Cookie and Similar Technologies Policy

1. About this Policy

1.1 This Cookie and Similar Technologies Policy explains how View Before You Move Ltd (“VBYM”, “we”, “us” or “our”) uses cookies and similar technologies when a person visits or uses the VBYM website, agency portal, property-listing pages, immersive tours, account pages, booking pages, payment pages or related digital services (together, the “Platform”).

1.2 This Policy should be read alongside the VBYM Privacy Notice. The Privacy Notice explains how we collect, use, share, retain and protect Personal Data and how individuals may exercise their rights.

1.3 The exact technologies used may change as the Platform develops. VBYM will maintain a current technical register and update this Policy when a material change affects users or their choices.

2. What cookies and similar technologies are

2.1 Cookies are small text files that a website stores on a computer, mobile telephone, tablet, headset or other connected device.

2.2 Similar technologies may include browser local storage, session storage, authentication tokens, software-development kits, tags, scripts, pixels, device identifiers and other technologies that store information on, or access information from, a user’s device.

2.3 References to “cookies” in this Policy include similar storage and access technologies unless the context requires otherwise.

3. How VBYM uses these technologies

3.1 VBYM may use cookies to operate and secure the Platform, authenticate users, preserve sessions, remember choices, complete requested bookings or payments, prevent misuse, diagnose faults, maintain availability and improve the service where permitted by law.

3.2 Only authorised agency users may upload or manage property-listing content. The Platform must restrict each agency user to the content, branches and functions connected with that user’s own authorised agency account. Consumers and general visitors cannot upload property-listing content.

3.3 Account separation and access restrictions must be enforced by server-side permissions and database or storage controls. Cookies or browser-side identifiers may support the session, but they must not be the sole control preventing one agency from accessing another agency’s content.

4. Strictly necessary technologies

4.1 Strictly necessary technologies are required to transmit a communication or to provide a service expressly requested by the user. Where the legal exception applies, these technologies may be used without consent.

4.2 They may be used to authenticate agency users, maintain secure sessions, associate a user with the correct agency and branch, enforce account permissions, protect forms, prevent cross-site request forgery, detect abuse, balance traffic, preserve a requested checkout or booking, process a requested payment and remember a user’s cookie preference.

4.3 Strictly necessary technologies cannot be switched off through the VBYM preference tool. A user may block them through browser controls, but the agency portal, login, booking, payment or other secure features may then fail to operate.

5. Functional and preference technologies

5.1 Functional technologies may remember choices such as language, region, display settings, immersive-tour preferences, playback settings or other user-selected options.

5.2 VBYM will use these without consent only where a legal exception applies. Otherwise, they will remain inactive until the user makes the appropriate choice through the preference tool.

5.3 Refusing functional technologies may mean that a preference must be selected again during a later visit.

6. Statistical and analytics technologies

6.1 Statistical and analytics technologies may help VBYM understand page use, user journeys, technical errors, performance, feature use and completion of key processes.

6.2 At the effective date of this Policy, VBYM does not use optional analytics, advertising tracking, behavioural profiling or session-recording technologies on the launch configuration.

6.3 VBYM will not introduce analytics until it has assessed the provider and purpose, updated the live register and relevant privacy information, and implemented any consent or objection mechanism required by law.

6.4 Where a statistical technology lawfully falls within an exception, VBYM will meet the conditions of that exception. Where no exception applies, it will not activate until valid consent has been obtained.

7. Advertising and behavioural tracking

7.1 VBYM does not currently use cookies to build advertising profiles, track users across unrelated services, retarget previous visitors, sell browsing information or share browsing behaviour with advertising networks.

7.2 Advertising or behavioural-tracking technologies will not be introduced unless VBYM completes an assessment, updates this Policy and the Privacy Notice, implements an appropriate consent-management system and obtains valid consent before activation.

8. Payment technologies

8.1 Where an agency purchases a media pack, subscription or other service online, the payment provider may use technologies needed to maintain the requested payment session, authenticate the transaction, prevent fraud and meet security or regulatory obligations.

8.2 VBYM does not intend to store complete payment-card details on the Platform. Card information should be entered directly into the payment provider’s secure environment.

8.3 The payment provider may process information under its own privacy and cookie documentation.

9. Embedded media, maps and immersive content

9.1 The Platform may display photographs, standard video, 360-degree footage, immersive tours, maps, floor plans or other interactive content.

9.2 Where this content is delivered through VBYM-controlled infrastructure, only technologies reasonably required to provide the requested content should be used.

