| Date | Version | Reference | Reviewer(s) |
|---|---|---|---|
| 28 Apr 2026 | 1.0 | Adopted by UKMSA Board | Amy Robinson, Director of Operations Rob DeSouza, GDPR Consultant |
1. Purpose
This Cookie Policy explains how UKMSA uses cookies and similar technologies on its website, what these technologies are, why UKMSA uses them, and how you can control them.
2. Scope
This policy applies to the UKMSA public website and any associated subdomains, landing pages, and online services that link to this policy. It is intended for website users, donors, beneficiaries, volunteers, and other stakeholders.
3. Definitions
For the purposes of this policy:
- Cookie: A small text file placed on your device by a website to remember information about you or your device.
- Similar technologies: Technologies with comparable functionality to cookies, such as pixels, tags, SDKs, and local storage.
- Strictly necessary cookies: Cookies required for the website to function (e.g., security, load balancing, consent management).
- Personal data: Information relating to an identified or identifiable natural person (as defined by UK GDPR).
4. Legal and Regulatory Compliance
UKMSA is committed to compliance with applicable UK data protection and ePrivacy requirements, including:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Privacy and Electronic Communications Regulations 2003 (PECR), as amended
- Information Commissioner’s Office (ICO) guidance on cookies and similar technologies
Where cookies involve processing personal data, UKMSA will ensure an appropriate lawful basis under UK GDPR and will provide transparent information about the processing. Under PECR, non-essential cookies are set only with your consent.
Digital Operational Resilience Act (DORA): DORA is an EU regulation primarily applicable to EU financial entities and certain ICT third-party service providers. UKMSA is a UK charity and DORA will typically not apply directly. However, if UKMSA provides ICT services to EU-regulated financial entities or processes data for them, UKMSA will support their operational resilience and incident reporting obligations as contractually required and will align relevant practices where proportionate.
5. Cookies We Use
UKMSA uses the following categories of cookies. A detailed cookie inventory may be provided via the website’s cookie banner or on request.
| Category | Purpose | Typical examples | Consent required? |
|---|---|---|---|
| Strictly necessary | Enable core website functions such as security, network management, and accessibility. | Session cookies; security tokens; consent-record cookie | No (PECR exemption) |
| Preferences / functionality | Remember your choices (e.g., language, region) to improve your experience. | Language preference cookie | Yes |
| Analytics / performance | Help us understand how the website is used so we can improve it. | Aggregated analytics identifiers | Yes |
| Marketing / targeting | Support communications and measure campaign effectiveness (where used). | Ad conversion tags; social media pixels | Yes |
Note: Where UKMSA uses third-party analytics or marketing tools, those providers may set cookies or access similar identifiers. See section 8 for more information.
6. Managing Consent and Preferences
When you first visit the UKMSA website, you will be presented with a cookie banner that allows you to:
- Accept all non-essential cookies
- Reject non-essential cookies
- Customise your choices by cookie category
UKMSA will not set non-essential cookies until you have provided consent. You can change or withdraw consent at any time by using the “Cookie settings” link (or equivalent) on the website. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.
7. How to Control Cookies in Your Browser
Most browsers allow you to control cookies through their settings. You can typically:
- Delete cookies stored on your device
- Block cookies (all cookies or only third-party cookies)
- Set your browser to notify you before cookies are placed
If you block strictly necessary cookies, parts of the website may not function correctly.
8. Third-Party Cookies and Processors
UKMSA may use third-party service providers (processors) to deliver website functionality, analytics, and communications services. Where third parties are used:
- UKMSA will conduct due diligence and put in place appropriate contracts, including Article 28 UK GDPR processor terms where applicable.
- UKMSA will ensure appropriate safeguards for any international data transfers (see section 9).
- Non-essential third-party cookies will be set only with your consent.
Examples of third-party services may include: website hosting, content delivery networks (CDNs), analytics providers, form tools, and embedded media platforms.
9. Data Retention
Cookies have varying lifespans:
- Session cookies are deleted when you close your browser.
- Persistent cookies remain on your device until they expire or you delete them.
Specific retention periods for individual cookies are provided in the cookie banner/inventory where applicable. UKMSA will not retain cookie-derived personal data longer than necessary for the stated purposes.
10. Security
UKMSA implements proportionate technical and organisational measures to protect information collected via the website, including access controls, secure configuration, vulnerability management, and incident response arrangements.
11. Your Rights
Where personal data is processed, individuals may have rights under UK GDPR, including the right to access, rectification, erasure, restriction, objection, and data portability (where applicable).
To exercise your rights or raise concerns, contact UKMSA using the details in section 12. You also have the right to complain to the ICO.
12. Contact Details
If you have questions about this Cookie Policy or how UKMSA handles personal data, please contact:
- Email: Data@UKMSA.ORG.UK
-
Postal address:
49 Station Road
Polegate
East Sussex
BN26 6EA
13. Changes to this Policy
UKMSA may update this policy from time to time to reflect changes in technology, law, or our practices. Material changes will be communicated via the website (for example, through an updated banner or notice).