For Businesses
Consent, cookies and visitor privacy
1Why this matters for your links
Every tracking link you generate points visitors at adswish.co.uk, which makes Adswish part of your compliance story. UK law (UK GDPR and PECR) requires that anything resembling tracking — including the session identifiers behind attribution — only starts after the visitor has consented. Adswish is built so that requirement is met by default, not bolted on.
2What Adswish stores — and when
- Before consent: nothing. The cookie banner blocks analytics telemetry until the visitor chooses; no analytics storage or heartbeat happens pre-consent.
- After consent: an anonymised analytics session (random ID, no profile), and click attribution records — link slug, timestamp, coarse browser/OS tokens.
- Never: raw IP addresses or device identifiers in stored logs — they are one-way hashed before they're written.
3Retention windows
- Consent records: kept for 2 years from the decision date.
- Clicks log archive: kept for 90 days.
- Withdrawals: a withdrawn consent stays in the record — the withdrawal itself is the evidence consent was respected.
4Consent evidence on request
If you ever receive a subject-access request or an ICO query that touches Adswish tracking, the platform can produce the evidence itself: every banner decision (including anonymous visitors) is recorded with one-way hashed identifiers, exportable as CSV with a cover memo covering the evidence window, decision counts and retention policy.
Related: tracking links that convert and the privacy policy.
5Frequently asked questions
Does Adswish track visitors before they consent?
No. Analytics telemetry only starts after the visitor accepts the cookie banner; nothing is stored pre-consent.
How long is consent evidence kept?
Consent records are kept for 2 years from the decision date, and the clicks log archive for 90 days.
What identifiers are stored in those records?
Only one-way hashed identifiers — raw IP addresses and device identifiers are never stored.