Cookie Policy

1. About This Cookie Policy

This Cookie Policy explains how CATALA Consulting Ltd uses cookies and similar technologies when you visit:

catalaconsulting.co.uk

It explains:

• what cookies and similar technologies are;
• which categories we use;
• why we use them;
• which third parties may receive information;
• how long information may be retained; and
• how you can accept, reject or change your choices.

This Cookie Policy should be read together with our Privacy Notice, which explains more broadly how we collect and use personal information.

2. Who We Are

The website is operated by:

CATALA CONSULTING LTD
Company Number: 11373928
Registered Office: 71–75 Shelton Street, London, WC2H 9JQ, United
Correspondence Address: 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom
Email: contact@catalaconsulting.co.uk

CATALA CONSULTING LTD is a private limited company registered in England and Wales.

In this policy, “CATALA Consulting”, “we”, “us” and “our” refer to CATALA CONSULTING LTD.

3. What Are Cookies and Similar Technologies?

Cookies are small text files placed on a computer, smartphone, tablet or other device when a person visits a website.

Cookies may allow a website or service provider to:

• recognise a browser or device;
• remember choices and preferences;
• maintain security;
• operate website features;
• understand how visitors use the website;
• measure marketing performance; or
• personalise content and advertising.

We may also use technologies that perform similar functions, including:

• browser local storage;
• session storage;
• pixels;
• tags;
• scripts;
• software development kits;
• unique identifiers; and
• embedded third-party services.

The rules applying to cookies may also apply to these other storage and access technologies. The ICO’s current guidance covers cookies, tracking pixels, device fingerprinting, web storage, scripts, tags and similar technologies.

4. Legal Framework

Our use of cookies and similar technologies is governed by applicable privacy and electronic-communications legislation, including:

• the Privacy and Electronic Communications Regulations 2003, as amended;
• the UK General Data Protection Regulation;
• the Data Protection Act 2018; and
• the Data (Use and Access) Act 2025.

The Data (Use and Access) Act introduced limited exceptions permitting certain low-risk storage and access technologies to operate without explicit consent. These may include some strictly necessary, appearance-related or qualifying statistical technologies.

Where no applicable exception exists, we obtain consent before placing or accessing the relevant technology.

As a clear and privacy-conscious approach across the markets in which we operate, we normally request consent before activating analytics, advertising, marketing and non-essential third-party technologies.

Where personal information is processed through cookies:

• consent is normally our lawful basis for non-essential analytics and marketing technologies;
• legitimate interests may apply to essential website security, fraud prevention and technical administration; and
• another lawful basis may apply where required by law or necessary to deliver a service requested by the visitor.

Further information is available in our Privacy Notice.

5. Categories of Technologies We Use

5.1 Strictly Necessary Technologies

These technologies are required for the website to operate securely or provide a service specifically requested by the visitor.

They may be used to:

• maintain website security;
• prevent spam, fraud or automated abuse;
• remember cookie choices;
• manage network traffic;
• enable contact-form functionality;
• maintain sessions;
• support accessibility settings; or
• provide functionality specifically selected by the visitor.

Strictly necessary technologies cannot normally be disabled through our consent tool because the website or requested feature may not work correctly without them.

However, they must be used only for genuinely necessary purposes.

Cookies that remember a visitor’s cookie preferences may qualify as strictly necessary when they are used solely to retain that choice.

5.2 Functional Technologies

Functional technologies support optional website features and visitor preferences.

They may be used to:

• remember display or language preferences;
• provide embedded booking tools;
• display interactive content;
• enable video, audio or social-media features;
• support third-party calendars; or
• remember choices relating to optional functionality.

Some functional technologies may be activated when a visitor deliberately requests a particular feature. Others require prior consent.

Rejecting functional technologies may mean that certain embedded services or website features are unavailable.

5.3 Analytics Technologies

Analytics technologies help us understand how visitors interact with the website.

They may collect information such as:

• pages viewed;
• visit duration;
• navigation paths;
• referring websites;
• approximate geographic region;
• browser and device type;
• screen size;
• website errors; and
• interactions with forms, buttons or links.

We use this information to:

• measure website use;
• understand which content is useful;
• identify technical problems;
• improve navigation;
• evaluate website performance; and
• make informed decisions about content and services.

Where Google Analytics 4 is enabled, Google may use first-party cookies such as _ga and _ga_<container-id> to distinguish users and maintain session state. Google states that the default expiry period for these cookies is two years, although browser restrictions or our configuration may shorten this period.

