DPP Grid legal information
DPP Grid Cookie Notice
Operational draft: Cookie notice and preference guidance for the DPP Grid website. Professional legal and production-fact review remains pending.
DPP GRID COOKIE AND SIMILAR TECHNOLOGIES NOTICE
Version 1.2 — 31 July 2026
1. What this Notice covers
This Notice explains how Fleeta Limited trading as DPP Grid uses cookies and similar technologies on dppgrid.com, authenticated workspaces and public Digital Product Passports.
Cookies are small files stored by a browser. Similar technologies include local storage, session storage, pixels, software-development kits and short-lived identifiers.
2. Our approach
We separate technologies into:
- Strictly necessary — required to provide a feature you request, protect the service, authenticate users, prevent fraud or remember privacy choices. These are used without optional consent where law permits.
- Functional — optional settings that improve convenience but are not essential.
- Analytics — optional measurement used to understand service or public-passport use.
- Marketing — optional advertising or campaign measurement, if ever enabled.
Optional technologies remain disabled until the required consent is given. Rejecting optional technologies does not prevent access to core public passport information or the account features that do not depend on them.
“Reject optional” and “Accept optional” should be equally easy to select. You may change your choice at any time through “Cookie settings”.
3. Public-passport analytics
Where a visitor allows analytics, a public passport may emit privacy-safe interaction events using a short-lived pseudonymous identifier. The purpose is to understand whether a passport resolves correctly and which approved information is useful.
DPP Grid does not use public-passport scans to build cross-site advertising profiles. Public scan events are retained for up to 90 days unless a shorter period is configured.
Browser Do Not Track is honoured for public interaction analytics regardless of the saved analytics preference.
4. Current technology table
| Category | Name / provider | Purpose | First or third party | Duration | Consent |
|---|---|---|---|---|---|
| Necessary | dpp-grid-session |
Keep an authenticated user signed in | First party | Up to 120 minutes of inactivity | Not required where strictly necessary |
| Necessary | XSRF-TOKEN |
Protect state-changing forms and requests | First party | Session-bound | Not required where strictly necessary |
| Necessary | dpp_analytics |
Remember the public analytics preference | First party | Up to 365 days | Not required for the preference record |
| Necessary when requested | Cloudflare Turnstile | Protect account and public forms from automated abuse | Third party | Challenge-controlled | Required when the protected form is submitted |
| Necessary when requested | Stripe Checkout | Secure payment collection and fraud controls | Third party | Provider-controlled checkout session | Required when checkout is opened |
| Analytics | Ahrefs Analytics | Measure public page performance and search visibility | Third party | Provider-controlled | Loaded by the public template; review before optional use |
No functional or advertising technology is configured in the current public template. A provider may set additional strictly necessary technologies inside its own hosted flow; those are governed by that provider's notice.
5. Third-party content
A page may include content or services from another provider, such as secure checkout, video, mapping, support or e-signature services. Those providers may set their own technologies when the feature is requested or consent is given. Their privacy notices also apply.
No optional third-party script should load before the relevant choice.
6. Managing your choice
You can:
- use the “Cookie settings” control on the website;
- reject or accept categories;
- withdraw consent as easily as it was given;
- configure your browser to block or delete cookies; and
- enable Do Not Track for public-passport analytics.
Blocking strictly necessary technologies may prevent login, secure checkout or requested account functions.
7. Legal basis
We use strictly necessary technologies to provide requested services and protect the platform. Where consent is required under PECR, UK GDPR, EU ePrivacy rules or other applicable law, we use optional technologies only after consent.
Where a technology also processes personal data, the DPP Grid Privacy Notice explains the purpose, lawful basis, recipients, retention and rights.
8. Changes and contact
We update this Notice and the live technology table when our use of cookies or similar technologies changes.
Questions or privacy requests: support@dppgrid.com, subject “Cookie privacy”.
Fleeta Limited trading as DPP Grid
Company number 16675897
50 Princes Street, Ipswich, England, IP1 1RJ