Request a list

Cookie Notice

Version 1.0 (draft) · Last updated TODO — [EFFECTIVE DATE]

CompanyLists
Operated by Team Dimensions Ltd, a company registered in England and Wales (company number 08348964), registered office Walden House, Foxcombe Road, Oxford, OX1 5DL.

Website: https://companylists.co.uk · Contact: [email protected]

This Cookie Notice is a standalone page and should be linked from the site footer alongside our Terms of Sale & Licence, our Privacy Policy / Customer Privacy Notice, and our Database Privacy Notice (the UK GDPR Article 14 notice to the company officers whose details appear in the lists we compile). It forms part of, and should be read with, our Privacy Policy.

1. What cookies are and our consent approach

Cookies and similar technologies. A cookie is a small text file that a website places on your device (computer, phone or tablet) when you visit. Cookies let a site remember things between page loads and visits — for example, that you are in the middle of a checkout, or how many people viewed a particular list page. "Similar technologies" includes things such as local storage, pixels/tags and software development kits that work in a comparable way. In this notice, references to "cookies" include those similar technologies.

Who is responsible. The controller for the cookies and similar technologies on this website is Team Dimensions Ltd (company number 08348964), trading as CompanyLists, registered office Walden House, Foxcombe Road, Oxford, OX1 5DL. We decide why and how cookies are used on https://companylists.co.uk. How we handle any personal data collected through cookies is explained in this notice and, in more detail, in our Privacy Policy.

Our consent approach (PECR + UK GDPR). Under the Privacy and Electronic Communications Regulations 2003 (PECR), as read with the UK GDPR and the Data Protection Act 2018, we may only set cookies on your device after you have given your consent — except for cookies that are "strictly necessary" to provide a service you have actively asked for. So:

  • Strictly-necessary cookies (for example, the cookies that make our checkout and your session work) are set automatically, because without them the service you actively requested cannot be delivered. Cookies in this category are limited to what is necessary to provide that service. See section 2.
  • All other cookies — currently our analytics cookies — are non-essential and are set only after you give consent through our cookie banner. They are switched off by default. See section 3.

When you first visit the site you will see a cookie banner that lets you accept or reject non-essential cookies, or choose which categories to allow. We do not use pre-ticked boxes, and we do not treat continuing to browse, scrolling, or simply closing the banner as consent. Strictly-necessary cookies are described for transparency but you cannot switch them off through the banner, because the site cannot function without them.

Lawful basis for personal data collected through cookies. Where non-essential cookies (our analytics cookies) collect personal data, our lawful basis under the UK GDPR is your consent (Article 6(1)(a)), consistent with the consent we obtain under PECR. For strictly-necessary cookies, we rely on our legitimate interests in operating a secure and functional website to deliver the service you requested. Your data-protection rights — including access, rectification, erasure, restriction, objection, and the right to withdraw consent — are explained in, and exercisable under, our Privacy Policy.

Withdrawing consent at any time. You can change your mind whenever you like. You can:

  • re-open the cookie banner / preferences panel using the "Cookie settings" (or "Manage cookies") link in our site footer, and turn analytics cookies off again; and/or
  • use your browser settings to block or delete cookies for this site (see section 4 for links and guidance).

Withdrawing consent is as easy as giving it. When you turn analytics off in our preferences panel, we stop the Google Analytics tag from loading on subsequent page views and stop setting the relevant non-essential cookies from that point; you can also delete any cookies already stored using your browser. We treat your withdrawal as taking effect immediately for new collection.

Complaints. If you have any concerns about how we use cookies or the personal data collected through them, please contact us first at [email protected] so we can try to put things right. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection and PECR, at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.

2. Strictly-necessary cookies (no consent required)

These cookies are essential to operate the site and to let you do the things you came here to do — in particular, to complete a payment and (if you choose) to access a post-purchase account. We set them without asking for consent because they are strictly necessary to deliver a service you have actively requested (such as taking you through checkout), which is the recognised exemption under PECR. They are not used for advertising or for analytics. Cookies in this category are limited to what is necessary to provide that service.

In use (or intended for use) in this category:

  • Stripe Checkout / payment cookies. When you buy a list, payment is taken through Stripe Checkout in a one-off payment (Stripe Checkout in payment mode). Card details are entered into and handled solely by Stripe — CompanyLists never sees or stores your full card details. Because our checkout is hosted by Stripe, Stripe acts as a separate operator and sets its own cookies on its pages and components. The cookies needed to load and operate the Stripe-hosted checkout you have actively initiated are necessary to deliver the payment service you asked us to provide. Stripe may also use cookies to help secure the checkout and detect or prevent fraud; the basis on which Stripe sets and relies on its own cookies (and any consent it obtains for them) is governed by Stripe's own policies on its hosted pages, linked below.
  • Site session cookie. A first-party session cookie that lets the website function as you move through it — for example, keeping the state of your checkout, carrying you from the buy button to Stripe and back to the confirmation page, and supporting any optional account that we may offer after payment. Without it, basic functions such as completing a purchase would break.

Stripe's own cookies and information. Because Stripe hosts the checkout and sets its own cookies in the course of taking payment, the way Stripe uses those cookies is governed by Stripe's own policies. You can read more in:

Stripe also provides a customer record for us so we can identify and fulfil your order. How we use the personal data you provide at checkout (your name and email) is explained in our Privacy Policy; CompanyLists is the controller for that customer/checkout data.

Because these cookies are strictly necessary to deliver the checkout, they cannot be turned off through our cookie banner. You can still block or delete them through your browser, but if you do, the checkout and parts of the site may not work.

