Cookie policy

1. About this policy

This policy explains how Business Quest uses cookies and similar technologies on its website and online services. It should be read alongside our Privacy Policy, which explains how we collect, use and protect personal information more generally.

Business Quest is registered in England and Wales under company number 17376281. Our registered office and correspondence address is:

128 City Road, London, EC1V 2NX, United Kingdom.

For questions about this policy, contact us at policy@businessquest.co.uk with the subject "Cookies", call +44 7348 556953, or write to the address above.

Scope

This policy applies to businessquest.co.uk and the subdomains we operate, including:

• Our public marketing website.
• The client portal and account pages.
• The assessment participant journey.
• Administrative pages.
• Invitation acceptance and password-reset flows.
• The Contact form and related enquiry pages.

It does not cover websites operated by other organisations, including third-party services we link to, such as our WhatsApp channel.

2. Legal framework

We apply the relevant UK and EU rules governing cookies and similar technologies. These frameworks are not identical, and we do not assume that an exception available under UK law automatically applies in the EU.

2.1 United Kingdom

In the UK, we apply regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025, together with the UK GDPR.

PECR generally requires consent before information is stored on, or accessed from, a user's device, unless an applicable exception applies.

The exceptions in Schedule A1 to PECR include:

• Communication.
• Strictly necessary technologies.
• Statistical purposes.
• Appearance.
• Emergency assistance.

The statistical-purposes exception applies only where the sole purpose is to collect statistical information about how a website or service is used, with a view to improving it.

The resulting information must be aggregated and must not be used to identify or track individuals. We must also provide clear and comprehensive information and a simple, free means for users to object.

Where a third-party analytics provider is involved, it must act on our behalf and only for the permitted statistical purpose.

The appearance exception also requires clear information and a simple, free means to object. We do not currently rely on the appearance or emergency-assistance exceptions.

2.2 European Union

For visitors in the EU, we apply Article 5(3) of the ePrivacy Directive 2002/58/EC, as implemented by the relevant member state, together with the EU GDPR.

The exceptions under UK law do not automatically apply in the EU. Whether consent is required for analytics and similar technologies depends on the applicable national law.

Where consent is required, we will obtain it before the relevant technology is loaded.

2.3 Consent standard

Where consent is required, it must be:

• Freely given, specific, informed and unambiguous.
• Provided through a clear affirmative action.
• Granular, allowing users to make separate choices where appropriate.
• As easy to withdraw as it was to give.
• Recorded by us.

We do not treat continued browsing as consent, use pre-ticked consent boxes or operate a cookie wall.

2.4 Our current position

We use:

• Strictly necessary cookies and browser storage.
• Cookieless analytics and performance measurement.

Based on our current assessment, the strictly necessary technologies do not require consent.

For UK visitors, we rely on the statistical-purposes exception for analytics only where all its legal conditions are satisfied. For EU visitors, we do not assume that this UK exception applies.

We do not currently display a cookie consent banner. If our assessment changes, or we introduce optional technologies that require consent, we will obtain that consent before using them.

3. Cookies and similar technologies

Cookies are small text files stored on your device by a website. They may be set directly by the website you visit (first-party cookies) or by another organisation whose content or services appear on that website (third-party cookies).

Cookies may last for a single browsing session or remain on your device for a defined period.

We also use browser storage technologies:

• Local storage (localStorage): Stores information in your browser until it is deleted by the website, you clear it, or your browser removes it.
• Session storage (sessionStorage): Stores information for the lifetime of a browser tab or session, subject to browser behaviour.

The rules governing cookies and similar technologies can also apply to browser storage. This policy therefore covers both.

4. Strictly necessary cookies and storage

We use certain technologies to provide the website and services you request. These support functions such as authentication, secure access, verification and assessment completion.

The technologies currently used for these purposes include:

Technology	Provider	Type	Purpose	Duration
Authentication cookie	Supabase, on our behalf	First-party cookie	Maintains your authenticated session when you sign in	Up to the applicable expiry period; may be renewed while you use the service
Authentication verification cookie	Supabase, on our behalf	First-party cookie	Supports secure sign-in and one-time-code verification	Short-lived or session-based
Anti-abuse verification	Cloudflare Turnstile	Third-party script and iframe; associated storage may be used	Helps protect the Contact form against automated submissions and abuse	Determined by the provider's implementation
Assessment completion session storage	Business Quest	Browser session storage	Helps prevent duplicate assessment completion submissions	Session-based, subject to browser behaviour

These descriptions identify the technologies by their functions rather than their internal technical identifiers.

The exact duration and behaviour of some technologies may depend on your browser, the service configuration and the provider's implementation.

Additional information:

• Authentication cookies are used when you sign in, accept an invitation or reset access. They are not ordinarily set on public marketing pages.
• Assessment completion session storage is used during the assessment completion process. It is browser storage, not a cookie.
• Cloudflare Turnstile may use storage as part of its verification process.
• Blocking or clearing necessary technologies may prevent you from signing in, completing an assessment or submitting a protected Contact form.

5. Analytics and performance

We use Vercel Web Analytics and Vercel Speed Insights to collect statistical information about how our website and services are used, with a view to improving their performance and usability.

