The Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426), as amended by the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (SI 2011/1208) and maintained in force post-Brexit by the European Union (Withdrawal) Act 2018. PECR Regulation 6 imposes the requirement to: (a) provide clear and comprehensive information about the purposes of any cookie or similar technology; and (b) obtain prior consent from the subscriber or user before storing or accessing information stored on their terminal equipment. Regulation 6(4) exempts cookies that are strictly necessary for the delivery of a service expressly requested by the user. PECR is enforced by the Information Commissioner's Office (ICO) under powers conferred by the Data Protection Act 2018. Fines under PECR can reach £500,000 for serious breaches.

The UK General Data Protection Regulation — the retained EU law version of the GDPR as it applied in the UK on 31 January 2020, as saved and amended by the European Union (Withdrawal) Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. UK GDPR applies where cookies process personal data (including device identifiers and IP addresses that can be linked to individuals). Key obligations include: obtaining valid consent under Article 6(1)(a) and Article 7; providing transparent information under Articles 13–14; enabling data subject rights under Articles 15–22; and appointing a data controller (us) with processing accountability under Article 24. As data controller, INDOOR & OUTDOOR FURNISHINGS LTD is responsible for demonstrating compliance.

The Data Protection Act 2018 supplements UK GDPR with domestic provisions, including the derogations and modifications permitted by Article 6(2) and (3) UK GDPR. It designates the ICO as the supervisory authority for the UK, grants the ICO enforcement powers (including fines of up to £17.5 million or 4% of global annual turnover, whichever is higher, for the most serious infringements), and sets out specific rules on sensitive data, criminal offences (including unlawfully obtaining personal data), and the conditions under which special categories of data may be processed.

While the Consumer Rights Act 2015 does not directly regulate cookies, it applies to the broader e-commerce relationship between us and our customers, requiring that digital content and services we provide (including the website itself) are of satisfactory quality, fit for purpose, and as described. Where our use of cookies affects the functionality of services you have paid for — for example, session data used during checkout — our obligations under the Consumer Rights Act 2015 require that functionality to work correctly.

The ICO's published cookie guidance (updated periodically, most recently in line with the ICO's strategic priorities for 2023–2026) sets out the following non-negotiable positions that we adhere to: (1) cookie banners must not use "dark patterns" that make it harder to reject cookies than to accept them; (2) pre-ticked boxes, implied consent through browsing, and consent bundled with terms and conditions are all invalid; (3) consent must be granular — users must be able to consent to analytics separately from marketing; (4) cookie walls that deny access to a website unless all cookies are accepted are not permitted; and (5) consent records must be kept and made available to the ICO on request.

Our website is not directed at children under 13. We do not knowingly collect personal data from children through cookies or any other means. If you are a parent or guardian and believe a child has provided personal data through our website without your consent, please contact us immediately at info@outdoorextensionleads.co.uk and we will take steps to delete that data. We acknowledge the ICO's Age Appropriate Design Code (the Children's Code) and note that our products — outdoor extension leads, electrical supplies, and sofas — are adult consumer goods not targeted at children.

Some third-party cookie providers (including Google and Meta) transfer data to the United States and other countries outside the UK. Post-Brexit, the UK uses its own international transfer framework under UK GDPR Chapter V. The UK has adopted adequacy decisions for transfers to certain countries and relies on International Data Transfer Agreements (IDTAs) or the UK Addendum to EU Standard Contractual Clauses for transfers to countries without an adequacy decision (including the USA). Google and Meta rely on Standard Contractual Clauses (or equivalent) for their UK-to-US transfers. We have no direct control over the transfer mechanisms used by third parties, but we only use third-party cookie providers who we are satisfied have implemented appropriate transfer safeguards in line with UK GDPR requirements.