Legal

Cookie & Similar Technologies Policy

Last updated 4 September 2026

Effective date: 4 September 2026
Last updated: 4 September 2026

This Cookie & Similar Technologies Policy explains how PepperClub uses cookies, web storage, SDKs, scripts, device identifiers and similar storage/access technologies on its websites and mobile applications.

It also contains a production implementation specification for PepperClub's consent banner and consent controls so that the technical implementation matches the legal position described to customers.

This policy applies to:

  • www.pepperclub.co.uk;
  • PepperClub's customer shopping website/web app;
  • PepperClub's Android application; and
  • PepperClub's iOS application.

The PepperClub corporate website and shopping service may operate on the same domain or related PepperClub subdomains.

This policy should be read together with the PepperClub Privacy Notice.

Part A — Customer Cookie & Similar Technologies Policy

1. Who we are

PepperClub is operated by:

PepperClub Ltd
Company number: 17072549
Registered in England and Wales
Registered office: 48 Radcliffe Drive, Derby, England, DE22 3LA

Privacy and cookie enquiries: privacy@pepperclub.co.uk

2. What are cookies and similar technologies?

A cookie is a small piece of information that a website stores on a browser or device.

Privacy rules can also apply to other technologies that store information on, or access information from, a user's device.

These can include:

  • browser cookies;
  • localStorage;
  • sessionStorage;
  • mobile-app storage;
  • software development kits ("SDKs");
  • scripts and tags;
  • pixels;
  • device or app identifiers;
  • authentication tokens;
  • security technologies; and
  • other similar storage and access technologies.

In this policy, we refer to these collectively as storage and access technologies.

3. Why PepperClub uses these technologies

PepperClub may use storage and access technologies to:

  • keep the website and apps secure;
  • authenticate customers;
  • maintain login sessions;
  • remember basket contents;
  • preserve checkout state;
  • detect fraud and automated abuse;
  • remember privacy choices;
  • process or protect payments;
  • provide requested interface preferences;
  • diagnose technical failures;
  • deliver push notifications where enabled;
  • measure how customers use PepperClub where permitted; and
  • improve the website, apps and customer experience.

We do not currently use advertising or remarketing technologies.

4. Current categories

PepperClub currently uses or plans to use the following main categories.

4.1 Strictly Necessary / Security & Service Operation

These technologies are used where they are genuinely necessary to:

  • provide a service you have requested;
  • authenticate you;
  • maintain a basket or checkout;
  • remember your privacy choice;
  • protect PepperClub systems;
  • prevent fraud or abuse;
  • maintain network security;
  • detect technical faults where the relevant legal exception applies; or
  • support a payment you have chosen to make.

Where the legal requirements for an exception are met, these technologies do not require consent.

They cannot be disabled through PepperClub's optional-cookie controls if disabling them would prevent the requested service or security function from operating.

Examples may include:

  • secure authentication cookies;
  • local storage used for authentication/session state;
  • shopping-basket identifiers;
  • consent/preference records;
  • Cloudflare security technologies;
  • proportionate bot/fraud controls;
  • payment-security technologies; and
  • essential fault/security mechanisms.

PepperClub will not classify a technology as "necessary" merely because it is commercially useful.

4.2 Analytics

PepperClub uses Microsoft Clarity to understand how people use the website.

Clarity may provide:

  • heatmaps;
  • session recordings;
  • click information;
  • scroll information;
  • navigation/journey analysis;
  • page-interaction information; and
  • related website analytics.

Because PepperClub intends to use Clarity's individual interaction/session-recording functionality, Microsoft Clarity is treated as optional Analytics and will not load until the user has given Analytics consent.

Analytics is off by default.

If you reject Analytics, PepperClub should remain fully usable.

4.3 Functional and appearance preferences

PepperClub may use device storage to remember preferences such as:

  • language;
  • accessibility/UI choices;
  • selected interface settings;
  • a preferred service area; or
  • another preference you have deliberately chosen.