Analytics technologies are disabled unless the visitor consents, except where a particular implementation has been assessed as meeting an applicable legal exception.

5.4 Advertising and Marketing Technologies

Advertising and marketing technologies may help us:

• measure whether advertising generates website enquiries;
• attribute enquiries to campaigns;
• measure conversions;
• understand advertising performance;
• prevent duplicate conversion reporting;
• create or evaluate remarketing audiences; or
• deliver more relevant advertising.

Google Ads conversion measurement may store information following an advertising click. Google’s Conversion Linker uses first-party cookies with names beginning _gcl_ and may also use browser local storage.

These technologies may involve identifiers, advertising click information, page URLs, device information and interaction data.

Advertising and marketing technologies are not activated unless the visitor has provided the required consent.

We do not use advertising cookies to collect hotel guest information, sensitive personal information or information submitted within contact-form message fields.

5.5 Embedded Content and Third-Party Services

Some pages may include content or functionality supplied by other organisations.

These may include:

• Calendly;
• YouTube;
• podcast platforms;
• LinkedIn;
• WhatsApp;
• Google services;
• maps;
• social-media content; and
• other external platforms.

Third-party providers may use cookies or similar technologies when:

• embedded content loads;
• the visitor interacts with the content;
• the visitor opens a booking popup;
• a video or audio item is played; or
• the visitor follows a link to the third party’s website.

Where possible, we delay optional embedded services until the visitor consents or deliberately requests the feature.

Once a visitor leaves our website or interacts directly with an independent third-party service, that provider’s privacy and cookie policies apply.

6. Services Used on This Website

Google Tag Manager

We use Google Tag Manager to manage and deploy website tags.

Google Tag Manager acts as a mechanism through which analytics, advertising and other measurement technologies may be loaded. The specific tags operated through it depend on our current configuration.

Google Tag Manager must not activate non-essential analytics or advertising tags before the appropriate consent has been obtained.

Google Analytics

Where enabled, we use Google Analytics 4 to understand website use and performance.

Google Analytics may collect:

• a client identifier;
• session information;
• approximate location;
• browser and device information;
• pages visited;
• interaction events; and
• referral information.

Google states that Analytics does not store the client identifier in the _ga cookie when analytics storage has been disabled through Google Consent Mode.

Google Ads Conversion Measurement

Where enabled, we use Google Ads conversion measurement to understand whether advertising leads to enquiries or other relevant actions.

Google advertising technologies may process:

• advertising click identifiers;
• conversion events;
• page URLs;
• browser and device information;
• first-party conversion cookies; and
• local-storage identifiers.

We do not activate advertising storage or advertising-personalisation technologies without the required consent.

Google reCAPTCHA

We use Google reCAPTCHA on certain website forms to help distinguish genuine visitors from automated activity and reduce spam or abuse.

reCAPTCHA may process technical and interaction information, including:

• IP address;
• browser and device information;
• interaction data;
• cookies;
• security signals; and
• information required to detect automated activity.

Where reCAPTCHA is technically necessary to protect a form, we use it for website security and abuse prevention.

Google processes information under its own privacy terms and may use cookies and unique identifiers for security and fraud-detection purposes.

Calendly

We use Calendly to allow visitors to book introductory meetings.

Calendly may use cookies and similar technologies to:

• operate its booking interface;
• maintain sessions;
• remember preferences;
• support scheduling functionality;
• prevent abuse; and
• measure use of its platform.

The Calendly popup should load only when the visitor selects the booking feature or provides any required functional consent.

Information submitted when booking a meeting is addressed separately in our Privacy Notice.

WordPress and Elementor

Our website is built using WordPress and Elementor.

These platforms or associated plugins may use necessary cookies or storage technologies to:

• operate the website;
• provide administrative functions;
• maintain logged-in sessions;
• test whether a browser accepts cookies;
• support forms; and
• maintain security.

Administrative cookies used by WordPress are generally relevant only to authorised website administrators or users accessing protected areas.

Cookie Consent Tool

We use a consent-management tool to:

• present cookie choices;
• record consent or rejection;
• remember preferences;
• prevent non-essential technologies from operating prematurely; and
• allow visitors to change their settings.

A necessary preference cookie or local-storage record may be used to remember the visitor’s choice.

7. Detailed Cookie Declaration

The exact technologies used on the website may change as our website, providers and marketing configuration develop.

