Cookies Policy

How legal.avantwerk.co.uk uses cookies and similar technologies. Statutory basis: PECR reg. 6 + UK GDPR.

1. What this policy covers

1. This Cookies Policy explains how Avantwerk Legal AI, operated by Bennovate spółka z ograniczoną odpowiedzialnością ("Bennovate", "we", "us"), uses cookies and similar tracking technologies on the website legal.avantwerk.co.uk (the "Site") and in the Avantwerk Legal AI web application.
2. Under reg. 6 of the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) ("PECR"), consent is required before storing information on, or accessing information from, your device unless a current statutory exception applies. We presently rely on an exception only for the necessary technologies described below and seek consent for the optional purposes listed in this policy.
3. Your consent to non-essential cookies is obtained through the cookie-consent banner displayed on your first visit to the Site, before any non-essential cookie is placed on your device.
4. This policy should be read alongside our Privacy Notice and our Security page.

2. What is a cookie?

A cookie is a small text file that a website places on your device (computer, tablet or smartphone) when you visit it. Cookies allow the website to remember information about your visit, such as your preferred language and settings.

We also use localStorage and sessionStorage on the public Site. This policy describes the public Site and access layer. The canonical case record of an installed Customer is held in its encrypted Customer-Controlled Vault, not in this Site's localStorage or IndexedDB.

3. Cookie categories

We group cookies and similar technologies by purpose. Strictly necessary technologies are always available. The optional purposes are functional services, audience analytics, Google advertising, Meta advertising and referral attribution. An optional technology may be listed here before it is activated; listing it does not mean that it is currently running.

3.1 Strictly necessary cookies

Strictly necessary cookies are essential for the Site and the Service to function. Without them, you cannot navigate the Site or use the application. Under reg. 6(4) PECR, these cookies do not require your consent.

3.2 Functional cookies

Functional cookies enable enhanced functionality and personalisation. If blocked, some features may not work correctly but the core Service remains accessible. These cookies require consent.

3.3 Analytics cookies

Audience analytics allow us to understand in aggregate how visitors interact with the Site. Analytics technologies are disabled unless you choose the analytics purpose. Analytics consent does not by itself permit advertising or remarketing.

Google Analytics 4 is configured in this publication candidate (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with infrastructure provided by Google LLC in the USA). After analytics consent it may receive online identifiers, truncated or full IP-derived connection data as determined by Google's service, browser and device data, page and referrer URLs, timestamps and interaction events. We configure the service to avoid sending names, contact details, enquiry text, Matter Content or privileged material. The Google tag must not load before the relevant consent is obtained. Google Signals, advertising features and ad-personalisation signals remain off unless the separately described Google advertising purpose is activated and consented to.

The GA4 measurement identifier is present in the site's consent controller, but the Google loader, configuration call and measurement network request do not run until analytics consent is given. The entries below describe the GA4 cookies and their maximum persistence; Google's service and the configured property may apply a shorter period. We review the inventory after any material configuration change.

3.4 Google advertising technologies

Google Ads conversion measurement and remarketing are off-ready and not active merely because they are described here. If activated, they will run only after a separate Google advertising choice. They may use Google tags, conversion-linker storage, advertising identifiers and cookies such as _gcl_*, and may receive page and referrer URLs, ad-click identifiers, timestamps and defined conversion events. Remarketing may allow Google to associate Site activity with a browser or Google account and place that visitor in an advertising audience. Exact cookie names, domains, recipients and retention must be verified from the production configuration before activation.

3.5 Meta advertising technologies

Meta Pixel measurement and remarketing are off-ready and not currently active merely because they are described here. If activated, the Pixel will run only after a separate Meta advertising choice. Meta Platforms Ireland Limited may receive browser and device data, IP-derived connection data, page and referrer URLs, timestamps, Meta/browser identifiers and defined conversion events. It may associate those events with a Meta account and use them for campaign measurement, audience creation and remarketing. Expected technologies may include the _fbp cookie and Meta identifiers; the exact production inventory and retention must be verified before activation. We will not configure advanced matching or send names, email addresses, phone numbers, enquiry text, Matter Content or privileged material without a separate assessment and updated notice.

3.6 TikTok advertising technologies

TikTok Pixel is currently inactive. No Pixel ID is configured and no TikTok script, request or storage is initiated. If introduced, it will remain off unless the visitor separately chooses TikTok advertising. Before activation we will publish the measured event parameters, provider and role, storage inventory and duration, recipients, international-transfer mechanism and withdrawal controls.

