Cookie notice
The two cookies this site sets, why they are exempt from needing your consent, and what would have to change for that to stop being true.
In short
- Four cookies. Three are needed to run the site. One is analytics, and it is not set unless you say yes.
- No advertising, no remarketing, no session recording, and nothing sold or shared for anyone else's purposes.
- Say no and nothing on this site works any differently. You can change your answer on this page whenever you like.
A summary, for orientation. The clauses below are the ones that bind us.
On this page
What this site sets
| Name | What it does | How long it lasts | Waits for your yes |
|---|---|---|---|
| duneair_access | Remembers that you proved an order is yours, so you don't have to do it again on every page. | Thirty minutes, extended while you're using it. | No — needed to run the site |
| __stripe_mid, __stripe_sid | Set by Stripe on the checkout page to detect card fraud. Set only when you reach payment, and read only by Stripe. | A year, and half an hour, respectively. | No — needed to run the site |
| duneair_consent | Remembers whether you said yes or no to analytics, so you are not asked again on every page. Holds your answer and the date you gave it, and nothing else. | Six months, then we ask again. | No — needed to run the site |
| _ga, _ga_XXXXXXXX | Google Analytics. Counts you as one returning visitor rather than several new ones, so we can see which pages get used and where the quote loses people. Set only if you accept. | Two years. | Yes |
The first is ours and cannot be read by JavaScript, which is what stops it being stolen by a script on the page. Stripe's two are set when the payment form loads, and only then — visit the site without reaching checkout and they never appear. The last two are Google's, and they do not exist at all unless you accept.
That table is generated from the same list the site's code reads when it sets a cookie. It cannot fall behind what actually gets set, and a cookie that skipped the question would show up in it as a contradiction rather than quietly not being mentioned.
The analytics, and why we ask
We use Google Analytics to count visits and to see which pages get used — most of all, which question in the quote is the one people give up on. Until August 2026 we measured nothing at all, which was a real cost: we could not tell which parts of this site worked.
UK law changed in June 2026 to let analytics used purely for statistics run on an opt-out footing. We could probably have relied on that and skipped the question. We do not, because the tool is Google's rather than ours — stretching a statistical-purposes exemption to cover a third party's own interest in your data is not a call we get to make on your behalf.
What analytics does not mean here
Your name, email address, full postcode and order details are never sent to Google. When you join the newsletter we record the first half of your postcode — the BN1, not the rest — so we know which parts of the country to recruit installers in. On its own that is a district of several thousand homes, and it is not attached to anything that identifies you.
Saying no, and changing your mind
Refusing is one click, in the same place and at the same size as accepting. There is no hidden second menu, and no button that means neither.
Checking what you chose…
Turning analytics off does not just stop the sending — it deletes the two Google cookies from this browser there and then. Your answer is remembered for six months, after which we ask again rather than assuming an old yes still holds.
Turning them off
Your browser can block or delete cookies, and you do not need our permission. Blocking ours has a specific consequence rather than a vague one: you will have to prove ownership of your order every time you open the page, and the payment form may refuse to load.
Nothing else on the site depends on them. You can read every guide, get a price and browse the shop with cookies switched off entirely.
If we add anything else
An earlier version of this notice said that if we ever added analytics, this page would be updated before the tool went live rather than after, and that we would say what we added, why, and how to switch it off. That is what this is. It shipped in the same commit as the tag.
The rule going forward, rather than a promise about one particular tool: anything not strictly necessary to do something you asked for waits behind the same yes, appears in the table above with a Yes in the last column, and is named here before it goes live. Nothing gets added to the accepted bucket by quietly widening what an old yes covered — if the scope changes, every stored answer is discarded and everybody is asked again.
Questions go to privacy@duneair.com.
What this document is written against
- Privacy and Electronic Communications Regulations 2003, regulation 6Requires consent for storage that is not strictly necessary for a service the user requested. Everything below is.
- UK GDPR, Articles 4(11) and 7Sets what consent has to be — freely given, specific, and as easy to withdraw as to give. The control in clause 3 is that requirement, not a courtesy.
- Data (Use and Access) Act 2025Would have let statistical analytics run on an opt-out footing from 19 June 2026. Clause 2 says why we did not take it.