1. Purpose
This policy explains how the Research Ethics Association (REA) uses cookies and similar storage and access technologies on www.ethics-association.org.
It explains the types of technology that may be used, their purposes, how long they may remain on a device, when consent is required and how visitors can manage or withdraw their choices.
REA is responsible for deciding how cookies and similar technologies are used on its website. The website is currently built and hosted using Wix.
2. Scope
This policy applies to the REA website, its member and login functions, forms, event or payment functions, embedded content, and any third-party service or integration that stores information on, or accesses information from, a visitor’s device.
It applies to cookies and comparable technologies, including tags, scripts, pixels, web storage, device identifiers and similar tools. It does not govern cookies placed by a separate website after a visitor follows an external link from the REA website
3. Definitions
4. Roles and responsibilities
5. Policy requirements
5.1 What cookies do
Cookies can support security, page delivery, account login, accessibility or display preferences, forms, payments, performance measurement and website analytics. Some cookies are placed directly through REA’s website; others may be placed by Wix or another service used on the website.
The fact that a cookie is useful or convenient does not automatically make it strictly necessary. REA will categorise each technology according to its actual purpose.
5.2 Consent and permitted exceptions
REA will provide clear and accessible information about the cookies and similar technologies it uses. REA will obtain valid consent before using a technology that requires consent under the Privacy and Electronic Communications Regulations 2003 (PECR). Consent must be freely given, specific, informed and indicated by an unambiguous positive action.
Non-essential technologies requiring consent must not be activated before the visitor has made a choice. Continuing to browse, silence, inactivity or a pre-selected option will not be treated as consent.
Consent is not required where a technology is strictly necessary to transmit a communication or provide an online service requested by the user. REA will still provide information about these technologies.
PECR also provides limited exceptions for specified low-risk purposes, including certain statistical uses intended to improve the service and certain appearance or functionality preferences. REA will rely on one of these exceptions only after documenting that all legal conditions are met, providing clear information and offering a simple and free means of objecting. If the conditions are not met, consent will be obtained.
5.3 Categories used by REA
5.4 Essential Wix technologies
Wix may place essential cookies to provide security, stability, API protection, rendering and other core website functions. The current standard Wix cookies known at the date of this draft are listed in Annex A. A particular cookie may not appear during every visit because this can depend on the page, device, browser and feature used.
A website feature must not be labelled essential merely because it is useful to REA. The Website Administrator must check the purpose of each technology against the applicable legal exception.
5.5 Accounts, forms, events and payments
Where a visitor creates an account, logs in, submits a form, registers for an event or uses a payment feature, Wix or the relevant service provider may set cookies needed to complete that request securely. Cookies that are not necessary for the requested function must remain subject to the appropriate consent or objection control.
REA will not state that it uses account, survey, shopping or payment cookies unless the relevant function is actually available on the website.
5.6 Analytics
The previous 2022 website notice stated that REA used Google Analytics. REA must confirm through its Wix settings and live cookie audit whether Google Analytics is currently enabled before this policy is published.
If Google Analytics is enabled, the relevant cookies and configuration must be shown in Annex A and in the website’s cookie controls. Unless REA has documented that every condition of a PECR exception is satisfied, Google Analytics must not set cookies before the visitor has consented. REA will not use analytics information for targeted advertising unless this is separately disclosed and consented to.
5.7 Third-party services and embedded content
Pages may include services or content supplied by another organisation, such as an embedded video, event platform, payment service or social-media feature. These services may attempt to set their own cookies or similar technologies.
Before adding or enabling a third-party service, REA will identify the provider, purpose, technology, category, expiry period, personal-data processing, international transfers and required consent mechanism. Non-essential content should be blocked until the required choice has been made.
5.8 Cookie banner and visitor choices
The website will provide a cookie banner or comparable control when this is required. The control must:
-
give clear information about the available categories and purposes;
-
allow visitors to accept or reject non-essential technologies;
-
make rejecting non-essential technologies as straightforward as accepting them;
-
allow visitors to make category-specific choices where appropriate;
-
avoid pre-selected consent and misleading wording or design;
-
record choices for an appropriate period;
-
provide an accessible way to reopen the settings and withdraw or change a choice; and
-
request a fresh choice where a material change makes the previous choice no longer sufficiently informed.
Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal. Essential services may continue to use technologies falling within an applicable legal exception.
5.9 Browser and device controls
Visitors can also use browser or device settings to view, delete or block cookies. Blocking all cookies may prevent account login, security or another requested feature from working correctly. REA will not advise visitors to leave all cookies enabled if they are unsure.
Browser controls do not replace REA’s responsibility to provide information and obtain consent or offer an objection mechanism where required.
5.10 Personal data
Where information collected through cookies or similar technologies is personal data, REA will also comply with the UK GDPR and Data Protection Act 2018. This includes identifying the purpose and lawful basis, limiting collection, protecting the data, setting an appropriate retention period and providing the information required in REA’s Privacy Policy.
Consent required under PECR and the lawful basis required for processing personal data under the UK GDPR are related but separate compliance questions. Both must be addressed.
5.11 Auditing and changing website technologies
The Website Administrator will complete a cookie audit at least annually and before or promptly after a significant website change. The audit must identify:
-
the name and provider of each technology;
-
whether it is first party or third party;
-
its actual purpose and category;
-
the information stored or accessed;
-
whether personal data is processed or shared;
-
its duration;
-
the consent requirement or documented exception relied on; and
-
whether the policy, banner and live controls remain accurate.
A new app, tag, code, embedded service or integration must not be enabled until this review has been completed. Unnecessary cookies must be removed. Annex A and the live cookie information must be updated whenever use changes.
5.12 Contact details
Questions or concerns about this policy may be sent to:
Research Ethics Association
47 Newlyn Crescent
Puriton
Somerset
TA7 8BS
Email: admin@ethics-association.org
Website: www.ethics-association.org
A person may also raise a data-protection concern with the Information Commissioner’s Office. Information about doing so is available at www.ico.org.uk.
6. Concerns and breaches
Anyone who believes that this policy has not been followed, or who becomes aware of a possible breach, should report the matter promptly to info@ethics-association.org. The email should be marked ‘Confidential – policy concern’ and should include enough information for the concern to be understood.
REA will consider the concern promptly and handle it sensitively. Information will be shared only with those who need it to review and respond. The Chair will normally oversee the response. If the concern involves the Chair, it will be handled by the Vice-Chair or another unconflicted trustee.
Where a breach is found, REA will take proportionate action. This may include stopping a technology, correcting the public information, resetting consent choices, deleting information where appropriate, reviewing a third-party service, improving website controls or reporting the matter where REA has a legal or regulatory duty to do so.
No person will be disadvantaged for raising a genuine concern in good faith. Serious or repeated breaches will be reported to the Board.
7. Review and document control
The policy owner will review this policy annually and sooner following a significant website change, the introduction of a new technology or provider, a relevant change in law or regulatory guidance, a complaint or breach, or evidence that the policy or website controls are inaccurate.
Substantive changes must be approved by the Board before they take effect. The approved master copy must be stored in the location shown on the front page, the Master Policy Register must be updated, and the current public version must be published on the website. Printed or downloaded copies are uncontrolled.
Related external guidance
-
Information Commissioner’s Office: Guidance on the use of storage and access technologies, finalised 29 April 2026.
-
Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended.
-
Data (Use and Access) Act 2025.
-
UK General Data Protection Regulation and Data Protection Act 2018.
-
Wix Help Centre: Cookies and Your Wix Site.
-
Google Analytics Help: GA4 cookie usage on websites, if Google Analytics is enabled.