Cookie Policy
Effective: September 2026
This Cookie Policy describes the cookies and similar storage and access technologies employed on this Platform, the purpose of each, the lawful basis relied upon, and how you may exercise control over them. It supplements, and should be read with, the Privacy Policy.
1. Definitions
"Cookie" means a small text file placed on your terminal equipment by a website. "Similar technologies" means any other means of storing information on, or gaining access to information stored on, your terminal equipment, including local storage, session storage, indexed databases, pixels, beacons and device fingerprinting. "Strictly necessary" bears the meaning given to it in Article 5(3) of Directive 2002/58/EC and in Regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003. "Consent" bears the meaning given to it in Article 4(11) of Regulation (EU) 2016/679.
2. Lawful basis
Cookies that are strictly necessary for a service you have explicitly requested, and technologies that store only a preference you have expressly set, are exempt from the consent requirement and are placed without it.
One technology on this Platform is not strictly necessary and is placed only where you have consented to it: the visitor identifier described in the table below. It is not set until you press Accept All in the cookie notice, it is deleted when you press Essential Only, and it is never set for a browser that sends a Global Privacy Control signal. The Platform functions identically without it.
3. Technologies employed
| Identifier | Type | Purpose | Retention |
|---|---|---|---|
| wmb_session | First-party cookie | Maintains an authenticated session so that material to which you have been granted access is disclosed to you and to no other person. Marked HttpOnly and SameSite. Strictly necessary. | 7 days, or until sign-out |
| wmb_login | First-party cookie | Holds the state of a sign-in in progress so that the response from the identity provider can be verified as an answer to a request this browser made. Strictly necessary; it is a cross-site request forgery defence. | The sign-in attempt |
| wmb_view_agent | First-party cookie | Records which member an administrator has chosen to view an area as. Set only for administrators, and only by their own deliberate selection. Strictly necessary for the administrative function requested. | 30 days |
| wmb_view_contractor | First-party cookie | As above, for the contractor area. | 30 days |
| wmb_consent | First-party cookie | Records your answer to the cookie notice, so that it is honoured and so that you are not asked again. Strictly necessary: without it your answer could not be given effect. | 6 months |
| wmb_visitor | First-party cookie | Consent required. An opaque identifier that allows the pages of one visit to be recognised as one visit in our own activity record. It identifies a browser, not a person; it is marked HttpOnly and is readable by no script and by no third party. Set only after you press Accept All, and deleted if you afterwards press Essential Only. | 1 year |
| wmb.a11y.* | Local storage | The text size, contrast, motion and underline settings you choose in the accessibility panel. Set only by your own action, never transmitted to us, and exempt as a preference you expressly set. | Until you clear your browser storage |
| wmb.view.* wmb.show.* wmb.page.* | Local storage | Which reading of a list you last had open, so a section opens where you left it. Set by your own navigation, never transmitted to us, and exempt on the same basis. | Until you clear your browser storage |
No advertising, analytics or tracking technology operated by any other company is employed on this Platform, and no third party sets any cookie or reads any storage through it. No page loads any resource from a third party.
4. Exercising control
The cookie button in the lower right corner of every page reopens the notice at any time, and withdrawing consent is a single press, exactly as giving it was. Your answer stands for six months, after which you are asked again.
If your browser sends a Global Privacy Control signal we treat it as a refusal and never ask. You may also block or delete cookies for this site in your browser's settings; the Platform will continue to work and you will remain able to sign in, though clearing the session cookie will sign you out.
5. What is recorded regardless
Whether or not you consent, our servers record the requests they answer: the time, the address requested, the response returned, and the account it belongs to where you are signed in. That is the ordinary operating and security record of a web service, it is held on our own servers, it is disclosed to nobody, and it is described in Section 2 of the Privacy Policy. What consent changes is whether those records can be recognised as belonging to one visit.