How Lions Campus uses cookies, tags, pixels, browser storage and related website technologies
Our approach
Strictly necessary technologies support security, consent management and services you request. Analytics, advertising and other non-essential technologies are controlled by your CookieYes choices. Rejecting non-essential cookies will not prevent you from reading our website or submitting an enquiry.
| Detail | Information |
|---|---|
| Website operator | Lions Campus Ltd |
| Company number | 13111830 |
| Effective date | 5 August 2026 |
| Contact | office@lions-campus.co.uk | +44 (0) 20 7190 9670 |
| Registered office | Blythe Hall, 100 Blythe Road, London, England, W14 0HB |
| Website | https://www.lions-campus.co.uk/ |
This policy should be read with our Privacy Policy, which explains how we use personal information collected through our website, enquiries, referrals and services.
Contents
- About this policy
- Who we are and how to contact us
- What cookies and similar technologies are
- The legal framework and when we ask for consent
- The categories we use
- How CookieYes manages your choices
- Details of cookies and similar technologies
- Google Analytics 4 and Google tags
- HubSpot forms, CRM and website analytics
- Embedded content, external links and other services
- Young people and sensitive information
- How to accept, reject or change your choices
- Browser and device controls
- Data sharing, international transfers, retention and security
- Audits and changes to this policy
- Questions and complaints
At a glance
- Necessary cookies are used to operate and protect the website, remember your consent decision and provide a feature you actively request. They cannot normally be switched off through our consent tool.
- Google Analytics 4 and HubSpot analytics cookies are treated as analytics technologies and are not intended to be stored until you choose the Analytics category.
- HubSpot forms may still process the information you deliberately submit even if you reject analytics cookies. Submitting a form is not consent to analytics or to marketing emails.
- You can accept all, reject all or select individual non-essential categories. The options must be equally accessible and refusing non-essential cookies does not reduce access to core website content.
- You can change or withdraw your choice at any time by using the Revisit consent button or the Cookie settings button in this policy.
- We do not intentionally place names, contact details, form answers or information about mental health, eating disorders, substance use, disability or safeguarding into analytics cookie names or analytics event parameters.
- The exact cookies present can change as providers update their services. The current CookieYes cookie list and preference centre, supported by periodic website scans, provide the most up-to-date operational declaration.
1. About this policy
This Cookie Policy explains when and why Lions Campus Ltd uses cookies and similar storage or access technologies on its website. It applies to pages on the lions-campus.co.uk domain that display or link to this policy. It also explains the choices available to website visitors.
This policy covers technologies operated by us and technologies placed or accessed by service providers acting for us. If you follow a link to a separate website, use an external app or interact with a service operated independently, that provider’s own privacy and cookie information will apply.
The detailed tables below identify the principal technologies we expect to use. A cookie may not appear for every visitor: this depends on the page visited, features used, browser, device, logged-in status, consent choices and the provider’s current configuration. Provider names, cookie names and lifetimes may also change.
2. Who we are and how to contact us
Lions Campus Ltd operates private residential and day programmes, behavioural coaching and case management for teenagers and young adults. We are the controller of personal information collected through the website when we decide why and how it is used.
Questions about this policy or our website tracking can be sent to office@lions-campus.co.uk with “Cookie Policy” in the subject line, or raised by telephone on +44 (0) 20 7190 9670.
3. What cookies and similar technologies are
A cookie is a small text file stored on a computer, tablet, phone or other device when a website is visited. Cookies can remember a preference, maintain a session, help protect a form, distinguish browsers, measure how pages are used or support content supplied by another provider.
This policy also uses the term “cookies” as convenient shorthand for related technologies where appropriate, including:
- local storage and session storage in the browser;
- tags, scripts, software development tools and similar code used to send events;
- pixels, web beacons and small image requests;
- device, network and log information used for security, load balancing or fraud prevention;
- consent signals exchanged between our consent platform and website tags; and
- embedded players, forms, maps, chat tools or other content supplied by third parties.
3.1 First-party and third-party cookies
First-party cookies are set on the lions-campus.co.uk domain, even where a service provider supplies the underlying technology. Third-party cookies are set from another provider’s domain, for example when an embedded service is loaded. A first-party cookie is not automatically low risk: its purpose and the information connected to it remain important.
3.2 Session and persistent cookies
Session cookies normally expire when the browser is closed. Persistent cookies remain until their stated expiry date, until they are replaced, or until they are deleted through browser or device settings. Some providers refresh the expiry date when the website is revisited.