Where a preference technology falls within an applicable legal exception, PepperClub may use it without consent subject to the conditions of that exception, including providing clear information and a simple free way to object where required.

Where a technology goes beyond the exception, PepperClub will obtain consent before using it.

4.4 Personalisation

Technologies used to infer preferences from behaviour are different from simply remembering a setting you chose.

For example:

  • recently viewed products;
  • behavioural product recommendations;
  • inferred interests; or
  • content selected because of previous browsing behaviour

will not automatically be treated as necessary or as an appearance preference.

Where use of a storage/access technology for personalisation requires consent, it will remain off until consent is given.

PepperClub may also provide server-side/account-based personalisation where applicable; not every server-side use involves storing or accessing information on the user's device, although UK GDPR may still apply.

4.5 Marketing and advertising

PepperClub does not currently use:

  • Meta Pixel;
  • Google Ads conversion tags;
  • TikTok Pixel;
  • Snapchat Pixel;
  • advertising SDKs;
  • remarketing cookies; or
  • similar advertising tracking technologies.

A Marketing/Advertising consent category should therefore not be shown merely for hypothetical future processing.

If PepperClub introduces advertising or remarketing technologies later:

  • this policy will be updated;
  • the consent interface will be updated;
  • the technologies will remain off until any required consent is obtained; and
  • existing users will be asked for fresh consent where the new purpose is not covered by their previous choice.

5. PepperClub authentication and browser storage

PepperClub's web service may use both:

  • secure cookies; and
  • browser local storage

for authentication, session and related service operation.

Exact implementation may evolve as PepperClub's authentication architecture changes.

Any authentication token stored on the device must be protected using an architecture appropriate to its sensitivity.

Where an authentication or session technology is genuinely necessary to provide the customer-requested service, PepperClub may rely on the applicable strictly necessary exception.

Authentication technologies must not be repurposed for analytics, advertising or unrelated tracking.

6. Basket storage

PepperClub may store shopping-basket information:

  • on the PepperClub server;
  • on the user's device; or
  • using a combination of both.

Where a device technology is genuinely necessary to remember the items a customer has placed in a basket for the requested shopping service, it may qualify as strictly necessary.

Basket identifiers must not be repurposed for unrelated advertising or behavioural tracking without an appropriate lawful basis and any required consent.

7. Cloudflare

PepperClub uses Cloudflare for infrastructure functions that may include:

  • content delivery/network proxying;
  • web application firewall ("WAF");
  • bot protection;
  • security challenges;
  • rate limiting;
  • availability and performance protection.

Depending on the Cloudflare features enabled, Cloudflare may use technologies such as:

  • __cf_bm;
  • cf_clearance;
  • _cfuvid;
  • load-balancing/session-affinity cookies; or
  • other Cloudflare security cookies.

PepperClub will treat Cloudflare storage/access as exempt only where it is genuinely necessary and proportionate for security, service delivery or another applicable exception.

Cloudflare Turnstile may be introduced later for bot verification. If used solely and proportionately for security/authentication, PepperClub will assess whether the applicable necessary/security exception is satisfied before deployment.

8. Microsoft Clarity

PepperClub intends to use Microsoft Clarity for website analytics.

Clarity may use first-party and third-party cookies including technologies such as:

  • _clck;
  • _clsk;
  • CLID;
  • ANONCHK;
  • MR;
  • MUID; and
  • SM.

Clarity may associate interactions with pseudonymous identifiers to create analytics and session information.

PepperClub rule

Clarity must not be initialised or permitted to set/read optional analytics technologies until the user has selected "Accept optional technologies" or has enabled Analytics through Cookie Settings.

Rejecting optional technologies must prevent Clarity from operating in its optional analytics/session-recording mode.

PepperClub will configure Clarity consent signalling appropriately for UK users.

