Last updated: 2 October 2026. Cookies are small files stored by a website in your browser. Similar storage includes data held just for a browser tab. This page explains the current site’s use of these technologies.
Ordinary browsing and enquiries
We do not enable analytics, advertising pixels, embedded social feeds or embedded maps. Website fonts and images are served from our own site. The hire filters, carousel and enquiry choices work without saving preferences in cookies or browser storage. There is no non-essential cookie service to opt into in the current site, so we do not display an “accept all” banner.
The unnecessary WordPress emoji-detection browser storage has been disabled. At the 2 October review, ordinary visitor checks found no first-party cookies or local/session storage from the site. Administrator sign-in is different, as explained below.
How the enquiry form is protected
The form includes a security token and a hidden anti-spam field. Short-lived checks are held on the server, not as tracking cookies: form tokens expire after two hours, hashed IP-based rate-limit records after one hour from the latest counted attempt, and acknowledgement/duplicate-prevention records after ten minutes. They do not hold the text of your enquiry. The acknowledgement page uses a random reference in its address.
Administrator and review access
Customers do not need an account to enquire. People who sign in to WordPress may receive the following first-party cookies from milkywayevents.co.uk:
- wordpress_test_cookie: checks whether the browser accepts cookies on the login screen; lasts for the browser session.
- wordpress_logged_in_* and wordpress_sec_*: authenticate a signed-in user. A normal login session is valid for two days, or fourteen days if “Remember Me” is selected; a non-remembered browser cookie normally ends when the browser session closes. Temporary review access uses a shorter two-hour session.
- wp-settings-* and wp-settings-time-*: remember WordPress editor/interface preferences for signed-in users, for up to one year. They are not used to track hire customers.
The asterisk represents a site or user-specific suffix. Logging out ends that WordPress login session. Browser settings can also clear stored cookies; blocking login cookies can prevent administrator access.
Hosting and security
The site uses Cloudflare for delivery and security. Its email-address protection script was present in our browser checks; it does not require an analytics or advertising cookie. No Cloudflare security cookie was issued during those checks.
If Cloudflare presents a security challenge or activates bot protection for a request, it may issue a security cookie. Cloudflare documents __cf_bm as expiring after 30 minutes of inactivity, and cf_clearance as recording a successful security check for the configured challenge period. Cloudflare’s documented default for that period is 30 minutes; this is not a claim that a challenge was observed or that the site’s setting has been independently verified. See Cloudflare’s cookie information for its security-cookie purposes and challenge-duration explanation.
External links and your choices
WhatsApp and other external services are not loaded as embedded feeds. Choosing an external link opens that provider’s service, which has its own privacy and cookie arrangements. You can use our telephone number or email address instead of WhatsApp.
You can inspect, block or delete cookies through your browser settings. Doing so may affect sign-in or a security challenge. If we introduce optional tracking or other storage that needs consent, we will explain it and provide a choice before it runs, including a way to withdraw consent.
For questions about cookies or personal information, email [email protected] or call 07754 702595.