Last updated: 20 April 2026
Cookie Policy
How London Vesta College uses cookies, local storage, scripts, embedded media, and similar technologies on its website.
This policy explains how London Vesta College Limited uses cookies and similar storage or access technologies on this website. It should be read with our Privacy Notice.
The current website uses a small number of browser and third-party technologies. We have not identified active Google Analytics, Google Ads, Google Tag Manager, Meta/Facebook Pixel, LinkedIn Insight Tag, TikTok Pixel, Hotjar, custom session cookies, custom CSRF cookies, or other advertising pixels in the current website source.
What this policy covers
"Cookies" are small files stored by your browser. PECR also covers similar technologies that store information on, or access information from, your device. On this website, that includes:
- browser local storage;
- scripts and tags;
- embedded maps, video, and thumbnail requests;
- bot-protection scripts where configured;
- hosting, security, and diagnostic technologies.
We have not identified active browser session storage in the current website source.
Audited technology inventory
| Name or technology | Provider | First-party or third-party | Purpose | Duration or persistence | Status or legal basis | UK or international processing | How to turn it off, object, or withdraw |
|---|---|---|---|---|---|---|---|
cookie-consent local storage item | London Vesta College website | First-party browser local storage | Remembers whether you accepted all, rejected optional storage, or saved analytics and marketing preferences. | Persists in your browser until you change Cookie settings or clear browser storage. | Strictly necessary preference storage. | Stored in your browser; not intentionally sent to us by the preference component. | Use the Cookie settings link in the footer or clear site storage in your browser. |
| Cloudflare Pages, CDN, security, and platform logs | Cloudflare | Third-party service provider for hosting and security | Delivers pages, applies security headers, helps protect availability, and processes request metadata such as IP address, user agent, URL, referrer, country, timestamps, response status, and security events. | Server and edge-log retention depends on Cloudflare account settings and security needs. | Strictly necessary hosting, security, and service operation. | Cloudflare may process data outside the UK. Transfer safeguards and settings should be checked by the site owner. | Required to deliver and secure the site. You can use browser privacy tools, but the website may not function if Cloudflare is blocked. |
| Cloudflare Turnstile script and challenge technology | Cloudflare | Third-party bot-protection service | Protects contact and application forms from spam and automated misuse when the Turnstile site key is configured. | Cloudflare controls challenge/session behaviour and any storage or device access used for verification. | Security technology. Treated as necessary for protected forms when enabled. | Cloudflare may process data outside the UK. Transfer safeguards and Turnstile settings should be checked by the site owner. | If Turnstile is enabled, the protected form cannot be submitted without verification. You can contact us by email or phone instead. |
| Pagefind search script and static search index | London Vesta College website using Pagefind | First-party script served from this website | Lets you search website content in your browser. Search terms are used locally by the search script to show results. | The script and index are downloaded when search is opened or used; the website does not intentionally store search terms from Pagefind. | Functional technology requested by the user when search is used. | Served from this website. Standard Cloudflare request logs may still apply. | Do not open or use search. You can also block scripts, but that may affect site functionality. |
| Programme filters, menus, tabs, and form controls | London Vesta College website | First-party browser behaviour | Lets you interact with page controls and forms. | No identified persistent storage for these controls, except the cookie preference item listed above. | Functional behaviour needed for pages and forms. | Handled in your browser, with normal hosting logs for page requests. | Do not use the relevant controls or disable JavaScript, although this may affect the site. |
| Google Maps iframe on the contact page | Third-party embedded media | Shows the London Vesta College location and lets visitors interact with the map. | Google controls any storage or device access associated with the map iframe. | Embedded media used to show our location. | Google may process data outside the UK. | Avoid the contact page map or use browser controls that block third-party frames. You can use the written address instead. | |
| YouTube thumbnail requests | Google / YouTube | Third-party embedded media request | Loads video thumbnails for testimonial and success-story video cards. | Google controls any storage or device access associated with thumbnail delivery. | Embedded media; no advertising pixels are loaded by our site code, but Google receives technical request data. | Google may process data outside the UK. | Avoid pages containing embedded video cards or use browser controls that block third-party image/media requests. |
