Cookie Policy

1. What this policy covers

This website uses essential storage and basic aggregate statistics to improve the store. Optional Google Analytics loads only after analytics consent. The Meta Pixel loads only after marketing consent and Shopify confirms that marketing is allowed. You can shop without accepting either optional service.

HRS NEWSAGENTS LTD, trading as HRS Food, is responsible for the choices described here. Email hrsnewsltd@gmail.com with a question about cookies or marketing.

2. Essential storage

The storefront cannot work properly without some essential storage. Clearing browser data may remove a basket, saved box or remembered analytics choice.

• •hrs-cart-v1: basket data used to keep the current cart on your device for up to 30 days after its most recent save, unless you clear the basket or browser data sooner. It can include product choices and personalisation you enter.
• •hrs-saved-boxes-v1: box choices saved on your device for up to 90 days after the most recent saved-box change, unless you remove them or clear browser data sooner. A saved box can include a recipient name, gift message and other personalisation you enter.
• •hrs-analytics-consent-v2: your analytics choice for 180 days, unless you change it or clear browser data sooner. After that, the website asks again. The older v1 choice is removed so visitors can make a fresh choice for the storefront and Shopify checkout handoff.
• •hrs-marketing-consent-v3: your separate marketing choice for 180 days, unless you change it or clear browser data sooner. An existing analytics choice does not grant marketing consent. The previous Meta-only marketing choice is not reused for OpenAI tracking.
• •hrs-statistics-choice-v1: remembers whether basic site statistics are on or off, until you change the choice or clear browser data. It contains only on or off, with no visitor identifier. Existing analytics rejections are carried over as a statistics objection when this setting is first created.
• •Storage needed by Shopify when you move to its checkout service.

3. Automatic basic site statistics

For UK visits, basic statistics run automatically under the statistical purposes exception to PECR, solely to improve the website. You can object free of charge using Turn off basic statistics in the privacy prompt or Cookie settings. Turning them off stops new statistics immediately and the choice is remembered. Rejecting Meta and Google cookies does not change this separate statistics setting.

HRS counts views of broad page categories, navigation between those categories and selected tool, basket and successful checkout-handoff actions. These are daily totals, not individual visitor histories, unique visitor counts or linked purchase funnels. The last public page category is held only in memory while this page is open, to count navigation steps; it is discarded on reload, objection or leaving a measured area.

Requests contain only an allowlisted event name and broad page category, plus the previous category for a navigation count. They do not include visitor or session IDs, cookies, IP addresses, full URLs, product handles, search terms, campaign tags, gift messages, order identifiers or form values. HRS immediately adds each request to a daily counter and does not retain individual event records in the statistics store.

Vercel hosts the collection endpoint and private statistics store on HRS's behalf. These statistics are not sent to Google, Meta or other advertising partners, combined with consented tracking, or used to target people. Only aggregate daily counts are retained for comparisons over time. Hosting and security logs are handled separately as described in the Privacy Policy. Requests from outside the UK, or without a UK location supplied by the hosting platform, are not added to the automatic counts.

4. Optional analytics

If you accept analytics, the site can load Google Analytics 4. Advertising storage, ad personalisation and Google Signals are disabled in the website configuration.

If you accept analytics, HRS sends manual page views, selected shopping events and sanitised campaign-source information. Page URLs are sent without query strings or fragments. For an external referrer, HRS sends only its origin; for a page on hrsfood.com, the referrer can include its path.

hrs-attribution-v1 can include limited UTM values, a path-only landing page, the external-referrer hostname, a recognised AI-source label and timestamps. UTM values that look like an email address or a long phone number are discarded. It expires 90 days after the most recent recorded non-direct visit and is removed sooner if you decline analytics.

After consent, Google Analytics can set first-party _ga and _ga_<measurement-id> cookies. The website tag limits their expiry to 90 days, although browser restrictions may shorten it.

The HRS Food Google Analytics property keeps user-level and event-level data for 14 months. This setting does not control standard aggregated reports.

