selected in the office (single company for Property Inspector). | Session [TBC] |
| Cookie-consent preference | Website | Records whether you have accepted or rejected optional cookies, so we do not ask again. | [TBC: e.g. 1 year] |
| Sign-in state during single sign-on | MBGW identity broker | Carries the state of a sign-in via Microsoft or Google between the redirect and the return. | Minutes |
3.2 The Sites are built on the Odoo platform, which may set a small number of additional technical cookies for the same purposes. [TBC: run a cookie audit on the live Sites and list every cookie observed, with exact names and lifetimes.]
4. Cookies that are not strictly necessary
4.1 We do not currently use analytics, advertising or social-media cookies on the Sites. [TBC: confirm no analytics tool is or will be installed on the marketing website at go-live. If one is added, it must be listed here and gated behind consent.]
4.2 The Odoo website platform can record marketing attribution values (utm_campaign, utm_source, utm_medium) from links you follow to the website. [TBC: confirm whether these are active on the marketing website; if they are, they are not strictly necessary and must be gated behind consent.]
4.3 If we introduce optional cookies in future we will ask for your consent through a banner before setting them, and you will be able to withdraw consent at any time.
5. Third-party sign-in
5.1 If you sign in with a Microsoft or Google account, you are taken to that provider's site to authenticate. The provider sets its own cookies on its own domain under its own cookie policy. We do not control those cookies. Once you return, only our first-party session cookie is used.
6. Map tiles and geocoding
6.1 The team location map and the site location picker in the workspace office load their base map tiles directly from OpenStreetMap's tile servers into your browser, and the location picker sends site coordinates and typed address searches directly to OpenStreetMap's Nominatim geocoding service. Alternative base layers that you can select in the map (Esri satellite and grey maps, OpenTopoMap) are loaded from those providers in the same way, and the location picker loads an address-search add-in script from the unpkg.com content delivery network. These providers therefore receive your IP address and browser details and the map area you are viewing. They are listed in the Sub-processor List.
6.2 The live-traffic overlay tiles (TomTom) are requested through our own servers, so TomTom does not see your browser.
6.3 To our knowledge these providers do not set cookies in your browser; any cookie they did set would be a third-party cookie under their own policy, not ours. [TBC: confirm in the cookie audit (s.3.2) whether tile.openstreetmap.org, nominatim.openstreetmap.org, server.arcgisonline.com, tile.opentopomap.org or unpkg.com set any cookie or local storage, and whether these requests should be routed through MBGW's servers instead.]
7. How to control cookies
7.1 You can block or delete cookies through your browser settings. Instructions for common browsers:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Edge: Settings → Cookies and site permissions
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy
7.2 Blocking strictly necessary cookies will stop you signing in to the Sites.
7.3 Where a consent banner is shown, you can change your choice at any time using the cookie settings link in the Site footer. [TBC: add the link once the banner exists.]
8. More information
8.1 Our use of personal data collected through cookies is described in the Privacy Notice. Questions about cookies can be sent to [TBC: privacy contact email]. Guidance on cookies is available from the Information Commissioner's Office at ico.org.uk.
9. Changes
9.1 Each version of this policy is numbered and published with its effective date. We will update it whenever the cookies we use change.