3. Analytics cookies (consent required)

Analytics cookies help us understand how people find and use the CompanyLists storefront, so we can improve it. They are non-essential, so we set them only after you opt in through the cookie banner. Our lawful basis for any personal data collected through them is your consent (UK GDPR Article 6(1)(a)), which you can withdraw at any time (see section 1).

What we use. We use, or intend to use, Google Analytics (Google's analytics service, including the Google tag / gtag.js used to load it). We may also operate Google Search Console; Search Console verification does not set cookies on your browser and reports on how the site appears in Google Search. If any Google tag or feature were to set a non-essential cookie, it would be disclosed in the cookie table in section 4 and would load only after your consent. We do not use advertising or profiling cookies. The exact cookie names and providers in this category are listed in the table in section 4.

Purpose. We use analytics to measure traffic and to understand how the storefront is used — for example, how many people visit, which list pages and sample tables are most popular, which sources or campaigns visitors arrive from, roughly where in the world visitors are (at country/region level), what device and browser they use, and how they move through the buying journey. This helps us fix problems, improve the lists and pages we offer, and measure our marketing.

Broad data collected. Through analytics cookies and tags we and our analytics provider may collect: a randomly generated analytics identifier, pages viewed and time on page, referring/source information and campaign parameters, approximate location derived from a truncated/anonymised IP address, and device, browser and operating-system information. We use this in aggregated and statistical form. We do not use analytics cookies to build advertising profiles of you, and we do not combine analytics data with the officer personal data contained in the lists we sell.

Your rights. Where analytics cookies collect personal data about you, you have rights of access, rectification, erasure, restriction and objection, and the right to withdraw your consent. These rights, and how to exercise them, are set out in our Privacy Policy. You can also complain to the ICO (see section 1).

Retention. Analytics cookies have their own expiry (set out in section 4 — typically up to around 2 years for the main Google Analytics identifier cookie, with a short-lived "throttling" cookie). The analytics records held in Google Analytics are retained for a configurable period — we set Google Analytics data retention to 14 months — after which user-level and event-level data is deleted in line with Google's retention controls.

Off by default; on only with consent. Analytics are disabled until you opt in via the cookie banner. We do not load the Google Analytics tag, and no analytics cookies are set, unless and until you give consent. If you later withdraw consent (section 1), we stop loading analytics and stop setting those cookies; you can delete any existing analytics cookies through your browser or the opt-out tools in section 4.

International transfers. Using Google Analytics may involve transferring data outside the UK. Where data is transferred outside the UK, we (and our analytics provider) rely on an appropriate transfer mechanism — such as a UK adequacy regulation / data bridge (including the UK Extension to the EU-US Data Privacy Framework) or the International Data Transfer Addendum to the EU Standard Contractual Clauses — together with any additional safeguards required. More detail on international transfers is in our Privacy Policy.

4. Cookie table, managing your choices and changes to this notice

Cookie table

The table below lists the cookies we use or intend to use.

Cookie / identifierProviderTypePurposeExpiry (approx.)
cl_sessionCompanyLists (first party)Strictly necessaryMaintains your session and checkout state as you move through the site and to/from Stripe; supports any optional post-purchase account.Session
__stripe_midStripeStrictly necessaryOperate and secure the Stripe-hosted checkout you initiated; identifies a returning browser to Stripe during checkout.~1 year
__stripe_sidStripeStrictly necessaryOperate and secure the Stripe-hosted checkout you initiated; ties together actions within a single checkout session.~30 minutes
_gaGoogle AnalyticsAnalytics (consent required)Distinguishes unique users by assigning a randomly generated identifier.~2 years
_ga_*Google Analytics (GA4)Analytics (consent required)Maintains session state for GA4.~2 years
_gidGoogle AnalyticsAnalytics (consent required)Distinguishes users over a short period.~24 hours
_gat / _gat_*Google AnalyticsAnalytics (consent required)Throttles the rate of requests to Google Analytics.~1 minute
Note on accuracy. The Stripe and Google entries above reflect commonly used cookies for those services; the exact names, parameters and expiries set on this site may be updated from time to time as those providers change the cookies they use.

Managing and withdrawing your consent

You are in control of non-essential cookies:

Blocking strictly-necessary cookies may stop the checkout or other core features from working. Blocking analytics cookies will not affect your ability to browse, buy a list or download your CSV.

Where to find this notice

We recommend keeping this Cookie Notice as a standalone page linked from the footer of every page, alongside the Terms of Sale & Licence, the Privacy Policy, and the Database Privacy Notice, so visitors can find it independently.

Changes to this notice

We may update this Cookie Notice from time to time — for example, if we add, remove or change analytics tooling, or if Stripe or Google change the cookies they set. When we make material changes we will update the version and "last updated" date at the top of this page and, where appropriate, ask for fresh consent through the banner. The cookie set on the site may change as our analytics tooling changes, so please check this page periodically.

Related documents

  • Privacy Policy / Customer Privacy Notice — how we handle your customer and checkout data: /privacy
  • Database Privacy Notice (UK GDPR Article 14) — the notice to the company officers whose details appear in our lists: /database-privacy-notice
  • Terms of Sale & Licence — the contract that governs your purchase and licence: /terms
  • Refund & Delivery — digital delivery and your cancellation rights: /refunds

Governing law

This Cookie Notice and any dispute relating to it are governed by the laws of England and Wales, and the courts of England and Wales have jurisdiction, without affecting any mandatory consumer-protection rights you have where you live.

Contains public sector information licensed under the Open Government Licence v3.0 (http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/). The Open Government Licence does not license personal data; UK GDPR and PECR apply to personal data independently.