Skip to content
FRATRES
Data & privacy

Cookie Policy

The cookies and similar technologies used on this website, their purposes, and how consent may be given or withdrawn.
Document reference
FGL-LEG-05
Version date
1 July 2026
Applies to
Fratres Limited

1.Interpretation and definitions

In this Cookie Policy the following capitalised terms bear the meanings given to them below. Terms defined in the UK GDPR and not otherwise defined here bear the meanings given to them in that instrument.

Company
Fratres Limited, a private company limited by shares incorporated and registered in England and Wales, being the operator of the Website and the controller in respect of Personal Data processed through it.
Website
The website published at fratresgroup.com, together with every subdomain, sub-directory and page operated by or on behalf of the Company under that domain.
Cookie
A small file, typically containing text, that is stored on Terminal Equipment when the Website is accessed and that may subsequently be read by the party that placed it.
Similar Technology
Any technique other than a Cookie by which information is stored on, or access to information stored on, Terminal Equipment is obtained, including local storage, session storage, indexed database storage, pixel tags and web beacons, script-based storage, software development kits and device or browser fingerprinting techniques.
Consent Tool
The cookie preference mechanism made available on the Website through which a Visitor may give, refuse, review and withdraw Consent by category, and which is reachable at any time from the persistent control in the Website footer.
Consent
Consent within the meaning of Article 4(11) of the UK GDPR, being a freely given, specific, informed and unambiguous indication of the Visitor’s wishes by which the Visitor, by a statement or by a clear affirmative action, signifies agreement to the storage of, or access to, information on Terminal Equipment.
PECR
The Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended.
UK GDPR
Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018, read together with the Data Protection Act 2018.
Personal Data
Personal data as defined in Article 4(1) of the UK GDPR, which expressly includes online identifiers such as those carried by Cookies.
Strictly Necessary Cookie
A Cookie or Similar Technology falling within the exemption in regulation 6(4) of PECR, being one used for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or one strictly necessary for the provision of an information society service explicitly requested by the Visitor.
Terminal Equipment
The computer, tablet, mobile telephone or other device used by a Visitor to access the Website, and the browser or application software running on it.
Business Day
Any day other than a Saturday, Sunday or public holiday in England and Wales.
Visitor
Any person who accesses the Website, whether or not that person subsequently makes an enquiry or enters into any relationship with the Company. References in this Policy to “you” are references to the Visitor.
1.1
Headings are inserted for convenience only and shall not affect the construction of this Policy.
1.2
A reference to a statute, statutory instrument or regulation is a reference to it as amended, extended, consolidated or re-enacted from time to time, and includes any subordinate legislation made under it.
1.3
The words “include”, “includes” and “including” shall be construed as being followed by the words “without limitation”, and the singular includes the plural and vice versa.
1.4
This Policy is supplemental to, and must be read together with, the Company’s Privacy Policy and Data Retention and Records Management Policy. Where there is any inconsistency between this Policy and another policy of the Company in relation specifically to Cookies and Similar Technologies, this Policy shall prevail.

2.Purpose and scope

2.1
The purpose of this Policy is to provide the clear and comprehensive information required by regulation 6(2)(a) of PECR as to the Cookies and Similar Technologies used on the Website, the purposes for which they are used, and the means by which Consent may be given, reviewed and withdrawn.
2.2
This Policy applies to the Website. It does not apply to any third-party website, platform or application to which the Website links. Where a Visitor follows a link away from the Website, the cookie practices of the destination site govern that visit, and the Visitor should consult the notice published there.
2.3
This Policy applies to every Visitor, wherever located. The Company operates the Website from the United Kingdom and applies the standard required by PECR and the UK GDPR as its baseline for all Visitors, including Visitors accessing the Website from Bangladesh or any other jurisdiction in which the Company operates.
2.4
Nothing in this Policy limits or excludes any right a Visitor may have under the law of the jurisdiction in which that Visitor is located. Where local law confers a higher standard of protection than that set out in this Policy, the Company shall apply the higher standard.
2.5
This Policy governs storage of and access to information on Terminal Equipment. The Company’s Terms and Conditions of Website Use govern the wider terms on which the Website may be accessed and used.