9. Clarity session-recording safeguards

Where PepperClub uses Clarity session recording:

  • sensitive input fields should be masked or excluded as far as technically supported;
  • passwords must never be intentionally captured;
  • payment-card information must never be intentionally captured;
  • sensitive customer fields should be masked;
  • unnecessary personal information should not be sent to Clarity; and
  • checkout, payment and account areas should use more restrictive capture settings.

PepperClub should consider excluding session recording entirely from pages or views where customers enter highly sensitive account/payment information.

Clarity must never be treated as a substitute for application logging or security monitoring.

10. Sentry

PepperClub uses Sentry across:

  • backend/server systems;
  • the web frontend; and
  • mobile apps

for error monitoring, crash reporting and service reliability.

PepperClub does not currently use Sentry Session Replay.

Sentry is intended primarily for:

  • detecting software failures;
  • investigating crashes;
  • diagnosing technical errors;
  • monitoring reliability; and
  • protecting the service.

PepperClub should configure Sentry to minimise unnecessary personal information.

Where reasonably possible, error reports should not contain:

  • customer names;
  • email addresses;
  • mobile numbers;
  • delivery addresses;
  • payment information;
  • passwords;
  • authentication secrets; or
  • unnecessary request bodies containing personal information.

If a Sentry feature stores or accesses information on a user's device and does not satisfy a legal exception, PepperClub must obtain any required consent before using that feature.

No Sentry feature should be blanket-classified as exempt without reviewing what that feature actually does.

11. Mobile applications

The same privacy rules can apply to mobile-app technologies that store or access information on a customer's phone or tablet.

PepperClub currently uses or plans to use:

  • Firebase / Firebase Cloud Messaging ("FCM") for push-notification infrastructure; and
  • Apple Push Notification service ("APNs") for notifications to Apple devices.

PepperClub is not currently using Firebase Analytics as the main customer analytics platform under this policy.

PepperClub uses Sentry for app error/crash monitoring.

12. Push notifications

Where a customer enables push notifications, PepperClub may use:

  • an app/device token;
  • FCM;
  • APNs; and
  • associated notification-delivery information

to provide the notification service the customer has enabled.

These identifiers are not treated by PepperClub as advertising identifiers merely because they identify an app installation/device endpoint.

Customers can normally control push permission through the operating-system settings and, where available, PepperClub app settings.

PepperClub does not currently use Apple's IDFA or Android Advertising ID for advertising tracking.

PepperClub does not currently require Apple's App Tracking Transparency permission for its planned launch tracking model.

13. Payments

PepperClub uses Stripe, including eligible payments using Apple Pay and Google Pay through Stripe.

Payment providers may use storage/access technologies for:

  • fraud prevention;
  • payment security;
  • transaction processing;
  • authentication; and
  • other payment functions.

PepperClub will classify only technologies that are genuinely required to provide or secure the customer-requested payment as necessary.

We will not automatically classify every technology operated by Stripe, Apple or Google as strictly necessary merely because it belongs to a payment provider.

14. Consent preference

PepperClub may store a privacy/cookie preference so that customers are not asked to make the same choice on every page visit.

The normal PepperClub preference duration is six months.

PepperClub may ask again sooner if:

  • purposes materially change;
  • a new third-party analytics/advertising provider is introduced;
  • the consent wording materially changes;
  • consent can no longer reasonably be treated as informed; or
  • another legal/compliance reason requires a new choice.

There is no implication that every consent automatically remains valid for exactly six months in all circumstances.

15. Changing or withdrawing your choice

Customers must be able to change their optional-technology choices at any time.

PepperClub will provide a persistent Cookie Settings or equivalent privacy-settings control on the website.

Changing or withdrawing consent should be as easy as giving it.

When Analytics consent is withdrawn:

  • PepperClub must stop future optional Clarity collection as soon as technically practicable;
  • optional analytics storage should be removed where PepperClub can reasonably do so; and
  • previously lawfully collected information may remain subject to applicable retention rules.