The current cookie declaration should be generated from a live website scan and displayed below. It should identify:

• cookie or storage name;
• provider;
• purpose;
• category;
• whether it is first-party or third-party;
• duration;
• technology type; and
• whether consent is required.

Necessary Technologies

Analytics Technologies

These Google Analytics entries should remain only if the relevant technologies are found during the live scan.

Advertising and Conversion Technologies

These entries should remain only if Google Ads conversion measurement is active.

Functional and Embedded Technologies

The final declaration should also list any technologies detected from:

• Calendly;
• reCAPTCHA;
• YouTube;
• LinkedIn;
• WhatsApp;
• podcast embeds;
• maps;
• social-media plugins; and
• other third-party content.

Replace this section with the automatically generated cookie declaration supplied by your consent-management platform after completing the live scan.

8. Your Cookie Choices

When you first visit the website, our consent tool should provide the following options:

• Accept All
• Reject Non-Essential
• Manage Preferences

Necessary technologies remain active where they are required to operate the website or deliver a requested service.

All optional categories should remain disabled unless the visitor actively selects them.

Consent is not inferred from:

• continuing to browse;
• scrolling;
• closing the banner;
• inactivity; or
• browser settings alone.

The ICO requires consent to involve a positive action and expects accepting and rejecting non-essential technologies to be equally straightforward.

9. Changing or Withdrawing Consent

You can change or withdraw your cookie choices at any time by selecting:

Cookie Settings

The Cookie Settings link should remain available in the website footer.

Withdrawing consent should be as easy as giving it. After withdrawal:

• the relevant optional technologies will no longer be activated;
• previously stored cookies may be removed where technically possible; and
• some optional website features may stop functioning.

The ICO requires consent mechanisms to provide a technically effective and equally accessible method of withdrawing consent.

We normally ask visitors to review their choices again after approximately six months, or sooner where:

• our purposes change;
• new providers are introduced;
• the technologies used change materially; or
• a legal or regulatory change requires a new choice.

10. Browser and Device Controls

Most browsers allow users to:

• view stored cookies;
• delete cookies;
• block cookies;
• block third-party cookies;
• receive a warning before a cookie is stored; or
• clear local storage.

Browser controls differ between providers and devices.

Blocking all cookies may affect website functionality. For example, forms, consent preferences or embedded services may not work correctly.

Browser settings do not replace our obligation to obtain consent where consent is required. The ICO currently advises that website operators should not rely solely on browser settings as evidence of valid consent.

11. International Processing

Some third-party providers may process information outside the United Kingdom.

This may include processing within the European Economic Area, Switzerland, the United States or other countries in which the provider operates.

Where cookie information constitutes personal information and is transferred internationally, appropriate safeguards will be used as described in our Privacy Notice.

Third-party providers may also rely on their own international-transfer arrangements and privacy frameworks.

12. How Long Cookies Remain

Cookies may be:

Session Cookies

These normally expire when the browser is closed.

Persistent Cookies

These remain on the device until:

• their configured expiry date;
• the visitor deletes them;
• consent is withdrawn and they are removed;
• the browser removes them; or
• the provider deletes or replaces them.

We aim to configure cookie durations so that they are proportionate to their purpose.

The duration listed in the cookie declaration may be shorter than a provider’s default where we have applied a more restrictive setting.

13. Personal Information Collected Through Cookies

Some cookie information may constitute personal information, particularly where it relates to:

• an identifiable device;
• an IP address;
• a unique identifier;
• a booking;
• an advertising click;
• website behaviour; or
• information linked to a known contact.

Further information about:

• lawful bases;
• recipients;
• retention;
• international transfers;
• security;
• individual rights; and
• complaints

is available in our Privacy Notice.

14. Updates to This Cookie Policy

We may update this Cookie Policy to reflect:

• changes to the website;
• new technologies;
• new service providers;
• changes to our analytics or advertising setup;
• legal developments; or
• updated regulatory guidance.

The latest version will be published on this page with an updated date.

Where a change materially affects an existing consent, we will ask visitors to make a new choice.

15. Contact Us

Questions about this Cookie Policy or our use of cookies should be sent to:

CATALA Consulting Ltd
Privacy Contact
Email: contact@catalaconsulting.co.uk
Correspondence Address: 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom
Company Number: 11373928

16. Complaints

If you have concerns about our use of cookies or similar technologies, contact us first so that we can investigate.

You may also raise a concern with the Information Commissioner’s Office, the United Kingdom’s data-protection regulator.

The ICO provides a specific process for reporting concerns about website cookies.