4.What cookies and similar technologies are

4.1
A Cookie is a small file placed on Terminal Equipment when a Visitor accesses the Website. It is returned to, or read by, the party that placed it on subsequent requests, allowing that party to recognise the browser, maintain continuity between page requests, and record information such as a preference or a security token.
4.2
Cookies are either session cookies, which are erased when the browser session ends, or persistent cookies, which remain on Terminal Equipment until they reach a stated expiry point or are deleted by the Visitor.
4.3
A number of other techniques achieve comparable results without using a Cookie file. These include:
  • local storage and session storage, in which values are held by the browser and read back by scripts served from the Website;
  • indexed database storage, used to hold structured data on Terminal Equipment;
  • pixel tags and web beacons, being small transparent image or script requests whose retrieval records that a page or element has been loaded;
  • software development kits embedded within applications; and
  • device and browser fingerprinting, in which a combination of configuration characteristics is used to recognise Terminal Equipment without storing anything on it.
4.4
References in this Policy to Cookies include Similar Technologies. The Company applies the same Consent standard to every technique that stores information on, or gains access to information stored on, Terminal Equipment, irrespective of the technology used and irrespective of whether that technique is described as a cookie.
4.5
The Company does not use Cookies or Similar Technologies for advertising, behavioural targeting, retargeting, cross-site tracking, the construction of individual profiles, or automated decision-making. The Company does not sell, rent or otherwise make available for consideration any data collected by means of Cookies, and does not participate in any advertising exchange, data co-operative or real-time bidding arrangement.
4.6
The Company does not use device or browser fingerprinting to identify or recognise individual Visitors. Where any such technique were to be introduced, it would require Consent in the same way as a Cookie, and this Policy would be amended before it was deployed.

5.Categories of cookies used

5.1
The Company operates three categories of Cookie on the Website, and no others: strictly necessary, preference, and analytics. The Consent Tool presents these categories separately and permits Consent to be given or refused for each category independently.
5.2
Strictly necessary. These Cookies are required for the Website to function and to be secure. They are used for the following purposes:
  • (a)routing requests and maintaining the integrity and continuity of a browsing session across page requests;
  • (b)security functions, including the generation and validation of the token that protects the enquiry form against cross-site request forgery;
  • (c)detecting and limiting abusive or automated traffic, including rate limiting and the mitigation of denial-of-service activity;
  • (d)balancing load between servers so that a Visitor’s requests are served consistently;
  • (e)recording the Consent choices made through the Consent Tool, so that those choices persist and are honoured on subsequent page requests; and
  • (f)recording that an informational notice has been read and dismissed, so that it is not shown repeatedly.
5.3
Strictly necessary Cookies fall within the exemption in regulation 6(4) of PECR and are therefore set without Consent. They cannot be disabled through the Consent Tool, because the Website cannot be delivered securely without them. They are described in this Policy in full notwithstanding the exemption, so that Visitors are informed of everything placed on their Terminal Equipment. They may still be blocked at browser level, with the consequences set out in clause 12.
5.4
Preference. These Cookies record choices a Visitor has made so that they do not have to be made again on a later visit. They are used to remember display and accessibility settings such as a reduced-motion preference or a text size selection, a language or regional selection where one is offered, and the state of expandable sections of a page. Preference Cookies are not strictly necessary. They are set only where the Visitor has given Consent to the preference category.
5.5
Analytics. These Cookies allow the Company to understand, in aggregate, how the Website is used, so that its content and structure can be improved. They are used to record the pages viewed within a visit and the sequence in which they were viewed, the general category of referring source, the browser and device type and screen dimensions, approximate location at country or regional level only, and technical errors encountered. Analytics Cookies are set only where the Visitor has given Consent to the analytics category.
5.6
The Company configures its analytics processing so that, so far as the relevant service permits: internet protocol addresses are truncated or anonymised at the point of collection; identifiers are not combined with data from any other site or source; no data collected through the Website is used by the provider for its own purposes; and no cross-site or cross-device identifier is created.
5.7
The Company operates no advertising, marketing or social media tracking category. If the Company were to introduce a further category of Cookie, no Cookie in that category shall be set until Consent has been obtained in accordance with clause 7 and this Policy has been amended to describe it.
Where the specific details are listed

The name, provider, category, stated purpose and storage duration of every individual Cookie in use at any given time are set out in the Consent Tool, which is reachable from the persistent control in the Website footer. That register is generated from the Website as it is actually configured and is therefore the authoritative record; this Policy describes the categories and purposes that the register is permitted to contain.