16. Rejecting optional technologies

If you choose Reject optional technologies:

  • Microsoft Clarity must not load in optional analytics/session-recording mode;
  • optional personalisation technologies requiring consent must not load;
  • future marketing/advertising technologies requiring consent must not load; and
  • PepperClub shopping, account and checkout functionality should continue to operate normally using technologies that are legitimately necessary or otherwise exempt.

PepperClub does not use a cookie wall requiring optional tracking in order to purchase groceries.

17. No consent from inactivity

PepperClub will not treat any of the following by itself as valid consent to optional tracking:

  • continuing to browse;
  • scrolling;
  • closing the banner;
  • ignoring the banner; or
  • visiting another page.

Consent to optional technologies requires a clear positive action.

18. Third-party embedded content

PepperClub does not currently plan to rely on embedded third-party services such as social-media widgets, YouTube embeds or third-party map/chat widgets as part of the launch policy.

If such functionality is introduced later and it causes non-essential third-party storage/access:

  • it should be blocked before consent where consent is required;
  • customers must be told which third party is involved and why; and
  • the Cookie Settings/inventory must be updated.

Where an embed can be provided in a genuinely privacy-preserving way without non-exempt storage/access, PepperClub may use that configuration.

19. Statistical-purpose exception

UK law now includes a limited exception for certain storage/access carried out solely for statistical purposes about use of an online service, with a view to improving that service.

PepperClub may consider using a privacy-focused aggregate analytics solution in future under this exception.

PepperClub will rely on the exception only where its requirements are satisfied, including:

  • the sole purpose is qualifying statistical measurement;
  • the statistics are used with a view to improving the PepperClub service;
  • the processing does not go beyond that purpose;
  • customers receive clear and comprehensive information; and
  • customers are provided with a simple free means to object.

PepperClub does not rely on this exception for its planned Microsoft Clarity session-recording setup.

If PepperClub introduces exempt statistical analytics later, this policy will be updated rather than silently changing the analytics model.

20. Appearance/functionality exception

UK law also contains an exception for certain storage/access used solely to adapt the appearance or functionality of a service to the user's preference.

PepperClub may rely on that exception for appropriate user-requested functionality where all legal conditions are satisfied.

Where required, PepperClub will provide:

  • clear and comprehensive information; and
  • a simple, free way to object.

The exception does not cover using previous browsing behaviour or inferred interests to decide which products or content to promote to the user.

Where there is uncertainty over whether a technology falls within an exception, PepperClub should default to obtaining consent rather than stretching an exception beyond its proper scope.

21. Current technology inventory

The table below describes the principal technologies expected in PepperClub's launch architecture.

Exact cookie names and provider-controlled lifetimes can change as software versions and configurations change. The live Cookie Settings / production technology inventory is the authoritative current technical list.

