Cookie Policy

1. About this policy

Cookies are small files a site stores in your browser. Local storage works similarly but is not sent back to the server with each request. This policy covers both, for this website and the Fish Planet London customer portal. It sits alongside our Privacy Policy and Terms & Conditions.

2. Cookies on this website

This marketing site sets no cookies at all. It uses one item of browser local storage:

• banner-closed — local storage, not a cookie. Records that you dismissed the store information banner so it is not shown to you again. It contains only the value "true", is readable only by this site, is never sent to our server, and stays until you clear your browser storage.

The newsletter form in the footer submits your name and email address directly to our own server and does not rely on any cookie.

3. Cookies in the customer portal

The customer portal sets two first-party cookies. Both are necessary for it to work; neither is used for advertising or cross-site tracking.

• Sign-in session cookie (name begins sb-) — keeps you signed in and holds your session token. It cannot be read by scripts in the page, is restricted to our own domain, is sent only over HTTPS in production, and expires after 30 days. It is deleted when you sign out.
• fp_world — remembers which section of the portal you last viewed (for example aquatics or terrariums) so the right one opens next time. It holds only that preference, is readable by scripts in the page because the interface needs it, and expires after one year.

Purpose classification: both are strictly necessary or preference cookies. We set no analytics, performance or advertising cookies anywhere — see the Analytics section of the Privacy Policy.

4. Third-party storage

The portal embeds two third-party components in pages where they are needed: the payment provider's card fields at checkout, and a bot-protection challenge on the sign-in and sign-up forms. These run in the provider's own frame and may set their own cookies or storage for security and fraud prevention. We do not control those and cannot read them.

TODO: Verify in a browser which cookies and storage keys the payment and bot-protection components actually set, and list them by name, purpose and duration. This is not determinable from our source code.

TODO: Confirm whether the hosting platform or any CDN in front of the site sets cookies of its own (for example load balancing or edge routing cookies), and name the platform.

5. Consent

There is currently no cookie consent banner on either site. That reflects the inventory above: no analytics, advertising or tracking storage is in use. A consent gate is wired into the marketing site and stays dormant until a measurement ID is configured; when that happens the banner will appear and this section will need a rewrite.

TODO: Legal review required. Confirm whether the storage listed above is exempt from consent under the applicable rules, or whether a notice or banner is required — in particular for the portal preference cookie and for any third-party storage found by the verification in section 4.

TODO: Before setting NEXT_PUBLIC_GA_MEASUREMENT_ID in production: update this page and the Privacy Policy to name Google Analytics 4, the cookies it sets, their purpose and duration, and the legal basis relied on. The technical gate already refuses to load the tag until the visitor accepts, but the legal copy must match.

6. How to control cookies and storage

You can delete or block cookies and clear local storage in your browser settings, and most browsers let you do this per site. Blocking the sign-in session cookie will prevent you from staying signed in to the portal. Clearing local storage on this site will simply make the store banner appear again.

TODO: Decide whether to add per-browser instructions or links, and keep them accurate if added.

7. Changes to this policy

We may update this policy. The version in force is the one published on this page.

8. Contact us

Email fishplanetlondon@gmail.com or call +44 2046259881.