Cookies

These make the site work and cannot be switched off. Under PECR they do not require consent.

• Your basket — kept in your browser’s local storage so your order survives a refresh. It never leaves your device until you check out.
• Sign-in — a single lacco_session cookie holding a random token. It is httpOnly, SameSite=Lax and Secure in production, so it cannot be read by scripts or sent from another site.
• Your cookie choice — remembered locally so we stop asking.

Optional, and off unless you turn them on. Analytics tells us which pages people actually use; marketing would let us measure whether an offer worked.

You can change your mind at any time using the cookie preferences link in the footer.

Stripe sets its own cookies on the payment step to detect fraud — that is part of taking a card payment safely. If you have a Google Maps key configured, the map on our contact page is served by Google; without one we use OpenStreetMap, which sets none.