Cookie & Storage Notice

Cookie, Local Storage, and Similar Technologies Notice

Principle

The Portal uses as little terminal storage as reasonably possible. Technologies strictly necessary to provide an expressly requested service may be used without optional consent where permitted by section 25(2) TDDDG. Non-essential analytics, advertising, cross-site tracking, or personalisation technologies require a valid legal basis and, where applicable, prior consent.

Necessary technologies

The Portal uses the following necessary technology categories:

| Purpose | Example data | Typical duration | Classification | |---|---|---:|---| | Authentication/session | session identifier, CSRF token | session / security lifetime | necessary | | Passkey flow | short-lived challenge state | minutes | necessary | | Security/rate limiting | challenge token, abuse-control identifier | minutes to days | necessary where triggered | | Download acknowledgement | accepted legal version and time | up to 24 hours or reviewed period | necessary for requested download/compliance evidence | | Download basket | selected set-version identifiers | until basket cleared or reviewed expiry | necessary for requested basket | | Language/accessibility | selected language and accessibility preference | reviewed period | necessary/preference requested by user | | Consent choice | consent record | until changed or expiry | necessary to remember consent decision |

The current technology inventory identifies each key, provider, purpose, data, duration, and third-party access where applicable.

Optional analytics and advertising

The Portal uses no optional analytics. If analytics are introduced, aggregate, self-hosted, cookieless measurement without user profiles is preferred. “Cookieless” does not automatically mean consent-free; terminal access and personal-data processing remain separately assessed.

If advertising for the Operator’s own products is introduced, contextual advertisements can generally be shown without behavioural tracking. Personalised advertising, conversion tracking, audience matching, or cross-service profiling must remain off until separately designed, documented, and consented to where required.

Consent management

A consent banner is required only for technologies requiring consent; it must not mislabel necessary functions as consent. Rejecting optional technologies must be as easy as accepting them. No optional technology may load before the user’s affirmative choice. The choice must be changeable at any time.