Skip to main content
SearchEnquiry basket

Cookie policy

Two strictly necessary cookies, and — only if you accept — Google Analytics and Google's advertising measurement on the public pages. Nothing beyond the necessary two happens until you answer, and none of it runs while you are signed in.

Effective from

What is necessary, what we ask for, and how to say no

Two of the cookies below are strictly necessary: without them you could not sign in, and the site could not tell a real form submission from a forged one. Those you cannot turn off and still use the site, and you are entitled to know exactly what they are — so here they are.

Everything else is asked for. On your first visit to a public page a notice at the foot of the screen asks whether you accept Google Analytics and Google's advertising measurement; until you answer, both are switched off — not paused, not partially on. That is enforced in the page itself: the tag is told analytics and advertising are denied before it is allowed to measure anything, and only your acceptance changes it.

We ask because we want to know which pages and products people actually use, and because we advertise. Neither loads while you are signed in, so no quotation, order or account page of yours is ever measured. Refusing changes nothing about how this site works, we do not ask again on every visit, and you can change your answer at the bottom of this page whenever you like.

The cookies this site sets

  • csrf_tokenStrictly necessary. Ties a form submission to your browser, so another site cannot forge one
  • csrf_token — lifetimeThe browser session
  • ictlab_sessionStrictly necessary. Keeps you signed in. Set only when you sign in
  • ictlab_session — lifetimeUntil you sign out or it expires
  • Those two — flagsHttpOnly, Secure, SameSite
  • Those two — contentsAn opaque random token. No name, email or account detail
  • _gaGoogle Analytics. Tells one browser from another, so a second visit is not counted as a second person
  • _ga_P0H1WJDZ7YGoogle Analytics. Holds the state of the current visit for one of the two properties this site reports to
  • _ga_2CEL7BH689Google Analytics. The same, for the second property
  • The analytics pair — lifetimeTwo years from your last visit, unless you clear them sooner
  • The analytics pair — wherePublic pages only. Never in your account, and never in the admin panel

`HttpOnly` means no script on the page can read the cookie, which is what stops a cross-site scripting bug from becoming an account takeover. `Secure` means it is only ever sent over HTTPS. `SameSite` means it is not sent when another site links to us.

Neither cookie contains anything about you. The session cookie holds a random token; the mapping from that token to an account exists only on our server, and the token itself is stored there as a hash.

Your enquiry basket is not a cookie

When you add products to an enquiry, the list is kept in your browser's local storage, not in a cookie. It never leaves your browser until you submit the enquiry, and it is not sent with ordinary page requests.

It holds only product codes and quantities. Clearing your browser's site data clears it. Because it is local to that browser, a basket built on your laptop does not appear on your phone.

When you do submit an enquiry, the server re-reads every product code from the catalogue and rebuilds the pricing itself — so nothing kept in your browser affects what you are quoted.

What this site does not do

  • Nothing at all until you accept. Analytics and advertising measurement are denied by default on every page, and stay denied if you never answer.
  • No analytics or advertising on signed-in pages — neither the customer portal nor the admin panel is measured, whatever you answered.
  • No session recording, no heatmaps, no keystroke or mouse-movement capture.
  • No social media plug-ins, share widgets or embedded feeds.
  • No tag manager. The tag is a fixed snippet in the page source, not a container anyone can add further tags to later.
  • No selling of personal data, and no sharing of it with advertisers other than through Google's own measurement described above.

Managing cookies

Your answer, and changing it. Use the buttons below. Your choice is kept in your own browser rather than in a cookie or on our server — we have no list of who accepted and no list of who refused. It follows that a different browser, a different device, or clearing your site data means being asked again.

In the browser itself, every browser lets you view, block and delete cookies, usually under privacy or site settings, and Google publishes its own opt-out extension at tools.google.com/dlpage/gaoptout. Any of these works regardless of what you told us here.

Blocking cookies altogether is also your choice, and most of the site still works: you can browse the catalogue, read every page, search, and build an enquiry basket. You will not be able to sign in, and you will not be able to submit a form, because the protection against forged submissions depends on the token cookie.

Signing out clears the session cookie immediately, and also revokes the session on our side — so a copy of the cookie taken beforehand stops working too.

A question about this document

If anything here is unclear, or conflicts with a quotation or agreement you already hold, tell us before you act on it. Where a signed agreement and this page disagree, the agreement governs.

Your answer