EnableGRC
Register interest

Route: /cookies/policy (matches MyJourneys architecture per Website Build Brief §2)

Cookie Policy

Effective: 16 July 2026. Version: 1.0.

This policy explains the cookies and similar technologies used on enablegrc.ai. It sits alongside our Privacy Notice.

1. Plain-English summary

We use the minimum cookies required for the site to work, plus one for a meetings-booking widget you may interact with. We do not use advertising cookies, tracking pixels, or cross-site identifiers. Our analytics platform (Plausible) is cookieless — it uses aggregate, anonymous data only.

You don’t need to accept anything to read our pages. You’ll only see a consent request if you open the meetings-booking widget on the Contact page.

A cookie is a small text file placed on your device by a website you visit. Cookies typically store settings (e.g. your preference for dark mode), session state (e.g. “you’re logged in”), or analytics data. Similar technologies (localStorage, sessionStorage, pixels) work in related ways.

3. Cookies we use

3.1 Strictly necessary (always on)

Required for the site to function. No consent required under GDPR.

Name Purpose Duration Source
mj_cookie_prefs Remembers your cookie preferences on this site 12 months EnableGRC (first-party)
cf_clearance Cloudflare bot-protection session token Per visit Cloudflare

These are set only if you open and use the HubSpot meetings widget on the Contact page.

Name Purpose Duration Source
__hs_opt_out Records whether you’ve opted out of HubSpot tracking 13 months HubSpot (third-party)
hubspotutk Identifies a booking session 13 months HubSpot (third-party)
messagesUtk Identifies you if you return to complete a booking 13 months HubSpot (third-party)

Consent: by opening and interacting with the booking widget, you consent to these cookies being set. You can decline by not opening the widget — our Contact page provides an email alternative.

3.3 Analytics (no cookies used)

We use Plausible Analytics, which is cookieless. Plausible calculates aggregate metrics (page views, referrers, device categories) using anonymised, non-persistent request signals. No personal data is stored, no cross-site profile is built, and no cookie is set.

Because Plausible uses no cookies and holds no personal data, no consent is required under GDPR or the Gibraltar equivalent.

3.4 Marketing / advertising

We do not use marketing or advertising cookies on this site.

  • On this site: you can open the cookie preferences panel at any time by clicking “Cookie preferences” in the footer.
  • In your browser: all modern browsers let you block or delete cookies. See aboutcookies.org or your browser’s help for instructions.
  • Do Not Track: this site respects the DNT browser signal by disabling optional cookies when DNT is set.

Note: blocking strictly-necessary cookies may impair basic site features (e.g. remembering your preferences).

5. Changes

We may update this policy if our cookie usage changes. The effective date is shown at the top.

6. Contact

Questions about this policy: privacy@enablegrc.ai.

For the drafter implementing the banner (matches MyJourneys architecture):

// src/components/CookieBanner.tsx
// Shows on first visit (no mj_cookie_prefs cookie present).
// Bottom-right floating panel, not a full-screen overlay.
// Three buttons: "Accept all", "Necessary only" (default-preferred), "Customise"
// "Customise" opens the /cookies/policy page with preferences visible.
// Writes mj_cookie_prefs = {"necessary": true, "functional": false|true} for 12 months.
// HubSpot widget checks mj_cookie_prefs.functional before loading.
// Plausible loads regardless (cookieless).

End of Legal Pack v1.0 — 20 April 2026, 18:20 UK. Three MDX files ready to drop into src/content/legal/ + cookie banner spec.