Lock Shop Direct
Cookie Policy
This policy explains how Lock Shop Direct uses cookies and similar storage or access technologies on www.lockshopdirect.co.uk, what they do, when consent is required and how you can control them.
Your choice: Necessary technologies operate because the website cannot provide the requested service securely without them. Optional analytics, personalisation and advertising technologies should remain off unless you enable them, except where a narrow statutory exception is lawfully used with the required information and simple free means to object.
1. What cookies and similar technologies are
A cookie is a small text file stored on a browser or device. This policy also covers similar technologies that store or access information on a device, including local storage, pixels, tags, scripts, software-development kits, device identifiers and related tracking or security technologies.
Some technologies are set by Lock Shop Direct or our website platform (“first-party”). Others are provided by another organisation whose service appears on the website (“third-party”). A technology may last only for the browser session or remain for a stated period.
2. How we apply the cookie rules
The Privacy and Electronic Communications Regulations apply when information is stored on or accessed from a user's device. Data protection law also applies where the information identifies or can be linked to a person.
Technologies that do not require consent
Consent is not required where a technology falls within a legal exception, including where it is strictly necessary to provide a service that the user expressly requests, or is used solely to transmit a communication. Current law also contains limited exceptions for qualifying statistical purposes and for adapting appearance or functionality to a user's preference. Those newer exceptions have specific conditions, including clear information and a simple, free way to object.
Technologies that require consent
Where no exception applies, we ask for consent before the technology is used. Consent must be a clear, informed and positive choice. Simply continuing to browse is not treated as consent. Refusing optional technologies should not prevent an ordinary purchase, although a feature that depends on an optional technology may be unavailable.
Our current Cookie Control Centre treats analytics, personalisation and advertising technologies as optional unless the settings expressly explain a lawful exception and provide the required objection control.
3. Categories of technology we use
| Category |
What it does |
Usual control |
| Strictly necessary |
Supports secure sessions, baskets, checkout, payment routing, account login, load balancing, abuse prevention and remembering the cookie choice itself. |
Operates automatically where the legal exception applies. Blocking it in the browser may stop the website working properly. |
| Preferences and functionality |
Remembers choices such as language, display, location-related presentation or requested account features. |
Consent, or a qualifying appearance/functionality exception with clear information and an easy free objection mechanism. |
| Analytics and performance |
Measures visits, searches, page use, errors, traffic sources and conversion so we can improve the website. |
Normally optional consent. A narrowly configured statistical technology may instead rely on the statutory statistical exception where every condition is met and a simple objection is available. |
| Personalisation |
Uses browsing or purchase signals to tailor search results, product recommendations, messages or website content. |
Optional consent unless a limited feature qualifies for another exception. |
| Advertising and conversion |
Measures advertising effectiveness, limits repetition, attributes orders and may support remarketing across websites or devices. |
Optional consent. |
| Third-party service |
Supports payment, review widgets, maps, videos, social features or another service you choose to use. |
Depends on whether the service is requested and whether its additional technologies are necessary or optional. The Cookie Control Centre should reflect the applicable choice. |
4. Current technology register
The following register describes the main technologies currently used or expected on the existing Lock Shop Direct website. Technology names can change when the website platform or provider updates. The live Cookie Control Centre and a current technical scan should be used to confirm the exact names and expiry periods operating at the time of your visit.
| Technology and provider |
Purpose |
Typical duration |
Category and control |
PHPSESSID or successor session identifier
Lock Shop Direct website platform |
Maintains the secure browser session and can support basket, login, checkout and continuity between pages. |
Session, normally deleted when the browser session ends. |
Strictly necessary. |
Cookie-choice record
Lock Shop Direct / consent platform |
Records whether optional categories were accepted, rejected or configured so the website can respect the choice. |
Normally up to 12 months, then the website may ask again. |
Strictly necessary to remember the requested privacy choice. |
Account or “remember me” identifier
Lock Shop Direct website platform |
Keeps an authenticated session active where the user expressly requests that feature. It should store an identifier or token, not a readable account password. |
Session or up to 12 months depending on the chosen feature; ends sooner on logout or deletion. |
Necessary for the requested account feature. |
Language or display preference
Lock Shop Direct website platform |
Remembers a requested language, display or similar presentation choice. |
Normally up to 12 months. |
Preference; optional consent or qualifying appearance exception with an objection control. |
sf_id
Salesfire |
Visitor identifier used for statistics and, where enabled, Salesfire personalisation or AI-related features. |
1 year. |
Analytics/personalisation; optional. |
sf_geo
Salesfire |
Stores a country code so Salesfire tools can display content appropriate to the visitor's country. |
1 hour. |
Functionality/personalisation; optional unless a configured appearance exception applies. |
sf_*
Salesfire |
Supports Salesfire tools and campaign state according to the settings used on the website. |
Up to 30 days. |
Functionality/personalisation; optional. |
_ga and _ga_*
Google Analytics |
Distinguishes visits and maintains analytics session information so website use and conversions can be measured. |
Up to 2 years, subject to our Google Analytics retention configuration. |
Analytics; optional unless a qualifying statistical exception is deliberately and correctly configured. |
Google advertising or conversion identifiers
Google, where enabled |
Measures advertising conversions, attributes orders and may support remarketing or audience functions. |
Names and periods vary by Google service, commonly from the session up to about 13 months. |
Advertising; optional. |
Payment, review and embedded-service technologies
For example Barclays ePDQ, PayPal, eKomi or another displayed provider |
Supports a payment, fraud check, review widget or other third-party service that you choose to use. The provider may set its own security or preference technologies. |
Provider-specific and shown in the provider's notice or the current Cookie Control Centre. |
Necessary to the requested service or optional, depending on purpose. |
Technical verification is essential. A website update can add, remove or rename cookies, pixels and local-storage entries. The website operator should run a consent-aware scan after deployment and whenever tags, checkout, analytics, Salesfire, review widgets or advertising tools change.
