This Cookie Policy explains how Trystan Clarke, a sole trader trading as WhealBit ("WagePilot", "we", "us", "our"), uses cookies, local storage and similar technologies on our marketing website at wagepilot.co.uk and within the signed-in WagePilot application. It should be read together with our Privacy Policy and, where you are a customer, our Terms of Service and Data Processing Agreement. For staff personal data processed inside the app, the employer (organisation) is the data controller and WagePilot acts as that employer's processor; for our marketing website and for account and billing data, WagePilot is the controller.
This policy describes the technologies we use, whether the law requires your consent for them, the legal basis we rely on, and how you can refuse, change or delete them at any time. It is governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended) ("PECR") and, where any cookie or similar technology involves personal data, by the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
The law in this area is changing. Cookie and consent rules may be affected by the Data (Use and Access) Act 2025, which is expected to introduce some new exceptions to the consent requirement. We do not rely on any such exception unless and until it is in force and lawfully applies; we keep this policy under review and will update it as the position is confirmed.
1. What cookies and similar technologies are
A "cookie" is a small text file that a website asks your browser to store on your device. Cookies can let a site work properly, remember your choices, keep you signed in, keep the site secure and (where you allow it) help the operator understand how the site is used. When you return, the site can read back the cookies it set.
"Similar technologies" means other ways of storing or reading information on your device that work in a comparable way and are treated the same way under PECR. They include:
- Local storage and session storage (sometimes called "web storage"): browser-based storage used by web applications to hold information such as a secure sign-in token or interface state.
- Pixels, tags and beacons: small pieces of code that can record limited information. We use one advertising measurement pixel, the Meta Pixel, and only with your prior consent (see sections 3, 4 and 7).
- Software development kits and device identifiers where relevant to any installed or progressive web app version of WagePilot.
Cookies may be "session" cookies, which are deleted when you close your browser, or "persistent" cookies, which remain for a set period or until you delete them. They may be "first-party" (set by us) or "third-party" (set by another organisation - see section 7). PECR only applies where information is actually stored on, or read from, your device; technologies that store nothing on your device fall outside it.
2. The marketing site and the signed-in app are different
WagePilot is delivered through two separate environments, and they handle storage differently:
- The marketing website (at wagepilot.co.uk) is a largely static, public information site about our product. It is built to minimise what is stored on your device. Our website analytics are provided by a cookieless tool that stores nothing on your device (see section 3). The only advertising technology is the Meta Pixel, which is blocked until you opt in through the cookie banner and can be refused or withdrawn at any time (see sections 3, 4 and 5).
- The signed-in application (at app.wagepilot.co.uk) is the secure web application that employers and their staff log into to manage rotas, clock-in/out, timesheets, leave and related features. The app sets strictly necessary storage that is essential to deliver the service you have asked for - for example, to keep you securely signed in, to maintain your session, and to protect against fraud and cross-site request forgery. Because this storage is strictly necessary to provide a service you have actively requested, it does not require consent under PECR; we still describe it here for transparency. Any optional interface or display preference that is not essential is treated as a functional cookie and handled as set out in section 3. How we handle the personal data behind these features is explained in our Privacy Policy and, for staff data, in our Data Processing Agreement.
3. Categories of cookies and similar technologies we use
The table below sets out the categories, whether your consent is required, and why. Where we currently set no cookie in a category, we say so. If that ever changes, we will update this policy first.
| Category | Consent required? | Status and purpose | Examples / notes |
|---|---|---|---|
| Strictly necessary | No - exempt under PECR | In use (signed-in app). Needed for the service to function and to keep it secure. Essential to deliver a service you have requested, so set without asking for consent. You can block them in your browser, but parts of the service may then not work. | Maintaining your session and keeping you securely signed in; security and anti-fraud protections (including protection against cross-site request forgery); load-balancing and routing. On the marketing site, the only storage in this category is wp_cc, a first-party cookie that records the cookie choice you make in the consent banner (kept for 180 days, shared across wagepilot.co.uk and app.wagepilot.co.uk so the app can honour the same choice). Recording your choice is itself strictly necessary, so this cookie is set when you answer the banner, whichever answer you give. |
| Functional / preferences | Yes (if introduced) | Not currently set as a consent-required cookie on the marketing site. Where introduced, these would remember optional choices (such as interface or display preferences) that are not strictly necessary. | If introduced, these would be set only after you opt in. If declined, the service would still work but might not remember optional preferences between visits. |
| Analytics | No - no device storage | In use (marketing site). We use Vercel Web Analytics, a cookieless analytics tool provided by our hosting provider, Vercel, Inc. It does not store or read any information on your device, sets no cookies, and does not use cross-site identifiers or build profiles of you. Because nothing is stored on or read from your device, PECR consent is not required and no analytics cookie is set. | Measurement is aggregated and is used only to understand which pages are useful and how the site performs so we can improve it. Any personal data aspects (for example the provider's transient use of IP address and browser information to derive a short-lived, non-persistent visitor identifier during measurement) are addressed in our Privacy Policy. Vercel, Inc. is based in the United States; the transfer safeguards for that processing are set out in our Sub-processors list. If we ever switch to an analytics tool that stores information on your device, we will name it here and obtain your prior consent before it is used. |
| Advertising / cross-site tracking | Yes - opt-in via the cookie banner | In use (marketing site), only with your prior consent. We use the Meta Pixel, provided by Meta Platforms Ireland Limited and Meta Platforms, Inc. ("Meta"), to measure whether our adverts on Meta's platforms (Facebook and Instagram) lead to sign-ups. It is blocked by default: no Meta code loads and no advertising cookie is set or read unless you choose "Accept" in the cookie banner. If you choose "Reject", or make no choice, it stays off and the site works identically. | With consent, Meta sets the first-party cookies _fbp (identifies your browser for ad measurement, up to 90 days) and, where you arrived from a Meta advert, _fbc (records the ad click, up to 90 days). If you consented and then create a WagePilot account, the app reports that single sign-up conversion to Meta, reading those cookies for attribution; without consent it does not. Meta may use this data for its own purposes as described in Meta's Privacy Policy; Meta Platforms, Inc. is based in the United States. You can withdraw consent at any time via "Cookie preferences" in the site footer (see section 5). |
4. Consent
Strictly necessary storage and our cookieless analytics do not require consent, for the reasons given in section 3, and are used as soon as you use the relevant environment. The one non-essential technology we use, the Meta Pixel, requires consent, and we ask for it through the cookie banner shown on the marketing site. Our consent mechanism works to the UK GDPR standard:
- Opt-in by default. The Meta Pixel is blocked until you give consent. We do not use pre-ticked boxes, sliders set to "on", implied consent, or "cookie walls" that deny access unless you accept. If you dismiss or ignore the banner, nothing is set.
