Cookie Policy
Prisma Staffing Limited
Version 1.0.0 | Effective: November 11, 2026
This website
prismastaffing.co.uk is a static website. It sets no cookies, uses no analytics, advertising or tracking tools, and loads no third-party scripts, so nothing on this website needs your consent. The rest of this policy describes the cookies and similar technologies used by the Opus app, the application you register for and log in to through Prisma Staffing, which Opus Platforms Limited runs on our behalf.
Contents
- What Are Cookies?
- How We Use Cookies
- Types of Cookies We Use
- Third-Party Cookies
- How to Manage Cookie Preferences
- Impact of Disabling Cookies
- Data Retention and Deletion
- Legal Basis for Cookies
- Children's Privacy
- Updates to This Cookie Policy
- Questions and Contact
- Useful Resources
1. What Are Cookies?
Cookies are small text files stored on your device (computer, smartphone, tablet) when you visit a website. They help the website remember your preferences, login status, and other information to provide a better user experience.
In addition to cookies, we also use HTML5 Local Storage, which works similarly but can store more data and does not expire automatically.
2. How We Use Cookies
Prisma Staffing uses cookies and similar technologies to:
- Keep you logged in to your account (authentication)
- Remember your cookie consent preferences
- Provide essential security features (CSRF protection)
- Improve platform performance and user experience (with your consent)
- Understand how you use our platform (analytics, with your consent)
We do NOT use cookies for:
- Selling your data to third parties
- Cross-site advertising profiles or ad retargeting (we have no advertising partners and run no ad-network tags)
We do use consent-gated third-party analytics and monitoring (Google Analytics 4, New Relic Browser and Sentry), consent-gated marketing visitor tracking (Apollo.io) and a consent-gated HubSpot meeting scheduler. These are described in Sections 3.2 to 3.4 below and are only loaded after you grant the relevant cookie-category consent.
3. Types of Cookies We Use
3.1 Necessary Cookies (Always Active)
These cookies are essential for the platform to function. You cannot disable them without losing access to core features.
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
opus_cookie_consent | Stores your cookie consent preferences (necessary to comply with ePrivacy Directive) | 6 months | Local Storage |
refresh_token | Authenticates your session so you can stay logged in; used to issue new access tokens | 7 days (or until logout) | HTTP Cookie (HttpOnly, Secure) |
opus_role_claim | Backend-signed token stating your account role, used by the platform to enforce access control on each page | 7 days (reissued on token refresh, or until logout) | HTTP Cookie (HttpOnly, Secure) |
opus_session_indicator | Non-authoritative hint (contains your account role) used only to avoid a visual flash while the platform loads; not used for any access-control decision | 7 days (or until logout) | HTTP Cookie (not HttpOnly, client script sets/clears it) |
NEXT_LOCALE | Remembers the language you chose for the site | 1 year | HTTP Cookie (set by the site, not a tracker) |
Note: your short-lived access token itself is never written to a cookie or to storage; it is held only in memory in your browser tab for the duration of your session and is discarded on refresh/close.
Other items stored on your device (Local Storage, Session Storage, IndexedDB): to make the platform work and to remember small choices, the web app also stores: a guest chat session identifier (
opus_guest_chat_session), a device identifier used for QR clock-in (opus_qr_device_id), your progress through employer verification (opus_employer_verification_progress), a marker that the cookie banner and your stored consent have been reconciled (opus_consent_reconciled), the time you dismissed CV or profile reminders (opus_cv_nudge_dismissed_at,opus_profile_nudge_dismissed_at), whether you dismissed the app-install prompt (opus-pwa-install-dismissed), a note of which language was applied for your account (opus_locale_seeded_for_user, Session Storage), and an offline queue of actions waiting to sync (IndexedDBopus-sync-queue). These are used only to run the features you use, are not shared with third parties, and can be cleared from your browser settings.
3.2 Functional Cookies (Optional - Requires Consent)
These cookies and similar technologies enhance your experience. The only item in this category is the HubSpot meeting scheduler on our "Book a call" page.
Provider: HubSpot, Inc. (United States). The HubSpot Meetings scheduler is loaded only after you grant functional consent, and only on the Book a call page. Once loaded, HubSpot sets the following cookies:
| Cookie Name | Purpose | Duration | Provider |
|---|---|---|---|
hubspotutk | Identifies the visitor; passed to HubSpot if you submit a booking, to avoid duplicate contact records | 6 months | HubSpot |
__hstc | Main HubSpot cookie for tracking visitors | 6 months | HubSpot |
__hssc | Tracks the browsing session for HubSpot | 30 minutes | HubSpot |
__hssrc | Detects whether the browser has been restarted since the session cookie was set | End of browser session | HubSpot |
__cf_bm | Bot management cookie set by HubSpot's content delivery provider (Cloudflare) | 30 minutes | Cloudflare, via HubSpot |
International transfer: HubSpot processes data in the United States. The transfer relies on the UK Extension to the EU-US Data Privacy Framework, with Standard Contractual Clauses (SCCs) or the UK IDTA as the fallback (see our Privacy Policy §6).
