GDPR & PECR Compliance

MatMaps Cookie Policy

Last updated 29 September 2026

This Cookie Policy explains how MatMaps Team ("MatMaps", "we", "us", or "our") uses cookies, local storage, indexedDB, and similar technologies on the MatMaps website, services, and the MatMaps Admin Hub (the "Services"). MatMaps Team, owned and operated by Mrs Sadie-May Guntrip and Mr Glyn Guntrip, is the data controller responsible for the processing described in this policy. Our contact address is 483 Green Lanes, London, N13 5XT.

We are committed to processing information transparently and in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and the EU General Data Protection Regulation (Regulation (EU) 2016/679).

Questions regarding our use of cookies or privacy requests can be sent to hello@matmaps.co.uk.

Your Current Consent Status

You can inspect, modify, or withdraw your cookie preferences at any time.

1. What are cookies and web storage?

2. Why we use storage in the Admin Hub

3. Legal bases under UK and EU GDPR

4. Categorization of storage used

5. Complete inventory table of cookies/storage

6. Your rights and withdrawing consent

7. Browser controls and clearing storage

8. Third-party providers and transfers

9. Changes to this policy and contact

1 What are cookies and web storage?

Cookies are small text files that are stored on your device (computer, tablet, or smartphone) when you visit a website. In addition to traditional HTTP cookies, modern web applications—including the MatMaps Admin Hub—make use of HTML5 Web Storage (such as localStorage and sessionStorage) and indexedDB to store data locally on your device.

Throughout this policy, references to "cookies" collectively include traditional HTTP cookies, localStorage keys, sessionStorage tokens, and browser cache mechanisms.

2 Why we use storage in the Admin Hub

The MatMaps Admin Hub is a dedicated administration console used by authorized team members, club moderators, and administrators. We use storage technologies for the following primary purposes:

Secure Authentication & Access Control: Verifying administrative identity and preserving secure sessions via Firebase Authentication so that authorized personnel do not have to re-enter credentials on every internal page transition.
Security & Tamper Prevention: Protecting administrative endpoints against Cross-Site Request Forgery (CSRF) and session replay attacks.
Consent Enforcement: Recording and respecting your cookie and privacy choices in accordance with GDPR regulations.
Workflow State & Dismissals: Remembering read or dismissed notifications (such as new club claims, flagged reviews, or event updates) to prevent redundant alerts during active administrative workflows.
Platform Stability & Diagnostics: Monitoring diagnostic performance and error rates anonymously to ensure platform uptime and high responsiveness.

3 Legal bases under UK and EU GDPR

Under the UK GDPR, EU GDPR, and Regulation 6 of PECR, the legal bases on which we deploy storage technologies are:

Strictly Necessary Storage

Lawful Basis: Legitimate Interests (GDPR Art. 6(1)(f)) and PECR strictly necessary exemption (Reg. 6(4)(b)). These technologies are technically essential to deliver the administrative service requested by the user. Prior consent is not required for this category.

Optional / Functional Storage

Lawful Basis: Freely Given Consent (GDPR Art. 6(1)(a)). Non-essential storage (such as notification history caches or analytics telemetry) is deployed only after you give affirmative opt-in consent.

4 Categorization of storage used

Category 1: Strictly Necessary Storage

Always Active

These storage mechanisms are strictly necessary to enable authentication, route authorization, and ensure the security of administrative functions. The Admin Hub cannot function properly without these items, so they cannot be disabled.

Category 2: Functional & Workflow Preferences

Consent Required

These items allow the Admin Hub to remember administrative workflow states, including acknowledging notification cards, preserving sidebar collapses, and custom table column configurations across sessions.

Category 3: Analytics & Diagnostic Telemetry

Consent Required

These items measure anonymous aggregate performance, page response times, and console diagnostics to assist our technical team in maintaining stability and high availability. We do not use third-party behavioral advertising trackers on the Admin Hub.

5 Complete inventory table of cookies/storage

The following table itemizes all cookies and web storage keys used within the MatMaps Admin Hub:

Identifier / Key	Type & Provider	Category	Purpose	Retention	Basis
firebase:authUser:[apiKey]:...	IndexedDB / LocalStorage (Firebase Auth / Google Cloud)	Necessary	Maintains authenticated admin identity, security tokens, and token auto-refresh across navigation.	Until sign-out or session expiration	Legitimate Interest
matmaps_admin_cookie_consent	LocalStorage & Cookie (First-party)	Necessary	Records your consent choices and timestamp to comply with GDPR accountability requirements.	12 months	Legal Obligation & Legitimate Interest
mm_seen_notifications	LocalStorage (First-party)	Functional	Remembers which event/club/review notifications have been seen to avoid duplicate unread alerts.	90 days or until cleared	Consent
Diagnostic Telemetry	Session Storage (First-party / Firebase)	Analytics	Anonymous portal latency diagnostics and error rate tracking.	Session only	Consent

6 Your rights and withdrawing consent

Under GDPR Article 7(3), you have the absolute right to withdraw or modify your consent at any time. Withdrawing consent is as easy as giving it.

You can exercise this right at any moment by:

Clicking the persistent "Cookie Settings" floating badge displayed at the bottom-left on the website.
Clicking the "Cookie Policy" link in the footer.
Using the buttons below:

7 Browser controls and clearing storage

Most modern web browsers allow you to control cookies and local storage through their settings. You can configure your browser to block cookies or delete existing cookies:

Google Chrome: Settings > Privacy and Security > Third-party cookies / Site settings.
Apple Safari: Preferences / Settings > Privacy > Manage Website Data.
Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data.
Microsoft Edge: Settings > Cookies and site permissions > Manage and delete cookies.

Note: Disabling strictly necessary cookies in your browser settings will prevent you from logging in to the MatMaps Admin Hub.

8 Third-party providers and transfers

Our administration backend relies on Google Firebase (Google Ireland Limited / Google LLC) for authentication and database services. Data stored via Firebase may be processed in data centers located in the EU, the UK, or the United States under standard contractual clauses (SCCs) and the UK International Data Transfer Addendum.

9 Changes to this policy and contact

We may update this Cookie Policy from time to time to reflect changes in our technology or legal requirements. When we make material changes, we will update the "Last updated" date and request renewed consent if necessary.

For inquiries or to exercise your GDPR rights, please contact our Data Protection Team at hello@matmaps.co.uk or by writing to: MatMaps Team, 483 Green Lanes, London, N13 5XT.