6.First party and third party cookies

6.1
A first party Cookie is one set by the domain the Visitor is visiting, namely the Website itself. A third party Cookie is one set by a different domain whose content or service is called by a page of the Website, such as an analytics service, a content delivery or security provider, or an embedded item of media.
6.2
The Company minimises reliance on third party Cookies. Strictly necessary and preference Cookies are, so far as practicable, set as first party Cookies by the Website itself.
6.3
Where a third party is engaged, the Company assesses whether that party acts as a processor on the Company’s documented instructions or as a controller in its own right. Where the party acts as a processor, the Company shall engage it only under a written contract containing the provisions required by Article 28 of the UK GDPR, including obligations of confidentiality, security, sub-processor control, assistance with data subject rights, and deletion or return of data at the end of the engagement.
6.4
The Company does not permit any third party to use data collected through the Website for that party’s own advertising, profiling or cross-site purposes, and shall not engage a provider whose standard terms reserve such a right.
6.5
Embedded third party content, such as a map, a video or a document viewer, may set Cookies at the moment it loads. Where such content is used, the Company shall either withhold it until Consent has been given to the relevant category, or load it in a mode offered by the provider that sets no Cookie until the Visitor interacts with it.
6.6
Where a third party engaged in connection with the Website processes Personal Data outside the United Kingdom, the Company shall ensure that the transfer is made in accordance with Chapter V of the UK GDPR, relying on adequacy regulations made under section 17A of the Data Protection Act 2018 or, in their absence, on the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission standard contractual clauses, supported by a transfer risk assessment. The Company’s International Data Transfer Statement sets out that framework in full.
6.7
The engagement of a third party does not diminish the Company’s accountability. The Company remains responsible under Article 5(2) of the UK GDPR for demonstrating compliance in respect of all processing carried out on its behalf.

9.Lawful basis for processing

9.1
Information held in or conveyed by a Cookie may constitute Personal Data, because Article 4(1) of the UK GDPR treats online identifiers as capable of identifying an individual. Where that is the case, the Company must have a lawful basis under Article 6(1) of the UK GDPR in addition to satisfying regulation 6 of PECR.
9.2
For preference and analytics Cookies, and for any Personal Data derived from them, the Company relies on the Visitor’s Consent under Article 6(1)(a) of the UK GDPR. Where PECR requires Consent to the storage or access, the Company does not rely on legitimate interests for the processing that follows.
9.3
For Strictly Necessary Cookies, which are exempt from the Consent requirement under regulation 6(4) of PECR, the Company relies on Article 6(1)(f) of the UK GDPR. The legitimate interests pursued are the secure, available and reliable operation of the Website, the protection of the Website and its users against abuse and attack, and the recording of Consent choices so that those choices are honoured. A balancing assessment has been carried out and recorded, and is available on request through the enquiry form.
9.4
A Visitor may object to processing carried out under Article 6(1)(f) in accordance with Article 21 of the UK GDPR. Where an objection is upheld in respect of a Strictly Necessary Cookie, parts of the Website may not be capable of being delivered.
9.5
The Company does not use Cookies to process special category data within the meaning of Article 9 of the UK GDPR, or data relating to criminal convictions and offences within the meaning of Article 10 and Part 3 of Schedule 1 to the Data Protection Act 2018, and relies on no condition for such processing in connection with the Website.
9.6
No decision producing legal effects concerning a Visitor, or similarly significantly affecting a Visitor, is taken on the basis of Cookie data, whether by automated means or otherwise, and Article 22 of the UK GDPR is not engaged.
9.7
The Company’s Privacy Policy sets out in full the categories of Personal Data processed, the recipients of that data and the rights of data subjects. This Policy governs only the storage and access step and the processing that follows directly from it.

10.Duration, storage and retention

10.1
Session Cookies used by the Website expire when the browser session ends. Persistent Cookies remain on Terminal Equipment until the expiry point recorded in the Cookie is reached or the Visitor deletes them.
10.2
The Company shall set no Cookie with a lifespan longer than is necessary for the purpose for which it is set, and shall review the duration of every persistent Cookie whenever this Policy is reviewed under clause 16.
10.3
The storage duration applicable to each individual Cookie in use is disclosed in the Consent Tool at the point at which Consent is sought, alongside the name of the Cookie, the party that sets it, its category and its purpose. Durations are stated there rather than in this Policy so that the disclosure always reflects the Website as configured.
10.4
Data generated by analytics Cookies is retained in accordance with the Company’s Data Retention and Records Management Policy. Analytics identifiers are not retained beyond the period stated in that policy, after which the underlying data is retained, if at all, only in aggregated form from which no individual can be identified.
10.5
Records of Consent are retained for so long as is necessary to demonstrate compliance with Article 7(1) of the UK GDPR and to evidence the Company’s position in the event of a regulatory enquiry, and are then deleted.
10.6
The Company applies appropriate technical and organisational measures under Article 32 of the UK GDPR to information stored on or read from Terminal Equipment, including transmission over an encrypted connection and restriction of Cookie access by scope and by domain.

