Cookie Policy

RFPVenue is a trading name of My Island Solutions Ltd, a company registered in England & Wales (company no. 14082673). Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact: info@rfpvenue.com.

This Cookie Policy explains how we use cookies and similar storage or access technologies on the RFPVenue website and application. In the United Kingdom, the Privacy and Electronic Communications Regulations 2003 (PECR) apply. For users in the European Economic Area, the applicable national laws implementing Article 5(3) of the ePrivacy Directive apply. Where an item involves personal data, the UK GDPR, EU GDPR or other applicable data-protection law may also apply. Read this with our Privacy Policy.

We use only strictly necessary first-party cookies to provide services you request: signing in, maintaining the authenticated browser session, protecting cookie-authenticated requests, and securing administration access. We do not set advertising, marketing, social-media or analytics cookies or storage, and we do not use third-party tracking. Because everything listed below falls within the strictly-necessary exception, we do not show a consent popup. If we introduce non-essential cookies or similar technologies, we will obtain valid consent before they are set or accessed, with Accept and Reject given equal prominence.

1. Who sets them. All items below are first-party: they are set by us on the hosts we operate (the website and the API / administration host). They are not set by advertisers or analytics vendors. Personal data they contain is processed as described in the Privacy Policy. Contact info@rfpvenue.com.

2. HTTP cookies. • rfpv.access — JSON Web Token (access token). Purpose: authenticate API and WebSocket requests to the marketplace after you sign in. Type: first-party HTTP cookie; HttpOnly (not readable by JavaScript); SameSite=Lax; Secure in production; browser-session cookie (no fixed cookie expiry). The access token inside it currently expires after 30 minutes. Cleared when you sign out. Strictly necessary for the signed-in service you request. • rfpv.refresh — JSON Web Token (refresh token). Purpose: obtain a new access token without re-entering your password. Type: first-party HTTP cookie; HttpOnly; SameSite=Lax; Secure in production; browser-session cookie (no fixed cookie expiry). The refresh token inside it is valid for at most 7 days from issue, is rotated on each refresh, and the previous refresh token is blacklisted. Cleared when you sign out; the server also revokes the refresh token on logout. Strictly necessary to maintain the signed-in browser session you request. • sessionid — Django session identifier. Purpose: keep you signed in to the Django administration site and to any session-authenticated API request. Type: first-party HTTP cookie; HttpOnly; SameSite=Lax; Secure in production. Duration: the browser session, or until you sign out of the administration site. Strictly necessary for the administration / session service you request. • csrftoken — Django CSRF token. Purpose: protect cookie-authenticated unsafe HTTP methods against cross-site request forgery. Type: first-party HTTP cookie; SameSite=Lax; Secure in production; not HttpOnly. The application also receives a matching token from GET /api/v1/auth/csrf (needed because the website and API may be on different hosts) and sends it as the X-CSRFToken request header. Duration: approximately one year from when it is set, or until you clear site data. Strictly necessary for the security of the signed-in service.

3. Similar technologies. We do not use browser localStorage, sessionStorage or IndexedDB. We do not use tracking pixels, device fingerprinting or third-party SDKs to store or access information on your device. Access and refresh tokens are held only in the HttpOnly cookies described above.

4. What we do not use. No advertising cookies. No third-party tracking cookies. No non-essential analytics storage. No consent-preference cookie, because we are not collecting consent for optional categories.

5. How to control them. Sign out of the application to clear rfpv.access and rfpv.refresh. Sign out of the Django administration site to end the sessionid session. You can also delete cookies and site data in your browser settings. Blocking strictly necessary cookies will prevent sign-in or administration access from working. We do not offer a toggle to reject essential items, because they are required to provide the service.

6. Changes. If we add non-essential cookies or similar technologies we will update this policy, increase its version, and obtain any consent required by applicable law before they are set or accessed. Questions: info@rfpvenue.com.