COOKIE POLICY

DRAFT FOR REVIEW — NOT FOR PUBLICATION

Prepared 6 October 2026. This draft records the configured services found during review. It is not a completed cookie inventory or a statement that consent controls have passed testing. Cookie names, providers, purposes, durations and control behaviour must be verified before publication.

1. ABOUT THIS POLICY

BestSalons.com is operated by DELIKIPOS HAIRDRESSING LTD, company number 10465250, registered office 12 Duke Street, Cardiff, Wales, CF10 1AY. Contact: hello@bestsalons.com. Our Privacy Policy explains the wider use of personal information and your rights.

Cookies are small files stored in a browser. Similar technologies can include browser storage, pixels and scripts that read or send device information. A script can transmit information even if it does not set a cookie. Session cookies generally last for a browsing session; persistent cookies last until their expiry or deletion.

2. SERVICES IDENTIFIED IN SETTINGS

Wix: website hosting and site functions, including forms, member accounts and subscriptions. Technologies necessary to provide a requested function or protect it must be distinguished from optional measurement. [Complete the verified cookie/storage names, exact purposes and durations for public pages, sign-in and checkout.]

Usercentrics for Wix: consent-management banner and privacy preference trigger. The banner is enabled in settings. [Verify the live controls and the consent-record cookie/storage name and duration.]

Google Tag: the Wix integration is connected, with Advanced Consent Mode unchecked. An enabled Google Tag entry is classified as Analytics. [Identify the Google Analytics/Ads destinations and actual tags, cookies, purposes and durations; verify behaviour before and after each choice. A connected tag alone does not establish which Google products receive data.]

Microsoft Clarity: an enabled all-page script loads the Clarity service. Clarity provides usage analytics, heatmaps and session replay. The script is currently classified as Essential in Wix. [Publication blocker: review and correct the classification as required, confirm masking and consent settings, inventory storage and test rejection/withdrawal. Do not state that it waits for consent until verified.]

Speed Booster: an enabled all-page script is classified as Essential. The earlier scanner identified cdn.pagebooster.net. [Identify its provider, actual device access/data transmission, purpose and retention; assess the appropriate category.]

Stripe: connected payment provider used at checkout. [Inspect checkout separately for payment, fraud-prevention and other technologies, names and durations. A technology needed for a payment is not automatically necessary on every page.]

Other items requiring reconciliation: the earlier scan reported Google Tag Manager, Google Tag Services, and favicon requests to t1.gstatic.com and t3.gstatic.com. These are leads to investigate, not a verified list of advertising cookies. An enabled custom script and installed apps also require inspection. The fresh scan was still running during this draft.

3. NECESSARY AND OPTIONAL TECHNOLOGIES

A label in Wix does not determine whether a technology is legally necessary. Device storage/access requires consent unless an applicable exemption actually covers its purpose and operation. Any exemption may have conditions, including transparency or an objection mechanism. The legal basis for associated personal-data processing is a separate question.

Spotlight is a paid placement on a selected directory page. Buying or viewing a Spotlight placement does not itself mean that personalised advertising, retargeting or cross-site profiling takes place. Those activities must only be described here if actually verified.

4. YOUR CHOICES

[Before publication, replace this note with the tested instructions: where the privacy preference control appears, how to accept or reject optional categories, how to save changes and withdraw consent, and how any applicable objection mechanism works. Record any regional differences.]

Your browser can also delete stored cookies or block future cookies. Blocking some necessary technologies may prevent sign-in, checkout or other requested features from working. Browser cookie controls do not necessarily prevent all scripts or other storage technologies, and clearing cookies can remove a saved preference.

5. INVENTORY AND DURATIONS

[Publication blocker: add the verified inventory with one entry per cookie or meaningful technology group: name, provider/domain, purpose, category/legal treatment, duration and relevant choice. Distinguish browser expiry from provider-side retention. Do not substitute generic vendor maximums for the site's actual configuration.]

6. THIRD-PARTY LINKS AND UPDATES

When you follow a salon, directions or social-media link, the destination has its own technology and privacy practices. Embedded services must be included in our own inventory where they load on this website.

We will update the final published policy when the technologies or controls materially change and show its effective date. For questions, contact hello@bestsalons.com.

ADDITIONAL REVIEW FINDINGS — 6 OCTOBER 2026
The public consent panel lists Google Tag Manager as Unknown, with Google AJAX as a subservice. It lists Google Tag Services as Marketing, with Conversion Linker, DoubleClick Ad and Google Ads as subservices. Wix and Usercentrics are Essential. The Unknown category is checked and cannot be disabled through this panel. These are banner-listed service descriptions, not proof of actual network activity or all data mentioned in the vendor templates.
A UI test on the public pricing page found that Deny left Functional, Analytical and Marketing unchecked after reopening and after reload. This was an existing browser session, not a clean-session pre-consent test. Actual tracker and storage blocking remains untested. Clarity was not listed in that panel despite its enabled Essential custom-code setting. Resolve this mismatch before publication.
The generic Custom snippet loads a CloudFront-hosted site-speed script on all pages, in the Head, once. Its provider identity, downstream requests and necessity remain unverified.