4. The legal framework and when we ask for consent
Our use of storage and access technologies is governed principally by the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, together with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
Where PECR requires consent, consent must be freely given, specific, informed and indicated by a clear positive action. We therefore do not treat silence, continued browsing or a pre-ticked option as consent. It must be as easy to refuse or withdraw non-essential cookies as it is to accept them.
Consent is not required for a technology that is strictly necessary to transmit a communication or provide an online service explicitly requested by the visitor. Amended PECR also contains limited exceptions for certain statistical and preference technologies, subject to safeguards and a simple right to object. As a cautious operational position, Lions Campus continues to place GA4 and HubSpot website analytics in the consent-controlled Analytics category rather than relying on those newer exceptions.
Where a cookie or similar technology involves personal information, we also need a lawful basis under data protection law. For consent-controlled analytics, consent is normally the relevant basis. For essential security, consent-management and requested-service technologies, we generally rely on our legitimate interests in operating a secure website, steps requested before a contract, performance of a contract, or compliance with law, depending on the activity. A data-protection lawful basis does not replace consent where PECR requires consent.
Important distinction
Cookie consent covers storage or access on a device. It is separate from consent to receive marketing messages, consent to share programme information, and any consent connected with a Lions Campus service. Changing a cookie choice does not automatically withdraw those other permissions, and vice versa.
5. The categories we use
| Category | What it does | Default position |
|---|---|---|
| Strictly necessary | Operates core website functions; protects the website and forms; balances traffic; records consent; and provides a feature or communication expressly requested by the visitor. | Always active where required. No consent toggle, but browser controls may still remove some cookies and can affect functionality. |
| Functional / preferences | Remembers optional choices or enables enhanced features such as media, chat or interface preferences. Some purely requested functions may be necessary; otherwise this category is consent-controlled. | Off until selected, unless a narrowly applicable legal exception permits the specific function. |
| Analytics / performance | Helps us understand visits, page use, navigation, campaigns and website performance so that we can improve content and usability. This includes GA4 and HubSpot website analytics. | Off until Analytics consent is given. |
| Advertisement / marketing | Supports advertising measurement, remarketing, cross-site tracking or personalised marketing audiences where such technologies are introduced. | Off until Advertisement consent is given. We do not infer advertising consent from an enquiry or newsletter subscription. |
Some tools can perform more than one function. We categorise a technology by its actual configuration and most privacy-significant purpose. We do not deliberately place an analytics or advertising technology in the necessary category merely because it is useful to us.
6. How CookieYes manages your choices
We use CookieYes as our consent management platform. When CookieYes is configured on the website, it displays the cookie banner and preference centre, records category choices, communicates those choices to compatible tags and stores a necessary preference cookie so that the website remembers the decision.
- Accept All enables the non-essential categories shown in the banner.
- Reject All keeps non-essential categories disabled.
- Customise or Preferences lets the visitor make category-by-category choices.
- The Revisit consent control reopens the preference centre so a choice can be changed or withdrawn.
- CookieYes may record a consent identifier, consent status, category choices and date/time where consent logging is enabled. The identifier is used to evidence and update the choice, not to diagnose or profile a young person.
- CookieYes normally remembers a choice for up to one year, subject to our configuration. We may ask again sooner if the policy, categories or technologies change materially, or if consent is renewed.
CookieYes can only control technologies that have been correctly integrated, categorised and blocked. We therefore combine the consent tool with configuration reviews and periodic scans. If an uncategorised or unexpected cookie appears, we investigate it and update the block rules or declaration as appropriate.
If the button does not open the preference centre, use the floating Revisit consent button on the website or contact us. The CookieYes tool may not work if its script has been blocked by a browser extension or network setting.
7. Details of cookies and similar technologies
The tables below describe the principal cookies and storage items used by or through Lions Campus. Durations are typical or provider defaults and may be shortened by browser controls, consent withdrawal or configuration. Pattern names containing an asterisk represent a family of cookies with a site-, account- or user-specific suffix.
7.1 Consent and WordPress preference cookies
| Cookie or storage item | Provider | Purpose | Typical duration | Category |
|---|---|---|---|---|
cookieyes-consent |
CookieYes / Lions Campus | Stores the consent identifier and category choices so the banner can respect and update the visitor’s decision. | Up to 1 year | Strictly necessary |
CookieLawInfoConsent, viewed_cookie_policy and cookielawinfo-checkbox-* |
CookieYes legacy WordPress interface | Legacy consent cookies that may remain where an older CookieYes / Cookie Law Info configuration is active. They remember whether the notice was viewed and the choice for each category. | Up to 1 year | Strictly necessary |
wp_consent_functional, wp_consent_marketing, wp_consent_preferences, wp_consent_statistics and wp_consent_statistics-anonymous |
WP Consent API / Lions Campus | Where the WP Consent API is active, shares the visitor’s category choices with compatible WordPress plugins so they can respond consistently. | Configured period, commonly up to 1 year | Strictly necessary consent state |
Current and legacy CookieYes cookies are not necessarily set together. The active names depend on the plugin version and migration status.