Technology / provider Main purpose Category First / third party Typical duration Consent required?
PepperClub authentication cookie(s) Login/session authentication Strictly Necessary First party Session or configured login/token lifetime No, where genuinely necessary
PepperClub authentication/session local storage Login/session/service state Strictly Necessary First party Configured session/token lifetime No, where genuinely necessary
PepperClub basket storage Remember requested basket contents Strictly Necessary First party/server-linked Session or basket lifetime No, where genuinely necessary
PepperClub consent preference Remember cookie/privacy choice Strictly Necessary First party 6 months No
Cloudflare __cf_bm where enabled Bot/security protection Security / Necessary Third-party service on PepperClub domain Provider controlled; commonly short-lived No where applicable security exception is satisfied
Cloudflare cf_clearance where enabled Security challenge clearance Security / Necessary Third-party service on PepperClub domain Configurable; commonly short-lived No where applicable security exception is satisfied
Other Cloudflare security/rate-limiting technologies WAF, rate limiting, bot mitigation, availability Security / Necessary Third-party service Feature/configuration dependent No only where exception applies
Microsoft Clarity _clck Clarity pseudonymous site/user analytics Analytics First party Provider controlled Yes
Microsoft Clarity _clsk Links page views into a Clarity session/recording Analytics First party Provider controlled Yes
Microsoft Clarity/Microsoft CLID, ANONCHK, MR, MUID, SM where set Clarity/Microsoft analytics and associated service functions Analytics Third party Provider controlled Yes under PepperClub's launch configuration
Sentry SDK / diagnostic mechanisms Error/crash/reliability monitoring Security & Reliability First/third-party service Configuration dependent Only exempt where actual use satisfies an exception; otherwise consent
FCM/APNs app/device token Deliver user-enabled push notifications Requested Functionality App/device + third-party service Until rotated, invalidated or notifications/device relationship ends No where necessary to provide the enabled notification service
Stripe / wallet security technologies Customer-requested payment, authentication and fraud prevention Payment / Necessary Third party Provider/configuration dependent No only for genuinely necessary payment/security functions
User-selected appearance/UI preference storage Remember user-requested display/function preference Preference First party Configuration dependent May be exempt if appearance exception conditions are satisfied; objection mechanism required where applicable
Recently viewed / behavioural personalisation storage Behaviour-based personalisation Personalisation First/third party Configuration dependent Yes where storage/access consent is required

22. Provider data-retention versus cookie lifetime

The lifetime of a cookie on your device is not necessarily the same as the time the provider retains information on its servers.

For example, analytics providers may retain aggregated or session information according to their own configured or published retention periods.

PepperClub's Privacy Notice explains the broader approach to retention of personal information.

23. Updates to the technical inventory

PepperClub's production team should review the actual deployed storage/access technologies:

  • before initial production launch;
  • after material frontend/app changes;
  • when a new SDK/tag/provider is introduced;
  • after major consent-manager changes; and
  • periodically as part of privacy compliance.

If an undeclared non-essential technology is detected, it should be investigated and, where necessary, blocked until the correct legal/consent treatment is implemented.

24. Contact us

For questions about cookies, app technologies or privacy choices:

privacy@pepperclub.co.uk

Postal correspondence:

PepperClub Ltd
48 Radcliffe Drive
Derby
England
DE22 3LA
United Kingdom

25. Changes to this policy

PepperClub may update this policy when:

  • providers change;
  • purposes change;
  • technologies change;
  • app functionality changes;
  • analytics or advertising functionality is introduced; or
  • legal/regulatory requirements change.

Where an update introduces a materially new purpose requiring consent, PepperClub will request fresh consent rather than assuming that an earlier choice covers the new processing.

Part B — PepperClub Production Consent Implementation Specification

This part is intended for PepperClub developers, infrastructure engineers, QA/UAT and compliance review.

It defines the minimum expected behaviour of the production consent system.

B1. First-layer cookie banner

Recommended production copy

Your privacy choices

PepperClub uses essential technologies to keep the service secure, remember your basket, sign you in and process orders. With your permission, we also use Microsoft Clarity to understand how people use PepperClub, including heatmaps and session recordings. You can accept, reject or manage optional technologies, and change your choice at any time.

Buttons:

Accept optional technologies
Reject optional technologies
Manage preferences

UI rules

  • "Accept optional technologies" and "Reject optional technologies" must have equal or genuinely comparable prominence.
  • Reject must not be hidden behind "Manage preferences".
  • Do not visually manipulate users toward Accept.
  • Do not use a pre-ticked Analytics switch.
  • Do not treat closing the banner as consent.
  • Do not treat continued browsing as consent.
  • Do not block normal shopping because Analytics was rejected.
  • The Privacy Notice and this Cookie Policy should be accessible from the banner or settings.

