Cookies Policy
How legal.avantwerk.co.uk uses cookies and similar technologies. Statutory basis: PECR reg. 6 + UK GDPR.
1. What this policy covers
- This Cookies Policy explains how Avantwerk Legal AI, operated by Bennovate spółka z ograniczoną odpowiedzialnością ("Bennovate", "we", "us"), uses cookies and similar tracking technologies on the website
legal.avantwerk.co.uk(the "Site") and in the Avantwerk Legal AI web application. - We are required under reg. 6 of the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) ("PECR") to obtain your consent before storing or accessing any cookie on your device, unless that cookie is strictly necessary for a service you have explicitly requested. This policy explains how we fulfil that obligation.
- Your consent to non-essential cookies is obtained through the cookie-consent banner displayed on your first visit to the Site, before any non-essential cookie is placed on your device.
- This policy should be read alongside our Privacy Notice and our Security page.
2. What is a cookie?
A cookie is a small text file that a website places on your device (computer, tablet or smartphone) when you visit it. Cookies allow the website to remember information about your visit, such as your preferred language and settings.
We may also use similar technologies such as local storage (HTML5), session storage, and browser-based IndexedDB for functional purposes within the application. Where we refer to "cookies" in this policy, we include these similar technologies unless context otherwise requires.
3. Cookie categories
We classify cookies into four categories in accordance with ICO guidance.
3.1 Strictly necessary cookies
Strictly necessary cookies are essential for the Site and the Service to function. Without them, you cannot navigate the Site or use the application. Under reg. 6(4) PECR, these cookies do not require your consent.
| Name / type | Purpose | Retention |
|---|---|---|
| Session authentication token | Maintains your logged-in session within the application | Browser session; cleared on logout |
| CSRF protection token | Protects form submissions against CSRF attacks | Browser session |
| Cookie-consent preference | Stores your consent choice (Accept / Essential only) in browser localStorage so you are not shown the banner on every page load | Persistent until you clear site data or change your choice |
3.2 Functional cookies
Functional cookies enable enhanced functionality and personalisation. If blocked, some features may not work correctly but the core Service remains accessible. These cookies require consent.
| Name / type | Purpose | Retention |
|---|---|---|
| Language / locale preference | Stores your selected interface language (English / Polish) | 12 months |
| UI layout preference | Stores your panel-width and sidebar-collapse preferences | 12 months |
| BYOK provider preference | Stores your selected AI provider choice (no key data is stored in a cookie — the key itself is in encrypted browser IndexedDB) | 12 months |
3.3 Analytics cookies
Analytics cookies allow us to understand how visitors interact with the Site and the Service. Analytics cookies are disabled unless you give explicit consent. No analytics tag loads before your consent is obtained.
Where analytics is enabled on this Site, we use Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with Google LLC (1600 Amphitheatre Parkway, Mountain View, California 94043, USA) as the ultimate parent and processor infrastructure. The Google Analytics tag (gtag.js, served from googletagmanager.com) loads only after you click Accept on the consent banner. If the analytics measurement ID has not been activated by Avantwerk, no analytics code executes at all, even after Accept.
Configuration applied: no ad-personalisation signals; Google Signals disabled; IP addresses are not logged or retained by Google for UK/EU traffic; event-level data retention on Google's servers is capped at 14 months.
| Name / type | Purpose | Retention |
|---|---|---|
_ga — Google Analytics 4 | Distinguishes individual users for aggregate traffic analysis. No cross-site advertising use; no individual profiling. Set by Google Ireland Limited. | Up to 2 years from last activity |
_ga_<container> — Google Analytics 4 | Maintains session state for GA4 measurement. Set by Google Ireland Limited. | Up to 2 years from last activity |
3.4 Marketing cookies
We do not use marketing or advertising cookies on the Site or in the Service by default. Marketing cookies are not placed on your device unless you give explicit consent.
Where such consent is given, any marketing activity is conducted through our CRM provider (identity withheld on customer-facing surfaces — see our Privacy Notice for the category description). That CRM provider does not place any cookies on the Site at any point before the Customer has registered an account; it operates only at the account-management level post-sign-up.
