Skip to main content
Legal

Cookie Policy

Last updated: 25 September 2026

1. What this covers

This policy covers cookies and similar technologies we use on ssgpartnerships.com — including browser storage such as localStorage and sessionStorage. UK law on this (the Privacy and Electronic Communications Regulations) applies to anything stored on or read from your device, not just to cookies, so we list all of it here.

For how we use the personal data behind these technologies, and your rights over it, see our Privacy Policy.

2. Your choices

  • When you first visit, a banner asks what you’re happy with. Nothing that isn’t strictly necessary runs until you choose — we don’t set analytics, advertising, attribution or A/B testing storage before you agree.
  • To change or withdraw your choices at any time, use the Cookie preferences link at the bottom of any page. Withdrawing is as easy as agreeing, and when you withdraw we delete the cookies we set.
  • We ask again every 12 months, so a choice never outlives its welcome.
  • You can also block or delete cookies in your browser settings. That works too, but it won’t remove cookies other websites have set.

3. Strictly necessary

These are set without asking, because the site cannot do what you asked of it without them. You cannot switch them off.

NameProviderPurposeLifetime
ssg-consent
(browser storage, not a cookie)		SSG (first party)Stores your cookie choices, plus a random reference number so we can evidence what you chose and when. That reference is used for nothing else and is never linked to your name or email.12 months, then we ask again
payload-tokenSSG (first party)Signs our own staff in to the content management system. Only ever set if you log in at /admin.Session

4. Analytics — only with your consent

These help us see which pages are useful and which version of a page works better. None of them is set unless you agree to analytics.

NameProviderPurposeLifetime
_gaGoogle Analytics 4Tells one visitor’s browser apart from another’s, so we can count visitors rather than visits.13 months from your last visit (we shorten Google’s 2-year default)
_ga_<measurement id>Google Analytics 4Keeps track of your current visit.13 months from your last visit
hubspotutkHubSpotLinks an enquiry you send us to the pages you looked at beforehand, so we can see which content led to it.6 months
__hstcHubSpotRecords the referring site, your first visit and your current visit.6 months
__hsscHubSpotTracks the current session.30 minutes
__hssrcHubSpotDetects whether you have restarted your browser.Session
ssg_exp_<test name>SSG (first party)Remembers which version of a page you were shown when we are testing two designs, so you keep seeing the same one. Holds a single letter and nothing else. If you don’t consent, you simply see the standard version of every page.30 days
ssg_attr_session
(browser storage)		SSG (first party)Notes that this visit’s referral has already been recorded, so one visit isn’t counted twice.Until you close the tab

5. Marketing and advertising — only with your consent

These let us measure which campaigns bring people to us, and let Google and LinkedIn report on their own advertising. None of them is set unless you agree to marketing.

NameProviderPurposeLifetime
ssg_attrSSG (first party)Records how you first reached us and how you reached us most recently: the campaign name, the search engine or social network, the page you landed on, and the advertising click identifier the ad platform added to the link (for example gclid from Google Ads or li_fat_id from LinkedIn). If you later send us an enquiry, this is how we know which of our campaigns reached you.

It does not contain your name, email or phone number. It does contain an advertising click identifier, which the platform that issued it can trace back to your individual click — which is why we treat it as marketing data rather than analytics, and why we don’t set it until you agree. Because it is set for the whole site, your browser sends it to us with every page you view here.		90 days
_gcl_au, _gcl_aw, _gcl_gb, _gcl_dcGoogleStore the advertising click identifier after you click one of our ads, so Google can report which ad led to an enquiry.90 days
bcookieLinkedInLinkedIn’s browser identifier, used for its advertising and Insight Tag.12 months
bscookieLinkedInSecure version of the above.12 months
lidcLinkedInChooses which LinkedIn data centre serves you.1 day
li_sugrLinkedInA probabilistic identifier LinkedIn uses to match browsers.90 days
UserMatchHistoryLinkedInSynchronises LinkedIn’s advertising identifiers.30 days
li_gcLinkedInStores your consent for LinkedIn’s own non-essential cookies.6 months
_fbp, _fbcMeta (Facebook)Identify your browser so Meta can report on our advertising there. Loaded through our tag manager.90 days
IDEGoogle (DoubleClick)Measures and reports on ad performance across sites. Set on Google’s own domain, so it has to be removed through Google’s controls (see below).Up to 13 months

6. Google Tag Manager

Google Tag Manager sets no cookies of its own. It is the container that loads the Google tags listed above, and it only does so within the choices you have made.

7. What happens before you choose

We want to be straight with you about this, because it isn’t obvious. Google’s tags load on every page, but until you agree they run in a mode where they store nothing on your device and read nothing from it — no cookies, no identifiers.

In that mode they do still send Google a single anonymous signal that a page was viewed, which includes your IP address, the page address and the time. We have asked Google to strip advertising identifiers from those signals. Google acts as our processor for analytics, and as an independent controller for its advertising products; its own notice is at policies.google.com/privacy.

LinkedIn’s and HubSpot’s scripts are different: they are not loaded at all until you consent.

8. Cookies we can’t delete for you

LinkedIn’s and Google’s cookies are set on their own domains, not ours. When you withdraw consent we stop loading their tags and we delete the cookies we set, but anything already stored on .linkedin.com, .google.com, .doubleclick.net or Meta’s domains has to be removed in your browser or through their own controls:

You may also see a __cf_bm cookie on those providers’ own domains (for example .hubspot.com or .linkedin.com). It is set by Cloudflare to tell real visitors from bots when your browser loads their scripts. It is a security cookie on their domain, not ours, so we can neither read nor remove it.

9. How long we keep the data behind these cookies

  • Usage analytics: 14 months, the maximum Google Analytics 4 allows.
  • Cookie consent records: 12 months, after which we ask you again. We keep a record of your choice — including a refusal — so we can show we honoured it.
  • Non-essential cookies: never longer than 13 months from your last visit.
  • Attribution data: the ssg_attr cookie lasts 90 days. Once it is copied onto an enquiry, it follows that enquiry’s retention period — see our Privacy Policy.

10. Transfers outside the UK

Google, LinkedIn and HubSpot may process this data outside the UK, including in the United States. Where that happens we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses.

11. Changes to this policy

We will update this page and the “last updated” date when anything changes. If a change materially affects what you agreed to, we will reset your choice and ask you again.

12. Contact us