Last updated: · Effective: · Version 3 · Version française
Version 3 removes a security cookie we no longer use. Version 2 described the proof of consent we keep, how long choices last in each region, Global Privacy Control and the Do Not Sell or Share link.
This notice lists the cookies and browser storage that observatory.global uses, why, and for how long. Anything that is not strictly necessary stays off until you allow it.
1. What cookies and browser storage are
A cookie is a small file a website saves in your browser. Browser storage (local storage and session storage) works in a similar way. Both let a site remember something between pages or visits, such as that you are signed in or which theme you chose. We call them all cookies in this notice. Similar rules apply to other ways of reading or storing information on your device.
2. Our approach
- We use only strictly necessary cookies unless you agree to more.
- Optional categories are off by default in every region, including US states. Nothing is turned on by scrolling or by continuing to browse, and closing the banner counts as refusing all optional cookies.
- Accept all, Reject all and Customise have the same size and weight, and refusing is as easy as accepting.
- We honour the Global Privacy Control signal everywhere as a refusal of the Marketing category and as a request to opt out of the sale and sharing of personal information. We record it with your choices and tell you on the banner that we honoured it.
- In US states with consumer privacy laws, the banner includes a notice at collection and a Do Not Sell or Share My Personal Information link. We do not sell or share personal information; the link records your opt-out in one step.
- We do not use advertising or cross-site tracking cookies, and we do not sell or share information collected through cookies.
- To apply the rules of your region, we estimate it from a country signal of our delivery service when one is available, or from your browser's time zone and language. We never use your precise location for this, and an unknown region gets the strictest rules.
- Your choice lasts 6 months, or 12 months in US states, unless you change it sooner. We ask again when it expires or when we change the notice, the categories or the services. You can change it at any time.
3. Categories
| Category | What it covers | Default |
|---|---|---|
| Strictly necessary | What the site needs to work, keep you signed in, protect it from attacks and remember your privacy choices and the settings you pick yourself | Always on |
| Preferences | Remembering optional settings beyond the ones you pick yourself | Off until you allow it |
| Measurement | Counting visits and seeing how pages are used, so we can improve the site | Off until you allow it |
| External media | Videos, maps and other content loaded from other providers, which may receive your IP address or set their own cookies | Off until you allow it, or until you choose Load once |
| Marketing | Measuring campaigns and personalising advertising | Off; refused by Global Privacy Control |
At the date of this notice, we use no Preferences, Measurement or Marketing cookies. If we add one, we will list it here and in Privacy choices before it runs, and it will stay off until you allow its category. The list of services in Privacy choices is the live list for each site.
4. Strictly necessary cookies we use
All of these are first-party: they are set by observatory.global and read only by it.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| nxo_consent | Cookie | Remembers your cookie choices: a random consent identifier, the notice version, the categories you allowed, the time, the expiry and whether Global Privacy Control was on | 6 months, or 12 months in US states |
| nxo_consent_dismissed | Session storage | Remembers that you closed the banner, which counts as a refusal, for this browser session | Until you close the tab |
| nxo_consent_region, nxo_consent_lang | Session storage | Remember the region whose rules apply and the language of the banner, for this browser session | Until you close the tab |
| nxo_consent_pending | Session storage | Keeps a record of your choice that could not be sent, to send it again on the next page | Until it is sent or you close the tab |
| nxo_consent_history | Local storage | Keeps the receipts of your last 20 choices in this browser so you can check them | Until you clear it |
| nexus_consent, nexus_consent_id, nexus_consent_records | Local storage | Copies your choice for older page views, so they do not ask you again | 180 days |
| wordpress_logged_in_*, wordpress_sec_* | Cookie | Keep you signed in and protect your session | Until you close the browser, or 14 days if you choose Keep me signed in |
| nxo_signed_in | Cookie | Tells pages served from the cache to load your account menu | Same as your sign-in |
| nxo_oidc | Cookie | Links your browser to a sign-in through an identity provider, when that option is offered | 10 minutes |
| wordpress_test_cookie | Cookie | Checks that your browser accepts cookies when you sign in | Until you close the browser |
| wp-postpass_* | Cookie | Remembers that you entered the password of a protected page | 10 days |
| wp-settings-*, wp-settings-time-* | Cookie | Remembers the layout of the administration screens, for staff only | 12 months |
| nxo-theme | Local storage | Remembers the light, dark or system theme, only after you pick one | Until you change it or clear it |
| nxo-lang | Local storage | Remembers the language you picked, only after you pick one | Until you change it or clear it |
| bp-* | Session storage | May remember the filter or tab you chose in a community list | Until you close the tab |
Some security checks do not store anything on your device: limits on how often a form can be sent use a keyed hash of your IP address on our server, and feedback on knowledge articles is counted without cookies.
5. Content from other providers
Some pages can show content from other providers: live map and data layers from public data services, and embedded videos or maps. When such content loads, your browser connects to the provider, which receives your IP address and browser data and may set its own cookies under its own policy. This content stays blocked until you allow External media, or until you choose Load once on a single item, which loads it without storing your choice. The providers of live map and data layers are listed in our privacy policy.
6. How to change your choices
- Open Privacy choices from the footer of any page or from the privacy button. You can accept all, reject all or switch each optional category on or off. Each decision gives you a short receipt code.
- Turn on Global Privacy Control in your browser to refuse Marketing on every visit.
- Use your browser settings to block or delete cookies. If you block strictly necessary cookies, you will not be able to sign in, and we will ask for your cookie choices again.
Withdrawing consent stops new storage and reading for that category. To remove what is already stored, delete this site's data in your browser.
7. Proof of your choices
The law requires us to be able to show that you gave or refused consent. Each time you make, change or withdraw a choice, or a choice expires, we add a record to a tamper-evident register on our server:
- the random consent identifier, the date and time, and how the choice was made (banner, closing the banner, privacy choices, a single embed, Global Privacy Control, Do Not Sell or Share, withdrawal or expiry);
- the choice for each category, the region and the rules applied, and how the region was determined;
- the versions of the banner and of our policies shown to you, with a fingerprint of the exact text, the language and the page address without its query string;
- whether Global Privacy Control was on and, if you were signed in, your account;
- a shortened IP address (the last part removed: /24 for IPv4, /48 for IPv6) and a keyed one-way hash of your browser's user agent, never the full values.
We keep each record for as long as your choice applies and for 3 years after it ends, then delete it. Our legal basis is our legal obligation to demonstrate consent (Article 7(1) of the GDPR and UK GDPR, and Quebec's private-sector privacy law as amended by Law 25). We store the shortened address and the hash, rather than nothing, in our legitimate interest in protecting the register against false or automated records; shortening and hashing keep that information to the minimum.
You can see the history of your choices, your receipt and the expiry in Privacy choices, and download your record. If you ask us to erase your data, we remove the personal fields of your records but keep the rest as proof, as the law allows. To ask for a copy or erasure, see our privacy policy.
8. Changes and contact
When we change the categories or add a service that needs your consent, we update this notice and ask for your choice again. Questions: our Privacy Officer at contact@observatory.global (Privacy Officer) or our privacy request form or the privacy request form.