B2. Preferences screen

At launch, the settings interface should show:

Strictly Necessary

Always active

Suggested description:

Required to sign you in, remember your basket and privacy choices, secure PepperClub, prevent fraud and provide checkout/payment functions you request. These cannot be switched off through Cookie Settings where they are genuinely necessary for the service.

Analytics

Default: OFF

Suggested description:

With your permission, PepperClub uses Microsoft Clarity to understand how people use our website, including clicks, scrolling, heatmaps and session recordings. This helps us improve PepperClub. The service works without Analytics.

Toggle:

[ OFF ] Analytics

Functional / Personalisation

Do not create one misleading catch-all category.

Where optional device-based personalisation is introduced, create a separate category such as:

Personalisation — Default: OFF

Suggested description:

Allows PepperClub to remember or infer browsing preferences for features such as recently viewed products or personalised content where consent is required.

User-requested interface settings that qualify for an applicable legal exception should be described separately and supplied with the required objection mechanism rather than silently treating them as consented optional tracking.

Marketing

Do not show this category at launch because no marketing/advertising tracking technology is currently deployed.

Add it only when a real marketing purpose/provider is ready to go live.

When added:

  • Default OFF.
  • Requires affirmative consent.
  • Must name relevant provider/controller information.
  • Must be included in the versioned consent record.
  • Existing users should receive a fresh choice if prior consent did not cover it.

B3. Initial state before any user action

On a user's first visit:

  • strictly necessary technologies may operate where the relevant exception is satisfied;
  • the consent-preference mechanism may operate;
  • Microsoft Clarity must remain blocked;
  • no Clarity session recording may begin;
  • no Clarity analytics cookies should be intentionally set;
  • optional behavioural personalisation must remain blocked;
  • advertising/remarketing technologies must not be present.

The default state is no optional consent.

B4. On "Accept optional technologies"

When the user selects Accept:

  1. record the consent choice;
  2. record the consent version and timestamp;
  3. set Analytics consent to granted;
  4. initialise Microsoft Clarity only after the consent state has been applied;
  5. pass the appropriate consent signal to Clarity;
  6. enable other optional categories only if they were explicitly covered by the displayed consent wording;
  7. do not treat Accept Analytics as consent to hypothetical future advertising.

B5. On "Reject optional technologies"

When the user selects Reject:

  1. record the rejection;
  2. keep Analytics denied;
  3. do not initialise Clarity in optional analytics/session-recording mode;
  4. prevent Clarity analytics cookies/local storage from being set where technically controllable;
  5. do not load optional behavioural personalisation requiring consent;
  6. continue normal account, basket and checkout operation;
  7. maintain only exempt/necessary technologies.

B6. On "Manage preferences"

The user must be able to make granular choices.

At launch the relevant optional choice is primarily:

  • Analytics: ON / OFF

No optional toggle should be pre-enabled.

Saving the settings is itself a clear positive action for the choices selected.

B7. Consent record

PepperClub should record sufficient information to demonstrate what happened, including:

  • consent category;
  • granted/refused state;
  • timestamp;
  • consent/banner version;
  • policy version where appropriate;
  • anonymous/session/device consent identifier;
  • source/interface used;
  • subsequent change or withdrawal history where appropriate.

Avoid collecting unnecessary identity data merely to prove a cookie preference.

For signed-in customers, PepperClub may additionally synchronise preference to the account where this is designed transparently and does not override the most recent user/device choice improperly.

B8. Consent duration

The PepperClub consent preference should normally persist for six months.

Re-prompt earlier where:

  • a new optional purpose is introduced;
  • a new third-party controller/provider materially changes the information;
  • consent wording materially changes;
  • an advertising purpose is introduced;
  • the existing consent can no longer reasonably be considered informed.

Do not mechanically re-prompt every six months if another legal/UX approach has been formally assessed and documented, but six months is PepperClub's launch standard.

B9. Persistent Cookie Settings control

Every website page should provide an easily accessible:

Cookie Settings

link/control, normally in the footer.

