Network Working Group Cookie Policy Request for Comments: CP-0001 Privacy Notice Category: Informational 2 July 2026 COOKIE POLICY AND PRIVACY NOTICE FOR WEBSITE Governing the Use of Session Cookies Under GDPR and the Privacy and Electronic Communications Directive Status of This Document This document is an informational policy notice published by the website operator. It describes the use of HTTP cookies on this website and the rights afforded to users under applicable data protection legislation, including Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Privacy and Electronic Communications Regulations 2003 ("PECR"), as amended. This document is not an Internet Standards Track specification. Copyright Notice Copyright (c) 2026 Website Operator. All rights reserved. Abstract This policy describes the single HTTP cookie deployed on this website, its purpose, legal basis, retention period, and the rights of data subjects with respect to the personal data it contains. This website uses exactly one (1) cookie. No tracking, advertising, or analytics cookies are used. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 2 3. Cookie Inventory . . . . . . . . . . . . . . . . . . . . . . 3 4. Legal Basis for Processing . . . . . . . . . . . . . . . . . 4 5. Data Retention . . . . . . . . . . . . . . . . . . . . . . . 4 6. Data Transfers . . . . . . . . . . . . . . . . . . . . . . . 5 7. Your Rights . . . . . . . . . . . . . . . . . . . . . . . . . 5 8. Consent and Cookie Control . . . . . . . . . . . . . . . . . 6 9. Contact Information . . . . . . . . . . . . . . . . . . . . . 7 10. Changes to This Policy . . . . . . . . . . . . . . . . . . . 7 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 1. Introduction This website places one (1) HTTP cookie on a user's device upon successful authentication. This cookie is strictly necessary for the operation of the authenticated session and cannot be disabled without preventing login functionality. The operator of this website is committed to transparency in its use of cookies and to the protection of personal data in accordance with applicable law. Users should read this policy before using authenticated features of the website. Use of authenticated features constitutes acceptance of the session cookie described herein, as it is technically necessary to provide that service. 2. Definitions The following terms are used in this document: "Cookie" A small text file placed on a user's device by a web server, retrievable by that server on subsequent requests, as defined in RFC 6265 [RFC6265]. "Controller" The natural or legal person which determines the purposes and means of the processing of personal data, as defined in GDPR Article 4(7). "Data Subject" An identified or identifiable natural person to whom personal data relates, as defined in GDPR Article 4(1). "Personal Data" Any information relating to an identified or identifiable natural person, as defined in GDPR Article 4(1). "Processing" Any operation performed on personal data, as defined in GDPR Article 4(2). "Session" A server-side record of an authenticated user's interaction with the website within a defined period. "UUID" A Universally Unique Identifier as defined in RFC 4122 [RFC4122], used in this context to identify an authenticated user's session. 3. Cookie Inventory This website sets exactly one (1) cookie. The full specification of that cookie follows. 3.1. Cookie: uuid Name: uuid Purpose: Stores the unique identifier of the currently authenticated user. This value is used by the server to associate incoming HTTP requests with an authenticated user account, thereby maintaining the user's logged-in state across requests. Category: Strictly Necessary Data Stored: A UUID (Universally Unique Identifier) in the canonical 8-4-4-4-12 hexadecimal format as per RFC 4122. For example: 550e8400-e29b-41d4-a716-446655440000 This value maps to a user record held in the website's database. It constitutes personal data as it is linked to an identifiable individual. Set: Upon successful authentication (login). Expiry: Session cookie (deleted when the browser is closed) or a fixed expiry not exceeding thirty (30) days, depending on whether the user selects a persistent login option. Domain: The domain of this website only. The cookie is not shared with any third-party domain. Path: / Secure: TRUE. The cookie is only transmitted over HTTPS connections. HttpOnly: TRUE. The cookie is not accessible via JavaScript. This mitigates the risk of cross-site scripting (XSS) attacks. SameSite: Strict. The cookie is not sent with cross-site requests, mitigating cross-site request forgery (CSRF) risks. Third Parties: None. This cookie is not read by or shared with any third party. 4. Legal Basis for Processing 4.1. GDPR Legal Basis The processing of the user identifier stored in the uuid cookie is carried out on the basis of Article 6(1)(b) of the GDPR: processing is necessary for the performance of a contract to which the data subject is party, namely the provision of the website's authenticated services. Alternatively, where a contract basis does not apply, processing is based on Article 6(1)(f) of the GDPR: the legitimate interests of the operator in providing a secure and functional authenticated service, where those interests are not overridden by the interests or rights of the data subject. 