5. Advertising and checkout analytics

After marketing consent, the OpenAI Ads Measurement Pixel sends public page and product views and basket additions to OpenAI. Shopify checkout sends checkout-started and completed-purchase events with value and currency. The storefront never sends a purchase event. HRS does not manually include contact details, recipient names, gift messages or photos in these events. Private share links are excluded from storefront tracking. Browser and advertising identifiers support attribution, and HRS opts storefront events out of future user-level personalisation.

The OpenAI pixel can set __oppref for an advertising click reference for 30 days and __obref for a browser reference for 365 days. Browser restrictions can shorten these periods. With marketing consent, an available OpenAI click reference is forwarded to the HRS Shopify checkout so the purchase can be attributed. Withdrawing marketing consent stops future events and deletes accessible OpenAI measurement cookies; it does not delete data already received by OpenAI.

After marketing consent, the Meta Pixel sends page views, product views and adds to basket to Meta for advertising measurement and relevant ads on Facebook and Instagram. It can send public product names, quantities, prices, currency, page URLs, browser/device information and marketing cookie identifiers. HRS does not add recipient names, gift messages, photographs or checkout links to these storefront events. Automatic form/button tracking and automatic advanced matching are disabled in the storefront pixel.

Meta can set _fbp (browser identifier) and _fbc (advertising click identifier when present) cookies after marketing consent. Their expiry depends on Meta and browser restrictions. They can be removed through browser controls or Cookie settings. Accepting marketing cookies does not sign you up for emails.

Shopify's Facebook & Instagram integration uses the same HRS pixel for checkout measurement, with Meta Pixel, advanced matching and Conversions API. Subject to Shopify's privacy controls, it can send checkout and purchase events, product/order values and identifiers, and customer information for matching. Shopify's Meta checkout tracking requires both Analytics and Marketing to be enabled. Shopify owns these checkout and purchase events; HRS does not send duplicate checkout or purchase events from this storefront.

When checkout starts, HRS sends Shopify the market, buyer country and builder mode needed to process the cart. With analytics consent confirmed for checkout, we also copy a sanitised snapshot of your first and latest external source, campaign and landing path into the cart and order so we can understand how customers find us. Without that consent, no browser attribution is copied. Unique advertising click IDs are not included in this snapshot.

When the Shopify Customer Privacy connection is configured, your separate analytics and marketing choices are passed to Shopify on the shared hrsfood.com domain so that hosted checkout can respect the same choices. Preference consent remains off; a data-sharing opt-out is respected.

The Shopify-managed Google & YouTube app is connected to HRS Food Google Analytics for checkout and purchase measurement. With analytics consent, this can include checkout events, product identifiers, quantities, order value, currency and a transaction identifier. The HRS storefront does not send a separate purchase event.

6. Change your choice

Use Cookie settings on the website to change basic statistics, optional Google and checkout analytics, and marketing independently. Turning off basic statistics stops new aggregate counts. Declining optional analytics stops new Google Analytics events, removes the HRS attribution record, deletes accessible HRS-set Google Analytics cookies and sends an analytics-storage denial update if the Google tag has loaded.

Withdrawing marketing stops new storefront Meta events, revokes consent in the loaded pixel and deletes accessible _fbp and _fbc cookies. It does not erase data already received by Meta. Use Meta account privacy controls or contact us about that data.

Where the Shopify Customer Privacy connection is configured, the same interaction also passes the updated analytics and marketing choices to Shopify. If that connection is not configured for a deployment, the choices apply only to optional measurement sent by the HRS storefront.

Withdrawing analytics consent stops new order-source snapshots and removes the browser attribution record. A snapshot already copied to a Shopify cart or completed order is not automatically erased by Cookie settings. Contact us with your order number to request removal of those source fields; this does not require deleting the purchase or accounting record. Both consent choices remain in browser storage for 180 days unless you change it or clear browser data sooner. Browser controls can also delete stored data.

7. Changes

We will update the date and wording if the storage keys, analytics providers, checkout measurement or advertising technologies change.