- Reject as easy as accept. The banner offers "Accept" and "Reject" side by side, with equal prominence, each one click.
- Granular. We offer a single optional category (advertising measurement), so one choice covers it. If we ever offer more than one optional category, you will be able to accept or reject each separately.
- Informed. The banner says what the pixel does and links to this policy before you choose.
If you ever believe a tool on our site does not behave as described here, please contact us at info@whealbit.co.uk so we can investigate and correct it.
5. How to refuse, change or delete cookies and storage
You can control storage at any time:
- Through the "Cookie preferences" link in the footer of the marketing site: it reopens the consent banner so you can change your choice, in either direction, at any time. Withdrawing consent is as easy as giving it, and takes effect from your next page load. Withdrawing consent will not affect anything lawfully done before you withdrew it; if you want the cookies Meta already set removed immediately, delete them through your browser as below.
- Through your browser: most browsers let you view, block and delete cookies and clear local storage through their settings or privacy menu. You can usually set your browser to warn you before a cookie is stored, or to refuse cookies altogether, and to use a private or incognito mode. Steps differ by browser, so please check your browser's help pages.
Where your browser sends a standard refusal signal (such as Global Privacy Control), we honour it as a refusal of consent for advertising measurement: the banner is not shown and the Meta Pixel stays off, unless you later opt in explicitly through "Cookie preferences".
6. Consequences of blocking or deleting storage
You are free to block, refuse or delete cookies and storage. Please be aware:
- If you block strictly necessary storage, parts of the signed-in app may not work - for example, you may be unable to stay signed in or to use secure features.
- Refusing or deleting the advertising measurement cookies has no effect on how the marketing site or the app works for you; it only means our advert measurement will not count you. Our analytics is cookieless, so there is nothing else on the marketing site to refuse.
- If we later introduce functional cookies and you refuse them, the site would still work but might not remember optional preferences between visits.
7. Third-party technologies and our service providers
We keep third-party technologies on the marketing site to a minimum. Our website analytics, Vercel Web Analytics, runs as a first-party script served from this domain by our hosting provider and, being cookieless, stores nothing on your device. The one third-party advertising technology is the Meta Pixel, described in section 3, which runs only with your consent and operates under Meta's Privacy Policy and cookie notices, which we encourage you to read. Where any other third party runs on our site, it does so under its own privacy and cookie notices.
Separately, a number of service providers help us operate the WagePilot service itself (for example our hosting, database and authentication, payment, and transactional email providers). These providers may set strictly necessary storage in the signed-in app or process related personal data. They are a distinct matter from website cookies: for staff data processed in the app they are engaged as our sub-processors under Article 28 UK GDPR, with the employer as controller and WagePilot as processor. Their identities, roles and regions are listed in our sub-processors list and described in our Privacy Policy. For the marketing site, WagePilot is the controller for any visitor and analytics data.
8. Cookies and personal data
Some cookies and similar technologies can involve personal data (for example an identifier in a cookie). Where they do, that processing is also governed by the UK GDPR and is described in our Privacy Policy, including the lawful basis we rely on, the recipients, any international transfers and the safeguards used, retention periods, and your individual rights (including the right to complain to the Information Commissioner's Office).
We do not use cookies, analytics or similar technologies to collect, infer or store special-category data (such as health information or the reasons for a member of staff's leave). Any such data is processed only within the app, by the employer as controller, under the safeguards set out in our Privacy Policy and Data Processing Agreement.
This Cookie Policy does not affect, limit or exclude your statutory rights under data protection law.
9. Changes to this policy
We may update this Cookie Policy from time to time to reflect changes in the technologies we use, our providers, or the law (including any guidance or exceptions that come into force under the Data (Use and Access) Act 2025). When we make material changes we will update the "last updated" date shown with this policy and, where a change introduces non-essential cookies, we will obtain your consent before relying on it. Please check this page periodically.
10. Contact
If you have any questions about this Cookie Policy or our use of cookies and similar technologies, please contact us at info@whealbit.co.uk, or write to us at St Ives, Cornwall. Our data protection registration reference with the Information Commissioner's Office is [ICO registration reference — to be completed before go-live]. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.
Related documents: Privacy Policy, Terms of Service, Data Processing Agreement, Sub-processors, Acceptable Use Policy, Service Level Agreement, and our Security page.