5. Salesfire
Lock Shop Direct uses Salesfire tools in connection with website search, recommendations, customer experience and marketing functionality. Depending on which Salesfire features are active and your choices, Salesfire may process a visitor identifier, pages and products viewed, searches, basket or order events, device information, approximate country and campaign interactions.
Salesfire's published tool-cookie information identifies sf_id with a one-year duration, sf_geo with a one-hour duration and other sf_* functional cookies lasting up to 30 days. Salesfire functions that track or profile behaviour for analytics, personalisation or marketing should not operate before the required choice has been made.
6. Google analytics and advertising technologies
Where enabled, Google Analytics helps us understand website traffic, pages and products used, device and browser information, traffic sources, searches, errors and completed transactions. We use the information to measure and improve the website rather than to obtain full payment-card details.
Google advertising or conversion tools may be used to measure whether advertising led to a visit or order and, where separately enabled, to support remarketing. Advertising and cross-site tracking technologies are optional and require consent.
Google may receive online identifiers and related usage information and may process information outside the United Kingdom. Our Privacy Notice explains international-transfer safeguards and individual rights.
7. Payment, review and other third-party services
When you choose a payment option, open an embedded review feature, follow an external link or use another third-party service, that provider may use its own necessary and optional technologies. Examples can include Barclays ePDQ, PayPal, eKomi, a carrier tracking page, a manufacturer video or a social platform.
A third party may act as an independent controller for its own authentication, fraud prevention, analytics or service improvement. Its own privacy and cookie information applies to that processing. We aim not to load non-essential third-party tracking before the relevant consent.
8. How to manage or withdraw your choices
You can use the Cookie Control Centre to enable or disable optional categories. Withdrawing consent does not make earlier consent-based use unlawful, but the relevant optional technologies should stop on future page loads after the choice is saved. You may also need to delete existing cookies from your browser to remove information already stored on the device.
Manage cookie choices
The cookie banner and settings should offer a clear way to accept or reject optional technologies and should not use pre-ticked optional choices. Rejecting optional analytics or marketing does not prevent access to the ordinary shop and checkout, although personalised recommendations, embedded content or other optional features may be limited.
9. Browser and device controls
Most browsers allow you to view, delete or block cookies and site data. Browser settings may also block third-party cookies or clear data when the browser closes. Instructions differ by browser and device, so use the privacy or site-data section of the relevant browser's help menu.
Blocking every cookie can prevent baskets, login, checkout, fraud controls or saved preferences from working. Browser controls do not always disable server-side order records, email preferences or technologies operating in another browser or device.
10. Personal information, lawful bases and international transfers
Cookie and device information can be personal information where it identifies or can be linked to a person or device. Our Privacy Notice explains the data controller, purposes, lawful bases, recipient categories, retention criteria, international safeguards and rights.
Consent under the cookie rules and a lawful basis under data protection law are related but separate requirements. Where consent is required for storage or access, we do not treat legitimate interests alone as a substitute for that consent.
11. Duration, deletion and consent records
A session technology normally expires when the browser session ends. Persistent technologies remain until their stated expiry, you delete them, the provider replaces them or the service is reconfigured. The table in section 4 gives typical periods.
We retain a record of the cookie choice for a reasonable period, normally up to 12 months, so the website can respect it and demonstrate how the choice was captured. We may ask again sooner where the purposes, providers or technologies materially change.
Analytics or campaign reports may retain aggregated statistics after the device identifier expires. Order, account and payment records are retained under the separate criteria in our Privacy Notice and are not automatically deleted when browser cookies are removed.
12. Changes and contact details
We review this policy and the technology register when the website platform, providers, tags or legal requirements change. The revised page will show a new version or effective date. A material new optional purpose should also be reflected in the Cookie Control Centre before the technology is enabled.