In the configuration we tested, these tools did not set cookies or use browser storage.

We do not use these tools for advertising, cross-site tracking or individual behavioural profiling.

Although these tools do not currently use cookies or browser storage in the tested configuration, information collected through them may still constitute personal data. This may include IP addresses or other online identifiers. Our Privacy Policy explains how we handle such information.

5.1 United Kingdom

For UK visitors, we rely on the statistical-purposes exception in Schedule A1 to PECR only where all its conditions are met.

We use these tools solely to collect statistical information about how our website and services are used, with a view to improving them.

Any individual-level information collected for this purpose is retained only for as long as necessary to produce aggregated statistical information. The resulting statistics are not used to identify, profile or track individual visitors.

Where a third-party provider is involved, it must act only on our instructions for the permitted statistical purpose. We will rely on the exception only where the relevant contracts and configuration support this arrangement.

5.2 European Union

For visitors in the EU, we do not assume that the UK statistical-purposes exception applies.

The applicable member-state law determines whether consent is required for these technologies. Where consent is required, we will obtain it before loading the relevant analytics tools.

5.3 How to object

You can object to analytics processing by emailing policy@businessquest.co.uk with the subject "Analytics objection".

You do not need to sign in or provide unnecessary personal information.

We are also working to provide an analytics objection control on this page. Once available, it will allow you to stop analytics collection for your browser, remember your preference and reverse your choice at any time.

If you object, we will stop the relevant analytics collection for your visits.

Because analytics is designed to produce aggregated statistics, we may not be able to remove information that has already been irreversibly aggregated. Where this applies, we will explain the limitation.

6. Third-party providers and their roles

We use third-party providers to support the operation, security and performance of our services. Their legal roles depend on the specific processing activity involved.

• Supabase acts as our processor for authentication and session-related services.
• Vercel acts as our processor for hosting. For the Web Analytics and Speed Insights processing described in section 5, Vercel must act on our behalf, use the relevant information only to help us improve our website and services, and must not link that information with other information it processes. Any separate processing Vercel undertakes as an independent controller for its own purposes is distinct from this analytics activity and is not covered by our reliance on the statistical-purposes exception.
• Cloudflare acts as our processor for the Turnstile verification service. Any separate processing Cloudflare undertakes as an independent controller for its own security purposes is distinct from that verification activity.

A provider's own privacy notice does not, by itself, determine its legal role. That role depends on the nature of the processing and the applicable contractual arrangements.

We will rely on the statistical-purposes exception only where the relevant contracts and service configuration support the processor arrangement described above.

Our Privacy Policy explains the safeguards we use when personal information is transferred outside the UK or EU.

7. Consent and your choices

We do not currently use optional cookies.

The technologies described in section 4 support functions intended to be necessary for the services you request. The analytics tools described in section 5 are configured to operate without cookies or browser storage and are used for statistical purposes, subject to the applicable legal requirements.

If we introduce optional technologies, such as advertising cookies, non-essential analytics or social media features, we will:

• Obtain consent before setting or accessing technologies where required.
• Provide clear choices for accepting or rejecting relevant categories.
• Make rejecting optional technologies as easy as accepting them.
• Avoid pre-ticked boxes and implied consent.
• Allow you to withdraw consent at any time, as easily as you gave it.
• Keep an appropriate record of your consent choices.

Where we rely on the UK statistical-purposes exception, we will maintain a simple, free means for users to object.

Where consent is required for EU visitors, we will obtain it before the relevant technology loads.

We will update this policy before introducing any material change to our use of these technologies.

8. Managing cookies and browser storage

You can manage cookies through your browser settings. Most browsers allow you to view, delete or block cookies and configure exceptions for websites you trust.

Your browser's help pages explain how to manage these settings.

Cookies and browser storage are different. Clearing cookies will not necessarily remove information stored in localStorage or sessionStorage.

To remove browser storage, use your browser's site settings or clear-site-data controls for businessquest.co.uk.

Please be aware that blocking or clearing technologies necessary for the operation of our services may prevent you from signing in, completing an assessment or submitting the Contact form.

We do not currently use advertising cookies, so there is no advertising-cookie preference to manage with us.

9. How long information lasts

The duration of cookies and browser storage depends on their purpose and implementation. The relevant durations are described in section 4.

For analytics, we retain individual-level information only for as long as necessary to produce aggregated statistical information, subject to the applicable provider configuration and retention arrangements.

Our Privacy Policy explains the retention periods that apply to other personal information we process.

10. Changes and review

We review this policy whenever we introduce a new third-party integration, analytics tool, authentication mechanism or storage technology, and at least once a year.

We will publish an updated version of this policy when necessary and revise its version number and publication date.

Where a change requires consent, we will obtain it before the new technology or purpose is introduced.

11. Contact and complaints

If you have questions, concerns or complaints about our use of cookies or similar technologies, contact us through:

• Email: policy@businessquest.co.uk
• Telephone: +44 7348 556953
• Post: Business Quest Ltd, 128 City Road, London EC1V 2NX, United Kingdom.

You may also have the right to complain to the relevant data protection regulator in the UK or your local supervisory authority in the EU.

We would appreciate the opportunity to address your concerns before you approach a regulator.