4.2. PECR / ePrivacy Basis Under Regulation 6 of the Privacy and Electronic Communications Regulations 2003, consent is not required for cookies that are strictly necessary to provide a service explicitly requested by the user. The uuid cookie is strictly necessary to maintain the authenticated session requested by the user upon login. No consent banner or opt-in mechanism is therefore required for this cookie under PECR. 5. Data Retention 5.1. Cookie Lifetime The uuid cookie is deleted from the user's browser upon logout or browser closure (session cookie), or after a maximum of thirty (30) days if a persistent session was requested. 5.2. Server-Side Data The user record associated with the UUID stored in this cookie is retained for the duration of the user's account. Upon account deletion, the server-side mapping is permanently erased. Server access logs, which may incidentally record the uuid cookie value, are retained for no longer than ninety (90) days for security and diagnostic purposes. 6. Data Transfers The data stored in the uuid cookie is not transferred to any third country outside the United Kingdom or European Economic Area. No third-party services, analytics platforms, advertising networks, or social media integrations receive this cookie or the data it contains. 7. Your Rights As a data subject under the GDPR, you have the following rights with respect to the personal data associated with your uuid cookie: 7.1. Right of Access (Article 15) You have the right to request confirmation of whether personal data concerning you is being processed and to receive a copy of that data. 7.2. Right to Rectification (Article 16) You have the right to request correction of inaccurate personal data held about you. 7.3. Right to Erasure (Article 17) You have the right to request deletion of your personal data, subject to the operator's legitimate interests and legal obligations. Account deletion will result in the removal of all data associated with your UUID. 7.4. Right to Restriction of Processing (Article 18) You have the right to request that processing of your personal data be restricted in certain circumstances. 7.5. Right to Data Portability (Article 20) Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format. 7.6. Right to Object (Article 21) Where processing is based on legitimate interests, you have the right to object to that processing. 7.7. Right to Withdraw Consent Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. 7.8. Right to Lodge a Complaint You have the right to lodge a complaint with a supervisory authority. In the United Kingdom, the relevant authority is: Information Commissioner's Office (ICO) Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF United Kingdom https://ico.org.uk/ In the European Union, the relevant authority is the data protection authority of your Member State of residence. 8. Consent and Cookie Control 8.1. Strictly Necessary Cookie Because the uuid cookie is strictly necessary for the provision of the authenticated service, no consent is required for its use under PECR Regulation 6(4). The cookie is only set after a user actively chooses to log in. 8.2. Disabling Cookies Users may configure their browser to refuse or delete cookies. Instructions vary by browser: Chrome: Settings > Privacy and Security > Cookies Firefox: Settings > Privacy & Security > Cookies Safari: Preferences > Privacy > Manage Website Data Edge: Settings > Cookies and Site Permissions NOTE: Disabling or deleting the uuid cookie will terminate the authenticated session. The user will be required to log in again. Unauthenticated features of the website remain accessible without cookies. 8.3. Opting Out Because this cookie is strictly necessary to provide the service requested by the user, there is no opt-out mechanism that would allow authenticated access whilst the cookie is disabled. A user who does not wish this cookie to be set should not log in. 9. Contact Information Questions, requests to exercise data subject rights, or complaints regarding this cookie policy should be directed to the data controller at: [Data Controller Name] [Address Line 1] [Address Line 2] [City, Postcode] [Country] Email: privacy@[domain] The operator endeavours to respond to all data subject requests within one (1) calendar month of receipt, as required by GDPR Article 12(3). 10. Changes to This Policy This policy may be updated to reflect changes in applicable law, regulatory guidance, or the operator's practices. Where changes are material, users will be notified by a prominent notice on the website prior to the change taking effect. The version date at the top of this document indicates when the policy was last revised. Previous versions are available upon request. 11. References [RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, DOI 10.17487/RFC4122, July 2005, . [RFC6265] Barth, A., "HTTP State Management Mechanism", RFC 6265, DOI 10.17487/RFC6265, April 2011, . [GDPR] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. [PECR] Privacy and Electronic Communications Regulations 2003, SI 2003/2426, as amended. Acknowledgements This policy was drafted in accordance with guidance published by the Information Commissioner's Office (ICO) and the European Data Protection Board (EDPB). Author's Note This document follows the formatting conventions of IETF RFCs for presentational clarity. It is not an IETF publication and does not represent the views of the IETF. [Page EOF]