11.Browser and device controls

11.1
Independently of the Consent Tool, a Visitor may control Cookies through the settings of the browser or device used to access the Website. These controls operate on all websites, not only this one, and take effect whether or not the Consent Tool is used.
11.2
Most current browsers, including the desktop and mobile versions of the widely used browser families, provide controls that allow a user to:
  • view the Cookies and stored site data currently held, by site;
  • delete individual Cookies, all Cookies for a given site, or all Cookies stored;
  • block all Cookies, or block third party Cookies only;
  • clear Cookies and site data automatically when the browser is closed;
  • set permissions on a per-site basis, allowing storage for some sites and refusing it for others;
  • browse in a private or incognito mode, in which storage is discarded at the end of the session; and
  • send an automated preference signal of the kind described in clause 13.
11.3
These controls are ordinarily found under the privacy, security or site settings section of the browser’s preferences. Because their location and naming differ between browsers and change between versions, a Visitor should consult the help documentation published by the supplier of the browser in question. The Company does not administer, and cannot alter, any browser setting.
11.4
Browser and device controls are specific to the browser and device on which they are set. A Visitor who uses more than one browser, or more than one device, must apply the chosen settings on each of them separately.
11.5
Because the record of Consent choices is itself stored on Terminal Equipment, deleting Cookies or clearing site data will delete that record. The Consent Tool will then be presented again on the next visit and the Visitor’s choices must be made again. This is a consequence of storing the choice locally rather than in an account, and is intended: the Company does not require a Visitor to identify themselves in order to express a preference.

12.Consequences of blocking or deleting

12.1
A Visitor is entitled to refuse or delete any Cookie. This clause sets out, so that the choice is an informed one, what follows from doing so.
12.2
Blocking strictly necessary Cookies at browser level will impair the operation of the Website. In particular, the enquiry form may fail to submit because the security token that protects it cannot be validated; session continuity between pages may be lost; protective measures against automated abuse may reject otherwise legitimate requests; and the Consent Tool will be presented on every page because the choice cannot be recorded.
12.3
Refusing or deleting preference Cookies will not prevent the Website from working, but choices such as a reduced-motion setting, a text size selection or a language selection will not persist and must be made again on each visit.
12.4
Refusing or deleting analytics Cookies has no effect on any function of the Website and no detriment of any kind to the Visitor. The only consequence falls on the Company, which loses aggregate insight into how the Website is used.
12.5
The Company shall not withhold, degrade or delay access to any substantive content of the Website, and shall not restrict the enquiry route, on the ground that a Visitor has declined a non-essential category. Access to the Website is not conditional on Consent.
12.6
Where a third party page reached by a link from the Website behaves differently when Cookies are blocked, that behaviour is a matter for the operator of that page and outside the Company’s control.

Declining analytics and preference Cookies costs a Visitor nothing. Every page of substantive content on this Website, and the enquiry form itself, is fully available to a Visitor who accepts only strictly necessary Cookies.

13.Do Not Track and preference signals

13.1
Do Not Track is a setting available in some browsers which causes an additional field to be included in requests sent to websites, indicating that the user would prefer not to be tracked across sites.
13.2
There is no accepted technical standard, and no legal requirement in the United Kingdom, prescribing how a website must interpret or respond to a Do Not Track field. The Website therefore does not alter its behaviour by reference to that field alone, and the Company does not represent that it does.
13.3
The practical position is that the Company sets no non-essential Cookie without Consent in any event. A Visitor whose browser sends a Do Not Track field and who does not give Consent through the Consent Tool is in exactly the same position as a Visitor who declines every non-essential category, and the Company operates no cross-site tracking or profiling from which such a Visitor would need to be excluded.
13.4
Where a recognised technical standard is established, or where a legal obligation arises to give effect to a specified automated preference signal, including a signal of the kind described as a Global Privacy Control, the Company shall implement that signal and amend this Policy accordingly.
13.5
Browser-level blocking, and the removal of Consent through the Consent Tool, are effective now and do not depend on the resolution of any standard. A Visitor who wishes to prevent non-essential storage should use those mechanisms rather than rely on a Do Not Track field.