The mobile app should provide equivalent privacy/tracking controls through Settings where applicable.

The user must be able to withdraw optional consent without having to:

  • contact support;
  • delete their account; or
  • navigate through disproportionate steps.

B10. Withdrawal behaviour

When Analytics is turned from ON to OFF:

  • stop future optional Clarity tracking immediately or as soon as technically possible;
  • issue the appropriate denied consent signal;
  • stop creating new analytics/session recordings;
  • delete PepperClub-controlled optional analytics storage where technically possible;
  • use provider-supported methods to clear or stop relevant Clarity cookies where practical;
  • do not delete essential authentication/session state;
  • do not break the basket or checkout.

Withdrawal does not make earlier lawful collection unlawful.

B11. Clarity production controls

Before production release:

  • set analytics storage default to denied for users without consent;
  • ensure Clarity is not imported/initialised before CMP state is known;
  • integrate Clarity's supported consent API/mode;
  • test fresh browser with no consent;
  • test Accept;
  • test Reject;
  • test consent withdrawal;
  • test expired consent;
  • test logged-in and logged-out states;
  • test checkout/account/payment views.

Capture restrictions

PepperClub should:

  • mask sensitive inputs;
  • avoid custom tags containing direct personal information;
  • exclude password fields;
  • exclude payment details;
  • minimise address/email/phone capture;
  • consider excluding recordings on checkout/payment/account forms;
  • periodically inspect recordings to confirm masking actually works.

Do not rely on a configuration assumption without testing.

B12. Sentry production controls

Sentry Session Replay: disabled at launch.

Before production:

  • scrub obvious personal-data fields;
  • redact authentication headers/tokens;
  • redact payment secrets;
  • avoid full request-body capture unless specifically justified;
  • review frontend breadcrumbs;
  • review URL/query-string collection;
  • use sampling appropriate to operational need;
  • set retention according to PepperClub's privacy/engineering policy.

If a future Sentry feature introduces non-exempt device storage/access, reassess PECR before enabling it.

B13. Cloudflare controls

Cloudflare technologies may run before optional consent only where:

  • the feature is actually deployed;
  • its storage/access is necessary/proportionate for security, authentication, fraud prevention, fault detection or another valid exception; and
  • it is not being used for a secondary analytics/advertising purpose outside that exception.

If Turnstile is introduced:

  • configure it for security/bot prevention;
  • avoid unnecessary secondary use;
  • document the exact cookies/storage set;
  • add it to the live technology inventory.

B14. Payment controls

Stripe, Apple Pay and Google Pay integrations should be loaded in a way that minimises third-party storage before the customer actually needs the payment function where technically reasonable.

Do not grant a blanket "necessary" classification to every third-party tag owned by the payment ecosystem.

Review:

  • what is loaded on general browsing pages;
  • what is loaded only at checkout;
  • which cookies/device identifiers are created;
  • whether each is genuinely required for payment/security.

B15. Mobile app controls

At launch:

  • no IDFA advertising tracking;
  • no Android Advertising ID for advertising tracking;
  • no Apple ATT prompt solely for the planned PepperClub analytics model;
  • Firebase/FCM used for push infrastructure;
  • APNs used for Apple push delivery;
  • Sentry used for crash/error monitoring;
  • no Firebase Analytics unless separately reviewed and added to this policy/consent design.

If an app SDK starts using tracking identifiers or device storage for analytics/advertising beyond an exception, obtain any required consent and, where Apple platform rules require it, implement ATT.

B16. Functional preference controls

For preferences such as:

  • language;
  • accessibility settings;
  • interface layout;
  • theme;
  • other deliberately selected UI preferences,

engineering should document:

  1. what is stored/accessed;
  2. why;
  3. whether it satisfies the appearance/functionality exception;
  4. what simple free objection/removal mechanism exists.

