GOVIQ-POL-019 · v0.1 (DRAFT)
Cookie Policy
- Effective
- 2026-05-29 (target)
- Owner
- Liam McDonagh, CEO & acting Data Protection Lead
- Review cycle
- Annual, or on any change to website tooling
- Contact
- privacy@goviq.ie
Statutory references: ePrivacy Regulations 2011 (S.I. No. 336 of 2011), GDPR (consent for non-essential cookies), Data Protection Commission Guidance on Cookies (2020).
2.Categories of cookies and similar technologies
The Data Protection Commission's 2020 guidance distinguishes four categories of cookies. GovIQ uses only the first two.
2.1 Strictly necessary cookies — set without consent
These cookies are essential for the website to function. The ePrivacy Regulations exempt them from consent because without them, the service you have asked for cannot be delivered.
| Cookie / technology | What it does | Provider | How long it lasts |
|---|---|---|---|
| Session cookie (Vercel platform) | Identifies a single browsing session for the site to function | Vercel | Session (deleted when browser closed) |
| CSRF token | Prevents cross-site request forgery on any form submission | GovIQ | Session |
| Consent record cookie | Remembers your cookie consent choices so we don't ask again | GovIQ | 12 months |
2.2 Performance / analytics cookies — consent required
We use a minimal analytics setup to understand which pages are useful and where to improve. These cookies are set only after you give consent via our cookie banner.
| Cookie / technology | What it does | Provider | How long it lasts |
|---|---|---|---|
| To be confirmed at website build (e.g., Plausible, Fathom, or self-hosted Umami) | Aggregate, anonymised analytics — page views, referrers, geography | TBD — EEA-hosted preferred | TBD per provider |
Our deliberate choice:GovIQ uses privacy-preserving analytics that do not track individuals across sites and do not require an analytics cookie at all (e.g., Plausible / Fathom). If we have implemented one of these, this section may say “no analytics cookies — privacy-preserving server-side analytics only.”
2.3 Functional cookies — consent required
We do not currently use functional cookies (e.g., language preferences). If we add them in future, this section will be updated and consent will be sought.
2.4 Marketing / advertising cookies
We do not use marketing or advertising cookies. We do not run advertising on our website, we do not embed advertising-network pixels, and we do not share visitor data with third-party advertisers.
3.Third-party cookies
Some content on goviq.ie may be embedded from third-party services (e.g., a YouTube demo video or a calendar booking widget). These may set their own cookies. Where possible we use privacy-preserving embed modes:
- YouTube:
youtube-nocookie.comembed (no cookies until you click play) - Calendar bookings: provider TBD, in privacy mode
A live list of any third-party embeds and the cookies they may set is maintained on this page whenever such embeds are present.
4.How we obtain your consent
When you first visit goviq.ie, we display a cookie banner that:
- Tells you we use cookies
- Lets you accept all non-essential cookies, reject all non-essential cookies, or choose by category
- Records your choice via the consent record cookie (§2.1)
- Does not set any non-essential cookie until you have made a choice
- Does nottreat “continuing to browse” as consent (this practice was deprecated by DPC guidance in 2020)
You can change your choice at any time by clicking the “Cookie preferences” link in the website footer.
5.How to control cookies in your browser
In addition to our cookie banner, your browser provides controls:
| Browser | How to manage cookies |
|---|---|
| Chrome | Settings → Privacy and security → Cookies and other site data |
| Firefox | Settings → Privacy & Security → Cookies and Site Data |
| Safari | Preferences → Privacy → Cookies and website data |
| Edge | Settings → Cookies and site permissions |
You can also use private / incognito mode for sessions where you do not want cookies retained.
Blocking strictly necessary cookies will break parts of the site (you will not be able to submit forms, for example).
6.International transfers and analytics
Our preferred analytics providers are EEA-hosted (Plausible, Fathom, self-hosted Umami). If we ever use a US-hosted analytics service that processes IP addresses or device identifiers, this section will:
- Disclose the provider and the transfer mechanism (SCCs + supplementary measures)
- Be subject to renewed consent if the transfer mechanism changes materially
7.Updates to this policy
This policy is reviewed:
- Annually
- Whenever we add or remove any cookie or similar technology
- Whenever the DPC issues updated guidance
Material changes are reflected in the cookie banner so existing visitors are prompted to re-confirm consent.
Version history is preserved in the GovIQ repository.
8.Your rights
Cookies that contain identifiers or that are linked to identifiable individuals are personal data under GDPR. The full list of your rights — including access, erasure, and the right to lodge a complaint with the Data Protection Commission — is set out in our Privacy Policy (§8).