7.2 WordPress and operational cookies
| Cookie or technology | Purpose | Typical duration | Who is likely to see it | Category |
|---|---|---|---|---|
wordpress_logged_in_*, wordpress_sec_* and related authentication cookies |
Authenticates and protects a WordPress account and administrative session. | Session or configured login period | Logged-in administrators and authorised users; not normally public visitors | Strictly necessary |
wp-settings-* and wp-settings-time-* |
Stores WordPress administrative interface preferences for a logged-in account. | Typically up to 1 year | Logged-in administrators and authorised users | Strictly necessary / preference |
wpEmojiSettingsSupports |
Allows WordPress to remember whether the browser supports native emoji display and load resources appropriately. | Session | Visitors where the WordPress emoji feature is active | Functional |
| Security, anti-spam and hosting signals | WP Engine, WordPress and tools such as WP Armour may use request logs, hidden honeypot fields, rate-limiting signals or short-lived security cookies to detect bots, abuse and malicious activity. A visible cookie is not required for every control. | Session or short operational period | Visitors who use forms or trigger a security control | Strictly necessary |
8. Google Analytics 4 and Google tags
We use Google Analytics 4 (GA4), supplied by Google, to understand how visitors find and use the website. GA4 may process a browser identifier, page URL and title, referral source, visit and interaction times, approximate location derived from IP address, device and browser information, and events such as page views or link interactions. See Google Privacy Policy for information about Google’s processing.
We use GA4 to produce aggregated reports, identify navigation or content problems, understand the effectiveness of communications and improve the website. We do not intentionally send names, email addresses, telephone numbers, full form contents or special-category information to GA4. Users of our analytics account are restricted according to role.
| Cookie or technology | Purpose | Typical duration | Category and consent |
|---|---|---|---|
_ga |
Distinguishes browser instances for GA4 measurement and reporting. | 2 years by default; may be refreshed or configured for less | Analytics — set only after Analytics consent |
_ga_ |
Persists GA4 session state for the relevant measurement container. | 2 years by default; may be refreshed or configured for less | Analytics — set only after Analytics consent |
| Google tag / Google Tag Manager | Loads and manages configured measurement tags. Tag Manager is a delivery system; the tags deployed through it determine whether cookies or other identifiers are used. | The container itself is code; resulting cookie duration depends on each tag | Controlled according to the purpose of each tag |
| Google Consent Mode signals | Where enabled, communicates consent states such as analytics storage and advertising storage to Google tags. Depending on configuration, limited consent-state or cookieless measurement signals may be sent even when analytics storage is denied; GA cookies are not intended to be placed in that denied state. | Request-level signals rather than a persistent GA cookie | Necessary consent communication / consent-denied measurement state |
Google’s default lifetimes can be changed in our configuration and browser privacy features may shorten them. GA4 reporting may also use modelling or aggregation. Consent Mode does not itself provide consent; it must receive and respect the choice made through CookieYes.
9. HubSpot forms, CRM and website analytics
We use HubSpot for website forms, enquiry and referral management, customer relationship management and website analytics. HubSpot is supplied by HubSpot, Inc. and associated companies. See HubSpot Privacy Policy for information about its processing.
9.1 Forms and contact records
When a visitor deliberately submits a HubSpot form, HubSpot processes the fields completed and technical details needed to deliver the submission, reduce spam and create or update a contact record. That processing can occur even when analytics cookies are refused because the visitor has asked us to receive the form. The form should not require agreement to analytics as a condition of submission.
If HubSpot analytics cookies have been accepted, the HubSpot visitor identifier may be associated with a submitted form and may connect earlier or later website activity from that browser to the resulting HubSpot contact record. If analytics cookies have not been accepted, we configure the service not to use that analytics history for the browser. We do not treat form submission as consent to email marketing; newsletter and other direct-marketing choices are handled separately.