14.Rights of individuals

14.1
Where information collected through Cookies constitutes Personal Data, a Visitor has the rights conferred by Chapter III of the UK GDPR, namely the right of access under Article 15, the right to rectification under Article 16, the right to erasure under Article 17, the right to restriction of processing under Article 18, the right to data portability under Article 20 in respect of data processed on the basis of Consent by automated means, and the right to object under Article 21.
14.2
A Visitor also has the right under Article 7(3) of the UK GDPR to withdraw Consent at any time, exercisable as described in clause 8.
14.3
Requests under this Policy should be submitted through the enquiry form at fratresgroup.com/contact. The Company shall acknowledge a request within five Business Days and shall respond substantively without undue delay and in any event within one month of receipt, in accordance with Article 12(3) of the UK GDPR. Where a request is complex or where a number of requests have been received, that period may be extended by up to two further months, in which case the Company shall inform the Visitor of the extension and the reasons for it within one month of receipt.
14.4
No fee is charged for responding to a request. Where a request is manifestly unfounded or excessive, the Company may charge a reasonable fee reflecting its administrative costs, or refuse to act on the request, in accordance with Article 12(5) of the UK GDPR, and shall in either case explain the reason and the routes of challenge.
14.5
The Company may require verification of identity before acting on a request. Any information requested for that purpose shall be proportionate, used only for verification, and deleted once verification is complete.
14.6
Where the Company is not in a position to identify a Visitor from Cookie data alone, Article 11 of the UK GDPR applies and the Company is not obliged to acquire additional information for the sole purpose of complying with a request. In such a case the Company shall inform the Visitor, and the Visitor may provide additional information enabling identification.

15.Enquiries and complaints

15.1
Questions about this Policy, about a particular Cookie, or about the operation of the Consent Tool should be raised through the enquiry form at fratresgroup.com/contact. Enquiries are acknowledged within five Business Days.
15.2
A complaint about the Company’s handling of Cookies or of Personal Data is dealt with under the Company’s Complaints Handling Procedure, which sets out the acknowledgement and investigation timetable and the internal escalation route.
15.3
A Visitor has the right to lodge a complaint with the Information Commissioner’s Office, which is the supervisory authority for the United Kingdom and the authority responsible for enforcing both PECR and the UK GDPR. That right arises under Article 77 of the UK GDPR and section 165 of the Data Protection Act 2018, and details of how to complain are published by that office at ico.org.uk.
15.4
A Visitor is not required to complain to the Company before approaching the Information Commissioner’s Office. The Company nonetheless asks to be given the opportunity to resolve a concern first, and will not treat a complaint to the regulator as a reason to decline to engage.
15.5
Nothing in this Policy affects a Visitor’s right to an effective judicial remedy under Articles 78 and 79 of the UK GDPR, or to bring proceedings under section 167 or to claim compensation under section 168 of the Data Protection Act 2018.

16.Review, amendment and status

16.1
This Policy is reviewed at least annually, and in any event whenever the Website’s use of Cookies or Similar Technologies changes, whenever a new third party is engaged in connection with the Website, and whenever applicable law or regulatory guidance changes materially.
16.2
The version date and the document reference shown at the head of this Policy identify the version in force. The version in force at the time of a visit is the version that governs that visit.
16.3
Where an amendment introduces a new category or purpose, or otherwise materially alters the basis on which information is stored on or read from Terminal Equipment, the Company shall obtain fresh Consent before the amendment takes effect and shall not rely on Consent given in respect of an earlier version.
16.4
Amendments that do not materially alter the categories, purposes or parties involved, including clarifications of drafting, take effect on publication of the amended Policy on the Website.
16.5
This Policy is issued by the Company, registered in England and Wales, and is approved at board level. Responsibility for its operation rests with the officer of the Company responsible for data protection compliance, who may be reached through the enquiry form at fratresgroup.com/contact.
16.6
This Policy and any dispute arising out of or in connection with it, whether contractual or non-contractual, is governed by the law of England and Wales, without prejudice to any mandatory protection available to a Visitor under the law of the jurisdiction in which that Visitor is habitually resident.
Related policies

This Policy should be read with the Privacy Policy, which describes all processing of Personal Data by the Company; the Data Retention and Records Management Policy, which sets the periods for which records are held; the International Data Transfer Statement, which governs transfers outside the United Kingdom; and the Terms and Conditions of Website Use, which govern access to the Website generally. All are published in the legal register.

Related policies
Privacy PolicyFGL-LEG-04Data Retention & Records Management PolicyFGL-LEG-06International Data Transfer StatementFGL-LEG-07
Full legal register