Cookie policy
You control optional analytics. Here is what we store, why we use it, and how to change your choice.
Last updated: 14 September 2026
The short version
Optional Google Analytics stays off until you select Accept analytics. Reject analytics is equally available and does not affect the website or contacting us. Cookie settings at the bottom of every public page lets you change your choice.
Analytics and your choice
After acceptance, Google Analytics uses first-party _ga and _ga_T92JB8ZXDC cookies to distinguish visitors and sessions. We configure these to expire after 180 days without extending them on each visit. Browsers may remove them sooner. They help us measure public page visits, referral sources and contact-button use; we do not enable advertising personalisation or Google Signals.
The citadel-analytics-consent entry in local storage remembers acceptance or rejection for up to 180 days. No analytics request is sent before acceptance. Rejecting after acceptance stops tracking and removes our Analytics cookies. Clearing browser storage removes your remembered choice, so we ask again.
We exclude private console and signing pages, strip URL queries and fragments, and do not send form contents or customer details. Successful callback requests are counted separately from phone/WhatsApp clicks. Our reports are private and may be read through GSC Wizard.
The staff console
Our own staff sign in to a private console on this domain to manage jobs, quotes and invoices for Citadel Autos Ltd. Signing in there sets a small number of first-party, strictly necessary cookies — the kind UK law (PECR) does not require consent for, because signing in can't work without them. They are only ever set when a member of staff signs in; customers browsing the site never receive them.
| Cookie | What it does | Lasts | Type |
|---|---|---|---|
| ops_session | Keeps a signed-in member of staff signed in to the console. | One working shift (typically 8 hours; never more than 30 days) | Essential |
| ops_onboarding | Carries a new staff member through first sign-in setup (password and two-factor). | 15 minutes | Essential |
| ops_2fa | A legacy step from an older sign-in flow. Current sign-ins no longer set it; if your browser still holds one, it does nothing. | Minutes | Essential |
How those cookies behave
Every staff cookie is:
- httpOnly — scripts running in the page can never read it.
- Secure — only ever sent over HTTPS.
- SameSite=Strict — never sent on requests from other websites.
- Never used for tracking, marketing, analytics or profiling of any kind.
Google Analytics
Google provides the optional Analytics service and processes visit data after your consent. The Analytics cookies are first-party cookies on our public website. Our hosting platform also keeps standard technical logs to keep the site online and secure; see the privacy policy.
Clearing cookies
Every browser lets you view and delete cookies — look under Settings, then Privacy (or 'Cookies and site data'). Deleting essential sign-in cookies signs staff out. Deleting the Analytics cookies removes their stored identifiers; use Cookie settings to reject analytics as well, so they are not recreated.
More about your data
Cookies are only one small part of how we look after your information. For what we collect when you call or message us, and the rights you have over it, read our privacy policy.