Your control: Toggle Functional off in Account Settings -> Privacy -> Cookie Preferences (or via the cookie banner). When off, the HubSpot scheduler is not loaded and you can email us instead.
Theme preference: the platform stores your dark/light mode choice under the Local Storage key
theme(not gated on cookie consent; it is a client-side display preference with no personal data). This is listed here for completeness rather than under Necessary or Functional, since it is neither strictly necessary nor consent-gated.
3.3 Analytics Cookies (Optional - Requires Consent)
Provider: Google Analytics 4 (Google LLC, United States). Loaded only after you grant analytics consent via the in-app cookie banner.
We use Google Analytics 4 for anonymous platform-usage analytics so we can understand which features are used, how users navigate the platform, and where users encounter errors. The Google Analytics integration is configured with anonymize_ip: true, so your IP address is anonymised before any data leaves your browser.
| Cookie Name | Purpose | Duration | Provider |
|---|---|---|---|
_ga | Distinguishes unique users for anonymous usage analytics | 2 years (Google default) | Google Analytics 4 |
_ga_<container> | Persists session state for the Google Analytics 4 property | 2 years (Google default) | Google Analytics 4 |
International transfer: Google Analytics processes data in the United States. The transfer relies on the UK Extension to the EU-US Data Privacy Framework (Google DPF), with Standard Contractual Clauses (SCCs) as the fallback.
Your control: Toggle Analytics off in Account Settings -> Privacy -> Cookie Preferences (or via the cookie banner). When off, the Google Analytics script is not loaded at all.
Provider: New Relic, Inc. (data processed in the New Relic EU data centre, bam.eu01.nr-data.net). The New Relic Browser agent is loaded only after you grant analytics consent.
We use New Relic Browser to measure page load performance, web vitals and front-end errors so we can find and fix faults. It records an anonymous session identifier for the length of your visit.
| Storage item | Purpose | Duration | Provider |
|---|---|---|---|
NRBA_SESSION::<key> | Holds an anonymous session identifier so page views and errors in one visit can be linked | Browser Session Storage; ends when the tab is closed, after 30 minutes of inactivity or at most 4 hours | New Relic |
Your control: Toggle Analytics off in Account Settings -> Privacy -> Cookie Preferences. When off, the New Relic Browser agent is not loaded at all.
Provider: Sentry (Functional Software, Inc.). The Sentry browser SDK is loaded only after you grant analytics consent and is used only to send front-end error reports (the error message, stack trace and the page route) so we can fix faults. It is configured not to collect default personal data, session replays or performance traces, and it does not set cookies or write to your browser storage.
Your control: The same Analytics toggle. When off, the Sentry SDK is not started.
3.4 Marketing Cookies (Optional - Requires Consent)
Provider: Apollo.io (Apollo Data Inc., United States). Loaded only after you grant marketing consent via the in-app cookie banner.
We use Apollo.io for outbound marketing visitor tracking, measuring engagement with marketing pages and outbound campaigns. The Apollo tracker is consent-gated and is not loaded for users who have not granted marketing consent.
International transfer: Apollo.io processes data in the United States. The transfer relies on Standard Contractual Clauses (SCCs).
Your control: Toggle Marketing off in Account Settings -> Privacy -> Cookie Preferences. When off, the Apollo tracker is not loaded at all. You can also opt out of marketing communications independently in account settings.
4. Third-Party Cookies
We do not use third-party cookies for advertising or ad retargeting. We do use consent-gated third-party cookies for analytics (Google Analytics 4), consent-gated performance and error monitoring agents (New Relic Browser and Sentry), a consent-gated meeting scheduler (HubSpot) and marketing visitor tracking (Apollo.io); these are only loaded after you grant the relevant cookie-category consent.