3.7 Sales-enquiry chat and acquisition CRM

HighLevel Inc. provides optional pre-sale chat and acquisition/sales CRM functions. It may receive device information and information a visitor chooses to submit for a sales enquiry, demo or booking. It is not used for product support, provisioning, subscription administration, billing, service mail, incidents, releases or customer success.

After separate referral-attribution consent, an AVW code in the URL fragment may be stored in sessionStorage for the current session and applied only to sign-up links. If the URL or an existing cookie contains a valid am_id, the Site may load GHL Affiliate Manager from stcdn.leadconnectorhq.com, which communicates with backend.leadconnectorhq.com and may set am_id, am_fingerprint and am_signed_up. Name and email are submitted as an affiliate lead only after consent and after the sign-up server accepts the registration.

4. Consent: how we obtain it and what it means

1. The summary offers equally prominent choices to accept analytics, keep only essential storage or customise. Accepting from the summary enables analytics only. Referral attribution requires its own choice under custom settings; inactive advertising and chat controls are not presented as live services.
2. All optional purposes are off by default. Not responding, continuing to browse or accepting one purpose does not constitute consent to another purpose.
3. Your consent is:
   • freely given: using the Service is not conditional on accepting non-essential cookies;
   • specific: each optional purpose and relevant third party has its own choice;
   • informed: this policy and the banner describe what each cookie does;
   • unambiguous: consent is given by a positive action (clicking "Accept"), not by pre-ticked boxes or by simply continuing to browse.
4. You may withdraw or amend each choice at any time through the "Cookie settings" control available from every page. Withdrawal passes the denied choice to a loaded provider, prevents us from intentionally sending further configured events for that purpose, and removes first-party cookies or storage that we can remove. A provider script already downloaded by the browser may remain in the page until it is reloaded. Withdrawal does not affect processing lawfully carried out before withdrawal.
5. The legal basis for our use of strictly necessary cookies is reg. 6(4) PECR. The legal basis for all other cookies is your prior, freely given consent under reg. 6(1) PECR and UK GDPR Art. 6(1)(a).

5. Third-party cookies and services

1. Transactional email. Product account-security, service and billing mail uses the applicable Legal AI-owned mail route. GHL-driven mail is limited to acquisition and sales communications.
2. HighLevel. HighLevel Inc. is limited to pre-sale chat, acquisition, sales and separately consented referral attribution. It is not used for product support, provisioning, subscription administration, billing or service mail.
3. Google. Google Ireland Limited provides the conditional GA4 and Google Ads services described above, with Google LLC providing infrastructure. Analytics and Google advertising require separate choices.
4. Meta. Meta Platforms Ireland Limited provides the conditional Meta Pixel measurement and remarketing service described above. It remains inactive until implemented and separately consented to.
5. Let's Encrypt. Our TLS certificate is provided by Let's Encrypt (Internet Security Research Group). Certificate validation does not set cookies and does not involve any personal data.

6. How to manage cookies in your browser

In addition to the controls we provide, you can manage cookies using your browser settings. Most browsers allow you to:

• view the cookies currently stored on your device;
• delete all or specific cookies;
• block cookies from particular sites; and
• block all third-party cookies.

Disabling strictly necessary cookies will prevent you from logging in or using core features of the Service.

Browser-specific guidance is available from the Information Commission at ico.org.uk/your-data-matters/online/cookies.

7. International transfers via cookies

Google, Meta and HighLevel may make personal data available outside the United Kingdom, including in the United States. Before activating a service, we verify the recipient's role, destination, applicable UK adequacy regulations and, where adequacy does not cover the transfer, the executed UK Addendum to the EU Standard Contractual Clauses or the IDTA together with the required transfer-risk assessment. These mechanisms are alternatives selected for the relevant transfer; they are not interchangeable labels.

8. Changes to this Cookies Policy

We review this Cookies Policy periodically and may update it to reflect changes in the cookies we use or in applicable law. Material changes will be notified through the cookie-consent banner and by updating the effective date at the top of this policy.

9. Contact and complaints

If you have any questions about our use of cookies, or wish to exercise any right under UK GDPR or PECR, please contact dpo@avantwerk.com.

If you are not satisfied with our response, you may complain to the Information Commission:

Information Commission
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
0303 123 1113 · ico.org.uk