9.2 HubSpot cookies and browser storage
| Cookie or storage item | Purpose | Typical duration | Category and consent |
|---|---|---|---|
__hstc |
Main HubSpot analytics cookie. Contains information such as domain, first visit, most recent visit, current visit and session number. | 6 months | Analytics — after Analytics consent |
hubspotutk |
Stores an opaque visitor identifier and can be submitted with a HubSpot form to help deduplicate contacts and associate consented website activity with a contact record. | 6 months | Analytics — after Analytics consent |
__hssc |
Tracks sessions, including visit number and session timing, for HubSpot analytics. | 30 minutes | Analytics — after Analytics consent |
__hssrc |
Helps determine whether the browser was restarted so HubSpot can establish a new session. | Session | Analytics — after Analytics consent |
__hs_opt_out, __hs_do_not_track, __hs_initial_opt_in and __hs_cookie_cat_pref |
Where HubSpot’s consent features are enabled or integrated, records opt-out, do-not-track, initial interaction and category choices. | 7 days to 6 months, depending on cookie | Strictly necessary consent state |
__cf_bm, __cfruid and __cfuvid |
Cloud delivery, bot management and rate limiting used in connection with HubSpot-hosted resources or forms. The exact cookie depends on the network configuration. | 30 minutes or session | Strictly necessary security |
hs_ab_test |
Where a HubSpot-hosted A/B test is active, remembers the version of a page shown so the test functions consistently. | Session | Analytics / performance — after relevant consent |
messagesUtk, hs-messages-is-open and hs-messages-hide-welcome-message |
Where HubSpot chat is enabled, recognises a chat visitor, restores history and remembers whether the chat interface or welcome message was shown. | 30 minutes to 6 months | Functional — after Functional consent, unless necessary to provide a chat expressly requested |
__hmpl and hublytics_events_53 |
Browser-storage items HubSpot may use to hold temporary event or performance metadata. These are not set in every implementation and their content and lifetime are provider-controlled. | Temporary / provider-controlled | Analytics — after Analytics consent |
HubSpot’s available cookies vary by product, hosting route and configuration. Chat, A/B testing and HubSpot’s own consent cookies will appear only if the associated features are enabled. CookieYes and HubSpot consent APIs must be correctly connected so that a change made in CookieYes is communicated to HubSpot.
10. Embedded content, external links and other services
A page may include or link to content supplied by another organisation. We seek to prevent a non-essential embed from setting cookies before the relevant consent. In some cases a placeholder is displayed until the visitor chooses to load the content.
| Service | How it may be used | Cookie position |
|---|---|---|
| YouTube / Google | Videos may be embedded in articles or programme pages. If a video or player is loaded, Google may receive device, IP, page and player-interaction information and may use cookies such as YSC, VISITOR_INFO1_LIVE or VISITOR_PRIVACY_METADATA, depending on its current configuration. | Functional or marketing cookies should remain blocked until the relevant consent. Provider-controlled durations apply. |
| WhatsApp / Meta | A WhatsApp link allows a visitor to open WhatsApp and contact us. Merely displaying a link should not require WhatsApp cookies; after the visitor follows it, WhatsApp or Meta operates its own site or app under its own privacy and cookie information. | External service after the visitor chooses the link; not treated as consent to Lions Campus analytics. |
| HubSpot embedded forms | Enquiry, referral or newsletter forms can be delivered from HubSpot. Security and form-delivery technologies may operate to provide the requested form; HubSpot analytics remains consent-controlled as described above. | Necessary form functions may operate; analytics stays off until Analytics consent. |
| Social and partner links | Links may lead to social networks, partner organisations, maps or other websites. Those providers may set cookies after the visitor chooses to leave our website or load their content. | The destination provider’s policy applies after interaction. |
We do not control cookies placed directly by an independent destination website. Opening a third-party service may also allow that provider to recognise an account already signed in on the device.
11. Young people and sensitive information
Our website is written for parents, professionals, teenagers and young adults. Because our subject matter includes mental health, eating disorders, behavioural challenges, neurodiversity and addiction, a page visit could reveal sensitive interests or circumstances. We therefore apply additional care to tracking design.
- We do not intentionally create advertising audiences from visits to condition-specific pages or from information submitted in an enquiry or referral form.
- We do not intentionally send form-field content, names, telephone numbers, email addresses, diagnoses, free-text enquiries or safeguarding information to GA4 analytics events.
- Analytics access is limited to people and providers who need it for website operation, reporting and improvement.
- Analytics reports are used to understand website performance and content at an aggregated level, not to make programme admission, safeguarding or support decisions about a visitor.