YouTube privacy-enhanced video iframe from youtube-nocookie.com | Google / YouTube | Third-party embedded media | Plays a video after you choose to play it. | Google controls any storage or device access associated with video playback. | Consent or user-initiated embedded media interaction, depending on context and configuration. | Google may process data outside the UK. | Do not press play. You can also block third-party media in your browser. |
| Outbound social and share links | Facebook, LinkedIn, X/Twitter, Instagram, YouTube, and other linked platforms | Third-party websites after you click a link | Opens our profiles or sharing destinations on external platforms. | Controlled by the external platform after you leave our site. | Not loaded as tracking plugins by the current site source. | External platforms may process data outside the UK. | Do not click the external link. Use your account and browser privacy settings on the external platform. |
| Optional redirect-log endpoint | London Vesta College on Cloudflare Pages Functions | First-party endpoint using Cloudflare logs | Can log legacy redirect activity if called, including old path, new path, timestamp, user agent, referrer, IP address, and country. | Cloudflare log retention depends on platform settings. | Legitimate interests in monitoring broken or legacy redirects and site reliability. | Cloudflare may process log data outside the UK. | This endpoint is not part of normal browsing unless a page or redirect flow calls it. Browser privacy tools may limit referrer or request metadata. |
| Resend email delivery after form submission | Resend | Third-party email delivery provider | Sends contact and application form content to our mailbox and acknowledgement emails to applicants or enquirers. | Resend retention depends on account settings and email delivery logs. | Not a browser cookie. It processes data only when you submit a form. | Resend may process data outside the UK. Transfer safeguards should be checked by the site owner. | Do not submit the form; contact us by another route if preferred. |
Optional analytics and marketing
The current website source does not intentionally load optional analytics tags, advertising pixels, retargeting tags, heatmaps, session replay tools, CRM tracking scripts, or tag-manager containers.
If these technologies are added later, they must not be enabled unless the cookie banner, this policy, and the Privacy Notice are updated first. Marketing and advertising storage or access technologies require consent before they are used. Analytics must be assessed under PECR and UK GDPR. If the Data (Use and Access) Act statistical-purposes exception is relied on, the setup must be low intrusion, used only for aggregate statistical improvement, clearly explained, and include a simple free way to object.
Your choices
When the cookie banner appears, you can:
- accept all categories;
- reject optional analytics and marketing technologies;
- manage analytics and marketing choices separately;
- close the banner without making a choice.
Closing the banner does not record consent for optional analytics or marketing technologies.
You can change your choice by using the Cookie settings link in the website footer. You can also clear or block cookies and local storage in your browser settings. Blocking all storage may affect preferences, forms, security checks, search, videos, or other interactive features.
Browser controls
Most browsers let you view, block, or delete cookies and site storage. Browser controls are separate from the website's cookie banner. If there is a conflict, we will respect the most recent choice we can reliably detect.
Data protection and site-owner review checks
Before this policy is approved for production, the data protection contact, site owner, or any appointed DPO should confirm:
- whether Cloudflare Web Analytics, Zaraz, Bot Management, Turnstile, challenge pages, or other Cloudflare dashboard features add cookies, scripts, tags, or device access outside the website source;
- whether Google Analytics, Google Tag Manager, Google Ads, Meta/Facebook Pixel, LinkedIn Insight Tag, TikTok Pixel, Hotjar, CRM tracking, newsletter tracking, or similar tools are injected by any platform outside the website source;
- whether any analytics setup will rely on consent or on the Data (Use and Access) Act statistical-purposes exception, and whether the implementation meets the exception conditions;
- whether all third-party processors and controllers have current contracts, transfer safeguards, retention settings, and privacy information;
- whether the Google Maps iframe on the contact page remains acceptable for the deployed location design;
- whether YouTube thumbnail loading before playback is acceptable for the deployed success-story video design;
- whether the cookie preference storage period should have a fixed expiry rather than lasting until the user changes settings or clears browser storage;
- whether the cookie scan of the live production domain matches this policy after deployment.
Changes to this policy
We update this policy when our website features, consent mechanism, suppliers, analytics tools, marketing tools, legal obligations, or ICO guidance change. The latest version is published on this page.
Contact us
For questions about cookies, privacy, or data protection, contact:
- Data protection contact: [email protected]
- General contact: [email protected]
- Phone: 0207 377 0731 / 07767 115 842
- Address: London Vesta College, 'Montefiore Centre', Hanbury Street, London E1 5HZ, United Kingdom
For more information about cookies and similar technologies, see the ICO cookies guidance and the ICO guidance on storage and access technologies.