If it does not clearly satisfy the exception, gate persistent device storage behind consent or redesign it.

B17. Recently viewed and behavioural personalisation

Do not classify "recently viewed" or behavioural recommendation tracking as Strictly Necessary merely because it improves conversion or convenience.

Before deploying device-based behavioural personalisation:

  • define the purpose;
  • identify exact storage/access technologies;
  • assess PECR;
  • add a Personalisation category where required;
  • default it OFF;
  • provide clear explanation;
  • obtain consent before use where required.

B18. Analytics exception — future option

PepperClub may later consider a privacy-focused aggregate analytics platform designed to satisfy the statistical-purpose exception.

Before relying on that exception, document that:

  • the sole storage/access purpose is qualifying statistics;
  • results are used to improve PepperClub;
  • the processing is appropriately limited;
  • it is not individual session tracking;
  • it is not advertising/profiling;
  • clear information is provided;
  • a simple free objection control exists.

Do not automatically move Microsoft Clarity into the exempt category.

B19. Required pre-production cookie audit

Before production launch, run a clean-browser audit covering:

Website

  • first page load with no prior consent;
  • corporate homepage;
  • sign-in;
  • customer marketplace;
  • search;
  • product page;
  • basket;
  • checkout;
  • payment;
  • account;
  • order confirmation.

Consent scenarios

  • no interaction with banner;
  • Reject;
  • Accept;
  • Analytics ON then OFF;
  • preference expiry;
  • new browser/device.

Inspect

  • cookies;
  • localStorage;
  • sessionStorage;
  • IndexedDB where used;
  • scripts/tags;
  • network requests;
  • SDK initialisation;
  • pixels/beacons;
  • third-party domains.

Any non-essential technology firing before consent must be treated as a release blocker until resolved.

B20. Live inventory requirement

The deployed application should maintain an accurate current technical inventory containing at least:

  • technology/cookie/key name;
  • provider;
  • host/domain;
  • purpose;
  • category;
  • first/third party;
  • duration;
  • whether it stores or accesses device information;
  • consent/exception basis;
  • applicable environment;
  • date last verified.

This inventory should be verified against actual production behaviour rather than populated only from vendor documentation.

B21. Regression controls

Add privacy/consent checks to release procedures.

A release introducing any of the following should trigger review:

  • new script manager;
  • new analytics platform;
  • new SDK;
  • social-media widget;
  • chat widget;
  • advertising integration;
  • new payment method;
  • fraud/fingerprinting system;
  • personalisation feature;
  • significant Cloudflare security feature;
  • Sentry Replay or similar recording;
  • Firebase Analytics;
  • embedded video/map provider.

B22. PepperClub launch decision summary

At launch:

Area PepperClub decision
Necessary authentication/basket/security Allowed where applicable exemption is genuinely satisfied
Consent preference 6 months
Microsoft Clarity Consent required; OFF by default
Clarity heatmaps Consent required
Clarity session recordings Consent required
Sentry Reliability/crash monitoring; Session Replay OFF
Firebase Analytics Not currently planned
FCM/APNs Push-notification infrastructure
Advertising pixels None at launch
Marketing category in banner Do not show until actually used
IDFA / Android Advertising ID Not used for advertising at launch
Apple ATT prompt Not planned/required for current launch model
Cookie wall No
Reject option Equal prominence with Accept
Analytics after Reject Must remain blocked
Analytics after withdrawal Stop future collection
Cookie Settings link Persistent
Pre-production technical audit Mandatory

B23. Ownership

Recommended internal ownership:

  • Engineering: technical blocking, CMP integration, inventories and testing;
  • Product: UI wording/flows do not undermine consent choice;
  • PepperClub management/data-protection owner: approves providers/purposes and policy changes;
  • QA/UAT: verifies that rejected technologies genuinely remain blocked.

No new analytics/advertising provider should enter production solely through a frontend code change without privacy review.