- A young person can reject non-essential cookies and still access core information or contact us through available channels.
Website cookie consent is given by the user of the device. Where a child is not able to understand the choice, a person with parental responsibility should assist. Our services are not designed for children to create unrestricted online accounts, and cookie consent does not replace any age, capacity or parental-responsibility assessment required for a programme.
12. How to accept, reject or change your choices
On a first visit, the CookieYes banner offers controls for non-essential categories. A visitor may:
- choose Accept All to enable the non-essential categories displayed;
- choose Reject All to keep them disabled;
- open Customise / Preferences to choose individual categories; or
- return later through the Revisit consent button or Cookie settings button and change the selection.
Withdrawing consent applies from that point forward. We stop or adjust the relevant tags when the updated choice is received. A previously stored cookie may remain on the device until it expires or is removed, but it should no longer be used for the withdrawn purpose by our website. Browser settings can be used to delete it immediately.
If cookies are cleared, a private-browsing session is used, a different browser or device is used, or the consent cookie cannot be read, the website may ask for a choice again. We may also renew consent after a material change.
13. Browser and device controls
Most browsers and devices provide controls to inspect, delete or block cookies; clear site data; limit cross-site tracking; or restrict third-party storage. Browser help pages explain the available steps. Blocking all cookies can prevent the consent tool, forms, embedded media, account login or other requested features from functioning correctly.
Browser ‘Do Not Track’ signals are not implemented consistently across the industry. We therefore rely primarily on the explicit CookieYes choices. Where a browser or platform sends a legally recognised opt-out signal that applies to a technology we use, we will assess and honour it as required. A browser signal does not prevent strictly necessary security or requested-service processing.
14. Data sharing, international transfers, retention and security
14.1 Providers and sharing
Cookie and website data may be available to Lions Campus personnel who need it and to providers that operate the website, consent platform, analytics, hosting, forms, CRM, security or embedded services. Key providers include CookieYes, Google and HubSpot. They may act as our processor, an independent controller or both for different activities, as described in their terms and privacy information.
We do not sell cookie data. We may disclose relevant records to professional advisers, insurers, courts, law-enforcement bodies or regulators where necessary and lawful, including to investigate security incidents, establish legal rights or meet a legal obligation.
14.2 International transfers
Some providers operate globally and may process website data outside the United Kingdom. Where we are responsible for a restricted transfer, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved EU standard contractual clauses, or another lawful safeguard, together with risk and security assessments where required. Provider privacy information may explain additional locations and safeguards.
14.3 Retention
Cookies remain on the device for the period shown in the tables or current CookieYes declaration, unless deleted earlier. Analytics data and related reports are retained according to our configured GA4 and HubSpot settings and then deleted, aggregated or anonymised where appropriate. CookieYes consent records are retained for the period available under our configured service and only for as long as reasonably needed to demonstrate consent and compliance, resolve disputes or meet legal requirements.
Information deliberately submitted through a form is retained as enquiry, referral, contact or programme information rather than merely as cookie data. The applicable retention approach is explained in our Privacy Policy.
14.4 Security
We use role-based access, account security, secure transmission, hosting safeguards, supplier controls, updates, logging and other proportionate measures to protect website information. No internet service is completely secure. Visitors should avoid including unnecessary medical, safeguarding or other highly sensitive details in general newsletter forms or unencrypted channels.
15. Audits and changes to this policy
We review website tags, plugins and cookie categories periodically and after material website changes. CookieYes scans help identify cookies, but automated scanning may not detect a cookie that appears only after a particular interaction, login, location, campaign or provider response. We therefore supplement scans with configuration and consent testing.
We may update this policy when technologies, providers, legal requirements or our practices change. The effective date at the top identifies the current version. If a change materially affects consent choices, we may reset or renew consent and display the banner again.
Current cookie list
Open Cookie settings and select the cookie-list or category details for the most current operational declaration generated from our consent configuration. If that list and this explanatory policy differ, please tell us so that we can investigate and correct the inconsistency.
16. Questions and complaints
Questions, objections or concerns about cookies can be sent to office@lions-campus.co.uk or raised on +44 (0) 20 7190 9670. Please describe the device, browser, page, approximate date/time and cookie name where possible; do not send passwords or unnecessary sensitive information.
You may also complain to the UK Information Commissioner’s Office. Information about concerns and complaints is available at ico.org.uk/make-a-complaint. We would appreciate the opportunity to investigate first, but you are not required to contact us before approaching the ICO.
For wider information about our handling of personal information and your data-protection rights, see our Privacy Policy.