4. Consent: how we obtain it and what it means
- When you first visit
legal.avantwerk.co.uk, you will see a cookie-consent banner before any non-essential cookie is placed. The banner presents two equal-weight choices: Accept (strictly necessary cookies plus analytics cookies) or Essential only (strictly necessary cookies only). As Google Analytics 4 is the only non-essential cookie category currently active on the Site, this binary choice constitutes consent for, or refusal of, each non-essential category. - You may: (a) click Accept to allow analytics cookies alongside strictly necessary cookies; or (b) click Essential only to restrict the Site to strictly necessary cookies only.
- Your consent is:
- freely given — using the Service is not conditional on accepting non-essential cookies;
- specific — the banner choice gives or withholds consent for analytics cookies as a category; as analytics is the only non-essential category currently active on the Site, the choice covers all non-essential cookies in use;
- informed — this policy and the banner describe what each cookie does;
- unambiguous — consent is given by a positive action (clicking "Accept"), not by pre-ticked boxes or by simply continuing to browse.
- You may withdraw or amend your consent at any time by clicking the "Cookie settings" link in the footer of any page on the Site. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- The legal basis for our use of strictly necessary cookies is reg. 6(4) PECR. The legal basis for all other cookies is your prior, freely given consent under reg. 6(1) PECR and UK GDPR Art. 6(1)(a).
5. Third-party cookies and services
- Transactional email. We use a third-party email service provider to send you transactional emails (account confirmation, invoice, onboarding). That provider may set cookies in emails you open (for example, a 1×1 pixel read-receipt). If you prefer not to allow such tracking, you may disable image loading in your email client. Full details of the categories of email service providers used are in our Privacy Notice Section 7.
- CRM. Our CRM provider does not place any cookies during anonymous browsing of
legal.avantwerk.co.uk. Post-sign-up, the CRM operates at the account-management layer and may set functional cookies tied to your authenticated session. - Google Analytics 4. Google Analytics 4 (provided by Google Ireland Limited, with Google LLC as ultimate parent) is the only third-party analytics service used on this Site. The GA4 tag does not load until you give explicit consent via the consent banner; if the analytics measurement ID has not been activated by Avantwerk, no analytics code executes at all. We do not use Hotjar, Facebook Pixel, LinkedIn Insight Tag, TikTok Pixel or any other third-party tracking or advertising script at any point on this Site.
- Let's Encrypt. Our TLS certificate is provided by Let's Encrypt (Internet Security Research Group). Certificate validation does not set cookies and does not involve any personal data.
6. How to manage cookies in your browser
In addition to the controls we provide, you can manage cookies using your browser settings. Most browsers allow you to:
- view the cookies currently stored on your device;
- delete all or specific cookies;
- block cookies from particular sites; and
- block all third-party cookies.
Disabling strictly necessary cookies will prevent you from logging in or using core features of the Service.
Browser-specific guidance is available from the ICO at ico.org.uk/your-data-matters/online/cookies.
7. International transfers via cookies
Where a cookie places data with a third party outside the United Kingdom (for example, a CRM or email provider based in the USA), that transfer takes place under one of the mechanisms set out in our Privacy Notice Section 8 — in particular, the UK Addendum to EU Standard Contractual Clauses (IDTA) or an applicable UK adequacy instrument.
In particular, where Google Analytics 4 is enabled, personal data collected by the _ga and _ga_<container> cookies is transferred from the United Kingdom to Google LLC in the United States. That transfer is safeguarded under the UK Extension to the EU–US Data Privacy Framework and, where applicable, the UK Addendum (IDTA) to Standard Contractual Clauses, as incorporated in Google Ireland Limited's data processing terms.
8. Changes to this Cookies Policy
We review this Cookies Policy periodically and may update it to reflect changes in the cookies we use or in applicable law. Material changes will be notified through the cookie-consent banner and by updating the effective date at the top of this policy.
9. Contact and complaints
If you have any questions about our use of cookies, or wish to exercise any right under UK GDPR or PECR, please contact dpo@avantwerk.com.
If you are not satisfied with our response, you may complain to the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
0303 123 1113 · ico.org.uk