Cookie Notice

Version 2 · 27 August 2026 · Applies to the Smart Spaces Building Readiness Scorecard and Smart Building Configurator

This notice covers this tool only. It sits alongside the Smart Spaces Cookie Policy, which covers our main website. The two are different properties running different software, so the cookies are not the same — this page is the accurate one for this tool.

1. What cookies are

A cookie is a small text file a website asks your browser to store. It lets a site recognise the same browser on a later page or a later visit. Some cookies are set by us; others are set by companies whose code runs on the page, which is why the table below names a provider for each one.

The same rules apply to similar technologies such as local storage, so we cover those here too.

2. The four categories we use

Essential

Needed for the tool to work. These remember the cookie choice you make here so we do not ask again on every page. They cannot be switched off and they do not identify you.

Performance

Let us count visits and see which parts of the assessment people find difficult, so we can improve it. We only ever look at this in aggregate.

Functional

Enable optional extras such as embedded content. Nothing on this tool needs them today.

Marketing

Used by advertising partners to build a profile of your interests and show you relevant adverts on other sites. Switched off unless you turn them on.

3. How our tags are managed

Analytics and advertising tags on this tool are deployed through Google Tag Manager rather than being written into the pages one by one.

We do not load Tag Manager at all until you accept at least one optional category. This matters: simply fetching the Tag Manager container file would disclose your IP address to Google before you had agreed to anything. Loading the container in a "denied by default" state is the common approach and it would make the promise at the top of this page untrue, so we do not do it.

On top of that, we set Google Consent Mode v2 signals to denied before any container could ever load, and update them whenever you change your choice. That is a safety net for tags added to the container later, not the primary control.

We also do not use the Tag Manager <noscript> fallback anywhere, because it fires unconditionally and cannot be gated on your consent.

4. Cookies used on this site

This table is kept in step with the cookie register inside the consent code itself, so it cannot quietly drift out of date.

5. Measurement that uses no cookies at all

We count how the tool is used with our own software, running on our own servers. It is separate from Google Analytics, it is not deployed through Tag Manager, and none of it is shared with anyone.

It stores nothing on your device and reads nothing from it. No cookie, no local storage, nothing. That is not a detail — it is the reason this measurement is not in the cookie banner. The law that requires a cookie banner is about storing or reading information on your equipment, and this does neither. It is covered instead by data protection law, where our basis is legitimate interests and where you have an unconditional right to object. That is why the off switch below exists.

What each event records:

• the page or screen you reached, and how long you spent on the previous one;
• the answer you picked, at the moment you pick it — so a half-finished assessment still tells us which questions people find hard, even if you never submit it;
• which buttons and links you clicked;
• your country, the kind of device you are using, and your browser family;
• the site you arrived from, as a domain name only — never the full address of the page you came from;
• a campaign tag, if you arrived through one of our links.

What it never records is your IP address. Our server has to see it to answer your request at all, as every web server must. It is used in memory for two things — working out your country, and generating the daily code described next — and then discarded. It is not written to our database and it is not written to a log.

To tell one visit apart from another without a cookie, we turn your address and browser into a short scrambled code using a secret that is thrown away and replaced every night. The code cannot be turned back into your address, and tomorrow's code for the same visitor is different and cannot be joined to today's. The practical effect is that we can see how many people used the tool on a given day and how far they got, and we cannot build a history of you.

How to switch it off. Either turn off the Analytics toggle in Cookie Settings — which is the one thing here that does store something, a small marker so we remember not to count you — or send a Global Privacy Control signal from your browser, which we treat as switching it off. Either takes effect immediately. You can also email dpo@smartspaces.app and we will handle it that way instead.

Individual events are deleted after 180 days. What survives is a daily count — how many people, how far they got, which answers were common — with no identifier of any kind in it.

The country lookup uses a database file stored on our own server, so no request goes to anyone else when we work out where a visit came from. It is derived from MaxMind's GeoLite2 data, used under the Creative Commons Attribution-ShareAlike 4.0 licence.

6. Third-party requests that happen before you choose

We want to be straight about one exception to the promise at the top of this page. The typeface used across this tool, halyard-display, is licensed through Adobe Fonts, and Adobe's licence requires their fonts to be served from Adobe's own network rather than from our servers. So one request goes to use.typekit.net when the page loads, before you have made any cookie choice.

That request sets no cookies and carries nothing about your assessment. It does disclose your IP address and the address of the page to Adobe, in the same way that loading any image from another company's server would. We cannot gate it behind consent without breaking the licence, and we cannot self-host the font for the same reason.

Our other typeface, Open Sans, is served from our own servers precisely to avoid this, so there is no request to Google for fonts.

7. Other things stored in your browser

Two small pieces of information are kept in your browser's own storage rather than in cookies. Neither identifies you and neither is shared with anyone.

• cfgSizeUnit — whether you last viewed building sizes in square feet or square metres, so you do not have to switch it again.
• submissionId — the reference for the assessment you are part-way through, so the configurator can add to the scorecard you just completed instead of starting a second record. Cleared when you close the tab.

These are strictly necessary for the tool to behave sensibly, so they are not gated behind consent. When you withdraw consent we clear everything else in storage but deliberately keep these two, so that withdrawing does not lose your place.

The same applies to the ss_noanalytics marker, set only if you switch off the cookieless measurement in section 5. Withdrawing consent deliberately does not clear that one either: erasing it would quietly switch measurement back on for somebody who had asked us to stop.

8. Changing your mind

Use Cookie Settings, in the footer of every page, to change your choices at any time. Turning a category off clears the cookies and stored data we can reach and reloads the page into a clean state.

Two honest limitations:

• A script that has already run cannot be un-run. If you accepted analytics, browsed a few pages and then withdrew, we can stop anything further from being sent, but we cannot recall what was already sent.
• We cannot delete another company's cookies. Cookies set on doubleclick.net or linkedin.com belong to those domains and are invisible to us. Withdrawing stops us contacting those services, but the cookies themselves stay in your browser until they expire or you clear them yourself.

For that reason, the opt-outs that actually reach those companies are theirs:

• Google My Ad Center
• LinkedIn advertising preferences
• Digital Advertising Alliance opt-out
• Your Online Choices (Europe)

9. This tool and smartspaces.app are separate

The choice you make here applies to this tool only. Our main website at smartspaces.app runs different software with its own cookie banner and its own cookie policy, and you will be asked separately there. The same is true of hidglobal.com, which is a different company's site entirely.

10. Global Privacy Control

If your browser sends a Global Privacy Control signal, we treat it as an instruction to switch off performance and marketing cookies, and the banner will tell you we have done so. You can still deliberately turn a category on, and we record that as your considered choice so it is not silently undone next time.

We treat it as switching off the cookieless measurement in section 5 as well, even though that one is not a cookie question. A signal that says "do not track me" is clear enough.

A GPC signal can only ever turn things off. It is not affirmative consent, so it can never switch a category on by itself.

We do not act on the older Do Not Track header. It was never finished as a standard, Safari removed it, and treating it as a preference would mean guessing at what a visitor meant.

11. Controlling cookies in your browser

Every major browser lets you block or delete cookies in its settings, and that works regardless of anything on this page. Blocking all cookies will stop us remembering your choice, so the banner will appear on every visit. aboutcookies.org has step-by-step instructions for each browser.

Questions about any of this: dpo@smartspaces.app. See also our Privacy Notice and Terms of Use.