Cookies Policy

1. What cookies are

Cookies are small text files placed on your device when you visit a site. We also use closely-related technologies — local storage, session storage, and pixel tags — which we collectively refer to as "cookies" in this policy.

2. How we use cookies

We use cookies to keep you signed in, remember preferences, secure your session, measure how the site is used, and improve performance. We do not use cookies for cross-site behavioural advertising, and we do not sell cookie data.

3. Categories we set

Strictly necessary — required for the site to work (auth, CSRF, load balancing). No consent required under PECR reg. 6(4).
Functional — remember your choices (language, theme, dismissed banners). Set only with your consent.
Performance / analytics — first-party analytics so we can improve the site. Set only with your consent.
Security — bot detection and abuse prevention on the public verification page. Set under legitimate-interests / strictly necessary.

4. Cookies we use

Name	Purpose	Category	Expiry
yz_session	Authenticated session	Strictly necessary	Session
yz_csrf	Cross-site request forgery token	Strictly necessary	Session
yz_lb	Load-balancer affinity	Strictly necessary	1 hour
yz_consent	Stores your cookie choices	Strictly necessary	12 months
yz_pref_density	Remembers UI density choice	Functional	12 months
yz_pref_theme	Remembers light/dark choice	Functional	12 months
_plausible	Anonymous, cookieless analytics ping (no ID stored)	Performance	n/a
yz_verify_rl	Rate-limit token on the public verify page	Security	15 minutes

5. Third-party cookies

Yezda's marketing site does not embed advertising, social, or behavioural-tracking SDKs. The customer portal uses no third-party cookies. The candidate mobile app uses Firebase Cloud Messaging tokens for push delivery — these are device tokens, not browser cookies, and are described in the Privacy Policy.

On your first visit, you are asked to accept or reject non-essential cookies via our cookie banner. You can change your choice at any time using the "Cookie preferences" link in the footer. You can also block or delete cookies in your browser:

Blocking strictly-necessary cookies will prevent the customer portal from working.

7. Do Not Track

We honour Global Privacy Control (GPC) signals: a GPC=1 header is treated as an opt-out from non-essential cookies for that visitor.

8. Changes

If we add or change cookies, this page will be updated and the "Last updated" date revised. Material additions in non-essential categories will trigger a renewed consent prompt.

9. Contact

Questions: dpo@yezda.co.uk.