QR Express Logo

Cookie Policy

Last updated:

How QR Express uses cookies and similar technologies on qrexpress.co.uk, and how you can manage them.

Draft — pending legal review

This document is currently a draft. It is published in good faith but has not yet been reviewed by qualified legal counsel. Please contact us if anything looks wrong or unclear.

This policy is currently in draft and pending legal review. A cookie consent banner has not yet been deployed on the site; it will be added in a separate change. Until then, only strictly necessary cookies should be considered active by default, and non-essential cookies described below are flagged as pending consent.

1. What cookies and similar technologies are

A cookie is a small text file that a website saves on your device when you visit. It lets the site recognise your device on later visits and store small pieces of information (for example, a session identifier, a language preference, or an analytics ID).

We also use similar technologies with comparable functions, such as:

  • localStorage / sessionStorage — small key-value stores in your browser,
  • pixels / web beacons — tiny images that signal that a page was loaded,
  • device fingerprinting in a limited form for security and fraud prevention.

Throughout this policy we use “cookies” as a shorthand for all of these.

2. Categories of cookies we use

We group cookies into four categories. The actual list of individual cookies is maintained in our cookie register and will be exposed in the consent banner once it is live.

2.1 Strictly necessary

These cookies are required for the website and the QR Express application to function. They cannot be switched off through our cookie controls.

  • Purpose: session management, authentication, CSRF protection, load balancing, remembering whether you accepted the cookie banner.
  • Lawful basis: these cookies fall within the “strictly necessary” exception under PECR (Privacy and Electronic Communications Regulations) and Article 5(3) of the ePrivacy Directive — no consent required. Underlying personal data is processed under our legitimate interest (UK GDPR Art. 6(1)(f)) in providing a secure service.
  • Retention: typically session-length, up to .

2.2 Functional / preference

These remember choices you make to give you a better experience.

  • Purpose: remembering language (EN/PL), region, accessibility preferences, and similar non-essential UI state.
  • Lawful basis: consent.
  • Retention: typically up to 12 months.

2.3 Analytics

We use analytics to understand which pages and features are used, where users come from, and what we should improve. We rely on:

  • Self-hosted, Umami-compatible analytics at stats.bytegears.com. This is a privacy-focused analytics tool that does not use cross-site tracking cookies; it stores aggregated and pseudonymised data.
  • PostHog — product analytics covering feature usage, funnels, and session-level events. May set cookies on your device.

Details:

  • Purpose: measuring aggregate traffic, understanding conversion flows, debugging product issues.
  • Lawful basis: consent (we treat all analytics as non-essential, even our self-hosted, low-impact stats, until consent is obtained).
  • Retention: event-level data typically retained .
  • Provider privacy pages: PostHog — , Umami — .

2.4 Marketing / support

  • Tawk.to live chat — provides the in-page chat widget so you can talk to our support team. Sets cookies to maintain the chat session, remember whether the widget was minimised, and identify returning visitors.
  • We do not currently run third-party advertising pixels (no Facebook Pixel, no Google Ads remarketing). If that changes, we will update this policy and ask for consent before activating them.

Details:

  • Purpose: providing live chat support and remembering your chat state.
  • Lawful basis: consent.
  • Retention: typically up to 12 months, see .

3. How to manage cookies

Until our in-product consent banner is deployed, you can manage cookies through your browser controls. Most browsers let you:

  • view the cookies stored for a given site,
  • delete cookies on demand or automatically on close,
  • block third-party cookies,
  • block all cookies (note: this may break parts of the Service).

Guides for the major browsers:

  • Google Chrome —
  • Mozilla Firefox —
  • Apple Safari —
  • Microsoft Edge —

You can also use browser-level “Do Not Track” or Global Privacy Control signals. We honour Global Privacy Control where technically feasible.

When the consent banner is live, you will be able to accept or reject each non-essential category from a settings panel that is always reachable via a “Cookie preferences” link in the footer.

4. Changes to this policy

We will update this policy when we add, remove, or materially change a cookie or similar technology. The “Last updated” date at the top shows when it was last revised.

5. Contact

If you have any question about cookies, write to us at contact@qrexpress.co.uk.

BYTEGEARS LTD, company number 12638514, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.