Version 5. Last updated: 25 October 2026.
We use cookies and similar browser storage to run and protect the shop and, only with your permission, measure which websites and campaigns lead to orders. Rejecting optional source-attribution cookies does not stop you browsing, using your account or buying parts.
Your choice
The consent panel offers Accept optional, Reject optional and Preferences. Necessary functions stay active. Optional source attribution is off until you choose to allow it. Use the Cookie preferences button to change or withdraw your choice at any time. Merely browsing, buying a product or agreeing to sales terms is not cookie consent.
Necessary storage
WooCommerce and WordPress use storage for the basket, requested account access and security. Complianz and WP Consent API remember and communicate your cookie choices. These functions are separate from optional source attribution. Some items are created only after you use the relevant feature.
| Technology | Purpose | Documented default or configured lifetime |
|---|---|---|
woocommerce_cart_hash, woocommerce_items_in_cart | Keep basket information consistent. | Session. |
wp_woocommerce_session_* | Connect your browser to its shopping session. | Normally 2 days. |
| WordPress login and test cookies | Check cookie support and recognise a signed-in customer. | Depends on the login session and any Remember me choice. |
cmplz_* | Remember cookie choices and policy settings. | Configured for up to 365 days. |
wp_consent_* | Pass the selected consent categories to compatible store functions. | Configured for 30 days; renewed when the choice is written again. |
| Basket fragments in browser storage | Keep the basket display up to date. | Depends on the shopping session and browser storage mechanism. |
The basket and checkout also use local storage, including storeApiCartData, storeApiCartHash, storeApiNonce and wc_cart_hash_*, to retain basket data and validate requests. Session storage, including wc_fragments_*, keeps the basket display consistent. Local storage may remain until updated, removed by the store or cleared in your browser; session storage normally ends when the tab closes.
The tables describe documented defaults or stated store settings, rather than measurements of your browser. They do not mean every listed item is placed on every page. The storage used and its expiry can vary with the feature, browser and provider changes.
Payment and security technologies
Stripe provides our card-payment tools and fraud-prevention technology, including Radar. When Stripe’s tools load, they may use cookies and similar technologies and send device and activity information to Stripe to support payments, authentication, bot detection and fraud prevention. This can include IP address, browser and device characteristics, and indicators such as time spent on pages and interaction with payment fields. Collection can occur before a payment is completed.
Stripe may also load hCAPTCHA to detect automated activity and obtain additional security signals. Where that service is used, its processing supports the payment-security checks. This does not mean that a visible challenge appears for every visitor.
Payment-security cookies can include __stripe_mid (one year), __stripe_sid (30 minutes), Stripe’s m (provider default two years, subject to shorter browser limits), and Cloudflare’s __cf_bm used by hCAPTCHA (30 minutes). These are provider lifetimes from setting or refreshing; the browser may apply a shorter expiry.
Our source-attribution cookie choice is separate from Stripe’s payment and security functions. Agreeing to sales terms or using a payment method does not give permission for optional marketing tracking. Stripe offers technologies for different purposes; naming Stripe here does not classify every Stripe cookie as necessary. See Stripe’s Privacy Policy and Cookie Policy for its data practices, storage purposes and provider information.
Optional source attribution
With permission, WooCommerce’s Sourcebuster integration records referral or campaign details, entry pages, visit timing, device information and session page views. If you place an order, source information can be linked to that order in our store. We use it to understand which sources lead to purchases and assess marketing effectiveness. This is not anonymous aggregate-only measurement, a newsletter subscription or permission to send marketing emails. No advertising-network integration has been configured as part of this setup.
| Cookie | Purpose | Documented default |
|---|---|---|
sbjs_session | Track the current visit/session for source attribution. | 30 minutes. |
sbjs_current, sbjs_first | Store current and first source information. | Session. |
sbjs_current_add, sbjs_first_add | Store supporting visit/entry details. | Session. |
sbjs_udata, sbjs_migrations | Support visitor/source information and the attribution cookie format. | Session. |
These first-party cookies support our own store’s attribution function; using the Sourcebuster library does not by itself mean an advertising network receives the information. Cookie expiry is separate from retention of source information already saved against an order. Identifiable order-source information is identified for review 90 days after it was recorded, for deletion or effective anonymisation through our quarterly manual review. This is not an automatic deletion setting or a 90-day cookie lifetime. Any continuing retention needs a specific, documented lawful reason; necessary financial records are assessed separately. See our Privacy Policy for the full retention approach, withdrawal and data-rights requests.
Removing cookies and changing your mind
You can reject optional source attribution through Cookie preferences, or manage stored cookies in your browser. Blocking necessary cookies may prevent login or the basket from working. If you use another device or browser, you may need to make your choice there too.
Withdrawal stops further optional tracking based on that consent. If you want us to locate source information already attached to an order, email us with the order reference. Necessary order and accounting records are considered separately from optional attribution.
Optional live chat
tawk.to loads only after you select Start chat in our separate notice. This choice is made again on each new page and does not accept optional source attribution. The chat service stays loaded on that page until you reload or leave it. Reloading without starting chat again prevents it from loading again on that page.
Once chat loads, tawk.to can use cookies, local storage and session storage to maintain the connection and recognise a chat session. For provider storage details and documented lifetimes, see tawk.to’s cookie information. The items used depend on the chat features and browser.
Chat storage can include TawkConnectionTime and twk_idm_key session cookies, a twk_uuid_* cookie lasting up to six months, twk_* and twk_token_* local-storage entries, and a previousNav session-storage entry. Browser settings may shorten these periods. Local-storage entries have no automatic cookie expiry and can remain until cleared or removed by the service.
Cookie preferences manages source attribution separately; it does not unload an already-started chat. Closing chat or reloading does not delete stored cookies or chat records. You can manage browser storage in your browser settings and email us for privacy or deletion requests. Chat-record retention is separate from cookie expiry; see our Privacy Policy.
Questions
Email sales@hvacentralparts.co.uk. The operator is HVACentral Parts. Our Privacy Policy explains how we handle information, and our Contact page gives the correspondence and returns address. There are no customer visits or collections.