9.3 Where an external provider wishes to place a non-essential technology, the optional feature must not load until the necessary choice has been obtained, unless a legal exception applies. A user may therefore need to enable a category before certain externally hosted content becomes available.

10. Agency-account security and separation

10.1 VBYM may use strictly necessary session and security technologies to identify an authorised agency user, associate the user with the correct agency and branch, verify permissions, detect suspicious access and end inactive or compromised sessions.

10.2 Agency users must not share credentials, permit unauthorised use, attempt to access another agency account, use another branch’s permissions without authority or interfere with account-separation controls.

10.3 VBYM and its approved software-development supplier must implement tenant isolation using a reliable agency identifier and server-side authorisation on every relevant API, database query and storage operation. The interface must never offer an agency user another agency’s record, but interface filtering alone is not sufficient.

10.4 Important access and administration events should be logged in accordance with VBYM’s production-access and incident-response procedure. Supplier access must use individual accounts, multi-factor authentication and the permissions recorded in the VBYM access register.

11. User choices

11.1 If optional technologies are used, the Platform will provide a suitable banner or preference tool allowing users to accept, reject or select categories and later change or withdraw their choice.

11.2 Optional technologies must remain inactive until the required choice is recorded. Rejecting optional technologies must be as easy as accepting them.

11.3 Strictly necessary technologies remain active where required to operate the requested service securely.

11.4 A persistent Cookie Settings link should be available in the website footer whenever configurable optional technologies are present.

12. Browser and device controls

12.1 Most browsers allow users to view, delete or block cookies and clear local storage. Device or application settings may provide additional controls.

12.2 Blocking all cookies may prevent a user from signing in, remaining signed in, accessing the agency portal, managing agency listings, completing a booking or payment, or using immersive features.

12.3 Browser controls may not manage every similar technology. Users should review the privacy and storage settings of their browser, device and relevant applications.

13. Duration and retention

13.1 A session technology normally expires when the browser or secure session ends. A persistent technology remains for a defined period or until deleted.

13.2 VBYM will not retain a cookie or identifier for longer than reasonably necessary for its stated purpose.

13.3 The live cookie register or preference panel should show the expected duration of each material technology.

14. Live cookie register

14.1 VBYM will maintain a current register of material cookies and similar technologies used by the live Platform.

14.2 The register should identify the technology name, provider, first- or third-party status, purpose, category, information stored or accessed, duration, legal exception or consent requirement and available control.

14.3 The register must be reviewed whenever VBYM adds a provider, changes authentication, introduces analytics, embeds third-party media or maps, changes payment services, launches an application or materially changes device storage or access.

15. Third-party providers

15.1 Providers of hosting, databases, authentication, payments, email, appointment booking, security, monitoring, media delivery, support and consent management may operate technologies for VBYM.

15.2 VBYM will assess relevant providers and enter appropriate contractual arrangements before permitting them to store or access information through the Platform.

15.3 A provider may also process information for its own purposes. Where relevant, users should review that provider’s privacy and cookie information.

16. Changes to this Policy

16.1 VBYM may update this Policy where the Platform, providers, technologies, law or regulatory guidance changes.

16.2 The latest version will be published with its effective date. Where a change materially affects optional technologies or an earlier choice, VBYM may request a new preference.

17. Contacting VBYM

17.1 Questions about cookies or similar technologies may be sent to privacy@vbym.co.uk.

17.2 Website: www.vbym.co.uk.

17.3 Users may also use the Cookie Settings link where available to review or change their choices.

Schedule 1 — Current launch configuration

Schedule 2 — Live technology register

Schedule 3 — Technical verification and change-control procedure

1. The launch scan covered the live public website and agency portal before login, during login, after login and after logout. Repeat this scan after material deployment or provider changes.

2. Test a new visitor who rejects optional technologies and confirm that no optional script or storage is activated.

3. Test an agency user and confirm that the session is restricted to that user’s own authorised agency account and branch permissions.

4. Inspect first-party and third-party cookies, local storage, session storage, pixels, tags, SDKs and embedded services.

5. Record exact names, domains, purposes, durations and whether each technology is essential, exempt or consent-dependent.

6. Check Stripe or any replacement payment flow, embedded media, maps, email links, booking tools and support widgets.

7. Update Schedule 2 and the live Cookie Settings panel so they match the production configuration.

8. Retain screenshots or exported scan results with the release record and repeat the scan after material changes.