Policy · Cookies

Cookie policy.

GAAS LAW uses cookies and similar technologies to run the site, remember your preferences and (with your consent) understand how the platform is used. This page lists every cookie set and explains the legal basis for each.

Last updated: June 2026·Version 1.0·UK GDPR · EU GDPR · PECR · CCPA / CPRA · LGPD · Quebec Law 25

Your Choice

Manage your cookie preferences.

You can change your cookie choices at any time. Your preferences and consent are recorded for 12 months and a confidential audit record is retained per Article 7(1) UK GDPR.

Category

Always active

Strictly necessary

Site operation: load balancing, secure logins, session continuity, CSRF protection, consent storage.

Cookie / token	Type	Duration	Purpose
gaaslaw_session	First-party · HttpOnly · Secure	7 days	Authenticated session for /app and /admin routes.
gaas_consent_v1	First-party	12 months	Records your cookie preferences.
gaaslaw_demo_mode	First-party	Session	Tracks Demo Mode state on the protected app shell.

Legal basis: Legitimate interest · PECR Regulation 6(4) (strictly necessary exemption)

Category

Functional

Remembers preferences such as accessibility settings, draft form retention and dismissed banners. Not used for tracking.

Cookie / token	Type	Duration	Purpose
ui_preferences	First-party	12 months	Layout / accessibility preferences.
banner_dismissed	First-party	12 months	Suppresses re-shown trust strips after dismissal.

Legal basis: Consent · UK GDPR Art. 6(1)(a)

Category

Analytics

Pseudonymous, aggregated usage measurement to understand how the platform is used. We do not use this to identify individuals or to build advertising profiles.

Cookie / token	Type	Duration	Purpose
GTM dataLayer (in-memory)	Tag manager queue	Session	Buffers analytics events for downstream tools when enabled.

Legal basis: Consent · UK GDPR Art. 6(1)(a) + PECR Regulation 6(1)

Category

Marketing

Campaign attribution and lead-source measurement (UTM parameters, conversion events). We do not run third-party advertising networks. No cross-site advertising profiles are built.

Cookie / token	Type	Duration	Purpose
utm_source / utm_medium / utm_campaign	Query-string parameters (not persisted)	Per page view	Source attribution for enquiry forms.

Legal basis: Consent · UK GDPR Art. 6(1)(a)

US California · CCPA / CPRA

Do Not Sell or Share My Personal Information.

California residents have the right to opt out of the “sale” or “sharing” of their personal information as defined under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

GAAS LAW does not currently sell or share personal information. We provide the opt-out control in the cookie preferences modal so the choice is recorded if our practices ever change. We also honour the Global Privacy Control (GPC) signal: if your browser sends Sec-GPC: 1 we pre-disable analytics + marketing and apply the CCPA opt-out automatically.

Equivalent opt-out signals from Colorado, Connecticut, Virginia, Utah, Texas and other US state privacy laws are honoured under the same mechanism.

International

Cross-border compliance.

United Kingdom
UK GDPR · PECR · ICO guidance (2023+)
European Union
GDPR · ePrivacy Directive · EDPB 03/2022
France
CNIL recommendations · 13-month consent cycle
California, USA
CCPA / CPRA · GPC signal honoured
Brazil
LGPD · ANPD guidance
Quebec, Canada
Law 25 (Loi 25)
Switzerland
revFADP / nFADP
India
DPDP Act 2023

Contact · Data Privacy

Privacy enquiries.

To exercise any data protection right — access, rectification, erasure, restriction, objection, portability, or opt-out of sale/share — contact GAAS LAW via the route in our Privacy Policy. Cookie-related questions can use the same channel.

Read the Privacy Policy