Other third-party cookies may also be set by essential service providers when you use specific features:
4.1 Identity Verification Providers
When you complete Right to Work verification, the identity verification provider may set cookies to complete the verification process. These are:
- Purpose: Biometric identity verification, liveness detection
- Duration: Session-based (deleted when you close the verification window)
- Your control: Required to complete verification where verification is a legal obligation
4.2 Payment Processors
When you make payments, the payment processor may set cookies to:
- Prevent payment fraud
- Remember your payment method (if you opt in)
- Process transactions securely
Privacy policies:
4.3 WhatsApp Integration
No cookies are set by WhatsApp on our platform. When you interact with Prisma Staffing via WhatsApp, Meta's privacy policy applies:
5. How to Manage Cookie Preferences
5.1 In-Platform Cookie Consent Manager
You can manage your cookie preferences at any time:
- Log in to your Prisma Staffing account
- Go to Account Settings -> Privacy & Data
- Click Cookie Preferences
- Toggle individual cookie categories on or off
- Click Save Preferences
Direct link: /account/privacy (Cookie Preferences section) or the dedicated /account/cookies page, both read/write the same consent ledger (lib/consent/consent-manager.ts, local-storage key opus_cookie_consent + server-side POST /gdpr/consent mirror).
5.2 Browser Cookie Settings
Most browsers allow you to control cookies through settings:
- Google Chrome: Settings -> Privacy and security -> Cookies and other site data
- Firefox: Options -> Privacy & Security -> Cookies and Site Data
- Safari: Preferences -> Privacy -> Manage Website Data
- Microsoft Edge: Settings -> Cookies and site permissions -> Cookies and site data
5.3 Clear All Cookies and Storage
To completely remove all cookies and data of the Opus app from your device:
- Open your browser's Developer Tools (F12 or right-click -> Inspect)
- Go to Application or Storage tab
- Expand Local Storage -> Select
https://opusplatforms.co.uk - Right-click -> Clear
- Repeat for the Cookies section
Note: Clearing cookies will log you out and reset your preferences.
6. Impact of Disabling Cookies
If You Disable Necessary Cookies
- You cannot use the platform (login functionality will not work)
- Cookie consent banner will appear on every visit
If You Disable Functional Cookies
- The HubSpot meeting scheduler on the Book a call page is not loaded; you can email us to arrange a call instead. Login and theme preference are handled by the Necessary cookies and the client-side
themestorage key described above, neither of which is gated on this consent category.
If You Disable Analytics Cookies
- No impact on functionality
- Google Analytics 4 and the New Relic Browser agent are not loaded, so we cannot measure anonymous usage of platform features or detect navigation errors and slow pages
If You Disable Marketing Cookies
- No impact on functionality
- Apollo.io visitor tracking is not loaded, so outbound marketing engagement is not measured
- You can still opt out of email marketing separately
7. Data Retention and Deletion
- Consent records: We keep a record of your cookie consent choices in your browser for 6 months (and, if you are signed in, a record of your choices on our servers, held for the period set out in our Privacy Policy) so we can demonstrate lawful processing.
- Auth session: Authentication tokens expire after 7 days of inactivity or when you log out, whichever comes first.
- Account deletion: If you delete your account, we delete your account records on our servers; cookies and local storage on your own devices are not cleared automatically, so you can clear them from your browser settings.
8. Legal Basis for Cookies
| Cookie Category | Legal Basis | Reference |
|---|---|---|
| Necessary | Exempt from consent (essential for service) | ePrivacy Directive Article 5(3), PECR Regulation 6 |
| Functional | Explicit consent required | UK GDPR Article 6(1)(a), ePrivacy Directive Article 5(3) |
| Analytics | Explicit consent required | UK GDPR Article 6(1)(a), ePrivacy Directive Article 5(3) |
| Marketing | Explicit consent required | UK GDPR Article 6(1)(a), ePrivacy Directive Article 5(3) |
9. Children's Privacy
Our platform is not intended for users under 18 years of age. We do not knowingly collect data from children via cookies or any other means.
10. Updates to This Cookie Policy
We may update this Cookie Policy to reflect:
- Changes in the cookies we use
- New legal or regulatory requirements
- Improvements to our platform
When we make significant changes:
- We update the "Last reviewed" date at the top
- We display a notification on the platform
- We request renewed consent if required by law
Check this page regularly to stay informed about our use of cookies.
11. Questions and Contact
If you have questions about our use of cookies:
Prisma Staffing Limited
- Data Protection Lead / Contact: support@prismastaffing.co.uk
- General enquiries: info@prismastaffing.co.uk
12. Useful Resources
Compliance Statement
This Cookie Policy complies with:
- UK GDPR (General Data Protection Regulation)
- Data Protection Act 2018
- Privacy and Electronic Communications Regulations (PECR) 2003
- ePrivacy Directive 2002/58/EC (as amended)
- ICO Cookie Guidance (2023)
Prisma Staffing Limited. Registered in England and Wales. Company number: 17571333. Registered office: Suite RA01, 195-197 Wood Street, London, E17 3NU. ICO registration number: ZC299204.