1. About this Notice
This Cookie and Storage Technologies Notice explains how Xworks Holdings Ltd uses cookies and similar technologies on xworks.systems and public pages that link to this Notice (the Site). It should be read with our Website Privacy Notice.
We use “storage technologies” broadly. It includes cookies, local storage, pixels, scripts, browser APIs, request-derived identifiers and other methods that store information on, or obtain information from, a browser or device.
2. Current summary
The technology schedule below reflects a review of the production Site on 8 September 2026. At that date:
- no advertising, retargeting or social-media tracking technologies were identified;
- Vercel Web Analytics and Vercel Speed Insights were loaded to produce aggregate site and performance statistics;
- Cloudflare Turnstile was loaded on protected contact forms to prevent automated abuse; and
- the Site did not intentionally store a first-party account, preference or marketing cookie.
Some security technologies are risk-based and may set a cookie only for certain browsers or challenge outcomes. Provider names, cookie names and durations can also change. We therefore audit the Site when the technology stack changes and update this Notice where needed.
3. Technology schedule
| Provider / service | Purpose and information | Storage and duration | Position / choice |
|---|---|---|---|
| Vercel Web Analytics | Aggregate page and traffic statistics: timestamp, URL, route, referrer, filtered query parameters, coarse location, browser, device and operating system. | No cookie in the reviewed configuration. A request-derived visitor hash is discarded after 24 hours; Xworks aggregate reports: up to 24 months. | Statistical purposes. You may object using Website measurement. |
| Vercel Speed Insights | Anonymous performance data: route, URL, network speed, browser, device type, operating system, country, web-vital metric, attribution and event time. | No persistent cookie identified in the reviewed configuration. Xworks aggregate reports: up to 24 months. Not designed to reconstruct a session. | Statistical purposes. You may object using Website measurement. |
| Cloudflare Turnstile | Human-versus-bot assessment for protected forms. May process IP address, TLS fingerprint, user-agent, site key, origin, challenge outcome and token. | Security tokens are short-lived. Risk-based Cloudflare cookies may be used as described below. | Strictly necessary to secure a form you choose to submit; no advertising purpose. |
4. Cloudflare security cookies that may appear
Cloudflare Turnstile is risk-based. Depending on the browser, challenge and Cloudflare configuration, one or more of the following strictly necessary cookies may appear. Their presence is not used by Xworks for advertising or cross-site profiling.
| Name | Set by | Purpose | Typical duration |
|---|---|---|---|
| cf_clearance | Cloudflare | Stores proof that a challenge was passed so the user can reach the protected service. | Configuration-dependent; short-lived security period. |
| cf_chl_rc_i; cf_chl_rc_ni; cf_chl_rc_m | Cloudflare | Internal cookies used to identify production issues in the Challenge Platform. | Short-lived; set only when Cloudflare requires them. |
| __cf_bm | Cloudflare | Supports bot-management calculations where that Cloudflare feature applies. | 30 minutes after continuous inactivity. |
Cloudflare may change security-cookie behaviour in response to threats or product changes. See Cloudflare’s current technical information.
5. Why website measurement is used without opt-in consent
We use Vercel Web Analytics and Vercel Speed Insights solely to create aggregate statistics about how the Site is used and to improve its content, reliability and performance. We do not use the information for advertising, cross-site tracking, profiling, or decisions about a particular visitor.
For UK users, we rely on the statistical-purposes exception in the Privacy and Electronic Communications Regulations where its conditions are met. This requires clear information and a simple, free way to object. Our UK GDPR lawful basis for any personal data involved is our legitimate interest in improving the Site using minimised and aggregate information.
6. Your Website measurement choice
You can object to Vercel Web Analytics and Vercel Speed Insights at any time using this control:
When measurement is off, the Site will not load those measurement scripts for that browser. Changing the setting reloads the page so the choice takes effect immediately. Turning measurement off does not affect the core Site or the Cloudflare security check required to submit a protected form.
The Site stores your measurement choice only to remember it. A preference record used solely for that purpose is exempt from consent requirements. If you clear browser storage or use another browser or device, you may need to set the choice again.
You can also view, delete or block cookies and other site data through your browser. Blocking all cookies may affect security checks or form submission. Browser controls do not necessarily prevent request-derived analytics or scripts from running, so use the Site’s Website measurement control as well.
7. External web assets
Some pages currently request fonts or code from external content-delivery services, including Google Fonts and the Tailwind content-delivery network. These requests may disclose ordinary connection information such as IP address, user-agent, requested URL and timestamp to the provider. We do not use those services for advertising or cross-site profiling. Further information appears in our Website Privacy Notice.
8. If we introduce new technologies
We will not use advertising, profiling or other non-exempt storage technologies before obtaining valid consent where the law requires it. Any consent request will provide a genuine choice, will not use pre-ticked options, and will make rejecting non-essential technologies as easy as accepting them. You will be able to withdraw consent at any time.
9. Changes and contact
We may update this Notice when technology, providers or legal requirements change. The current version is the version published on the Site. We will update the schedule and the “Last updated” date when the change is material.
Questions or objections relating to storage technologies may be sent to accounts@xworks.systems or to the Privacy Lead, Xworks Holdings Ltd, 66 Paul Street, London EC2A 4NE, United Kingdom. General website enquiries may be sent to hello@xworks.systems.