1. Current register
| Name | Type and provider | Purpose | Duration | Consent |
|---|---|---|---|---|
np_csrf | First-party cookie; NovaPharm | Prevents forged form and portal requests | 1 hour | Strictly necessary |
np_session | First-party cookie; NovaPharm | Maintains an authenticated, role-scoped secure session | 8 hours by default, or earlier logout/revocation | Strictly necessary for the requested portal |
np_cookie_consent | First-party local storage; NovaPharm | Remembers consent version, selected categories, timestamp and a random preference-record identifier | 180 days | Necessary to remember the visitor's choice |
2. Categories
Strictly necessary technologies support security, forms and an authenticated portal. Preference storage remembers the choices a visitor asks the site to retain. Analytics and marketing are separate optional categories. The current production candidate contains no enabled analytics, advertising, social pixel or marketing tag, and no such tool may be added without updating this register, completing a transfer and privacy review, and honouring the saved category choice.
3. Your choices
The first layer offers equally accessible controls to accept all, reject non-essential technologies or manage categories. Optional boxes are off by default. Use at any time to change or withdraw a choice. Rejecting optional categories does not block ordinary public content.
4. Evidence and transfers
The preference record stays in the browser and is not used for unrelated tracking. It contains no name, email or portal data. Current first-party cookies do not themselves initiate an international transfer. Any future third-party analytics or marketing provider requires a documented recipient, purpose, duration and transfer assessment before activation.
5. Audit method
The release audit checks application source and generated response headers, and automated tests assert that optional categories default to off and remain off after rejection. Browser inspection of cookies, local storage and network requests remains a required preview and production acceptance step. The approach follows the ICO's final April 2026 guidance on storage and access technologies. NovaPharm does not rely on a statistical-purpose exception in this release; optional analytics remains absent and off.