Cookie Policy
Last updated: 23 October 2026
1. About this policy
This Cookie Policy explains how Maysa B.V. uses cookies and similar storage or access technologies on maysaunderwear.co.uk, what is currently known about those technologies, and how you can record or change a choice.
Maysa B.V. is registered with the Dutch Chamber of Commerce under number 42097847. Our legal address is Da Costastraat 119 O, 1053ZK Amsterdam, the Netherlands. You can contact us at iris@maysaunderwear.co.uk.
This policy should be read with our Privacy Policy.
2. What cookies and similar technologies are
Cookies are small text files stored on your device. Websites can also use pixels, tags, local storage, session storage and other technologies that store information on, or access information from, your device. In this policy, “cookies” includes those similar technologies unless the context requires otherwise.
3. Why these technologies are used
- Store operation and requested functions: to provide the storefront, remember consent or localisation choices, maintain a cart, support sign-in, checkout, payment security and fraud prevention, or provide another function requested by you.
- Preferences: to remember optional choices about how the store appears or works.
- Analytics: to measure interactions with the store and understand or improve its use.
- Marketing and attribution: to measure campaigns, attribute visits or sales, build audiences, personalise advertising or recognise activity across services.
A technology is not exempt from consent merely because it is described as essential or functional. Its legal treatment depends on its actual purpose, configuration and the applicable UK storage and access rules.
4. Your choice and the current verification boundary
The storefront presents a Cookiebot interface with options to manage preferences, accept all or decline all. You can reopen that interface through “Cookie settings” in the website footer.
This policy provides information; it is not itself a technical consent control. It does not block, enable or remove a technology, and publishing this policy does not correct any consent-control defect.
Our intended rule is that a technology requiring consent should not be enabled before the relevant consent is recorded. We are not claiming that this rule is currently enforced in every UK session. In a fresh clean-session test from the Netherlands on 23 October 2026, Microsoft Clarity activity and multiple analytics or marketing identifiers were observed before a choice was recorded. Equivalent clean-session testing from Great Britain has not been completed on the current live theme. Transparency about that observation does not make any consent-required pre-choice storage or access lawful.
5. Changing or withdrawing your choice
You can review or change your recorded choice by selecting “Cookie settings” in the website footer. A refusal or withdrawal is intended to stop future non-exempt use covered by that choice, but that outcome has not been re-verified from Great Britain on the current live theme. Withdrawal does not affect processing that was lawful before withdrawal. We do not claim that withdrawal immediately deletes every cookie or storage object previously placed on your device.
6. Current storefront technology inventory
This inventory is based on the current live Shopify theme, current app-embed settings and read-only public observations. “Observed” means detected in the stated test; it is not a legal classification. Generated names can vary. Durations are stated only where supported by the current theme inventory or provider documentation; otherwise they are shown as not independently verified.
| Provider or party | Technology | Purpose and current status | Duration |
|---|---|---|---|
| Cookiebot |
CookieConsent and Cookiebot scripts |
Records and presents the customer consent choice. Active on the storefront. | The exact live consent-record duration has not been independently verified. |
| Shopify |
_shopify_essential and related store, privacy and session state |
Core storefront, privacy, session and requested commerce functions. Active. | Shopify documents a maximum of one year for _shopify_essential. Generated session keys can last for the browser-tab session. |
| Shopify | localization |
Remembers country or language selection. Active. | The exact live duration is not stated here because available provider-source records conflict. |
| Shopify |
_shopify_analytics, shopify_client_id and generated web-pixel or runtime keys |
Shopify analytics and platform measurement. Observed before a recorded choice in the Netherlands test; Great Britain pre-choice behaviour is untested on the current live theme. | Shopify documents a maximum of one year for _shopify_analytics. The duration of shopify_client_id has not been independently verified; generated keys can vary or last for the browser-tab session. |
| Shopify | _shopify_marketing |
Shopify marketing consent or measurement state. Observed before a recorded choice in the Netherlands test; Great Britain pre-choice behaviour is untested on the current live theme. | Shopify documents a maximum of one year. |
| Shop / Shopify |
_shop_app_essential, Shop sign-in and cart-sync storage, including signInWithShop:* and _shs_state
|
Shop recognition, sign-in, cart synchronisation or session functions. Active or conditionally active depending on the feature used. | Some keys use local storage without an automatic browser expiry; session-storage keys last for the browser-tab session. The exact live duration of _shop_app_essential has not been independently verified. |
| Stripe |
__stripe_mid, __stripe_sid, m and Stripe scripts |
Stripe scripts loaded on the storefront, and the listed identifiers were observed before checkout. Stripe describes __stripe_mid and __stripe_sid as fraud-prevention technologies, but their exact role in MAYSA’s current storefront and checkout route has not been independently verified. |
Stripe documents __stripe_mid for one year and __stripe_sid for 30 minutes. The duration of m has not been independently verified. |
| Microsoft | Clarity requests and identifiers including _clck, _clsk, _cltk, MUID, ANONCHK, MR and SM
|
Interaction measurement and analytics. The Microsoft Clarity app embed is enabled and Clarity collection was observed before a recorded choice in the Netherlands test. | Exact live durations have not been independently verified for this storefront. |
_ga, property-specific _ga_*, _gcl_au, _gcl_ls, IDE and DoubleClick test storage |
Analytics, advertising or conversion measurement. Observed before a recorded choice in the Netherlands test; operation can depend on configuration and consent signals. | Exact live durations have not been independently verified for this storefront. | |
| Meta |
_fbp, _fbc, _fbclid and multiFbc
|
Campaign and click attribution. The current storefront code creates or maintains Meta-related attribution identifiers, and they were observed before a recorded choice in the Netherlands test. | The first-party attribution cookies created by the current storefront code are configured for up to 90 days. Local-storage entries have no automatic browser expiry. |
| TikTok |
_ttp and _ttclid
|
Campaign and click attribution. The current storefront code creates or maintains TikTok-related attribution identifiers, and they were observed before a recorded choice in the Netherlands test. | The first-party attribution cookies created by the current storefront code are configured for up to 90 days. |
_pin_unauth and _pinterest_ct_ua
|
Pinterest attribution technology. Observed before a recorded choice in the Netherlands test. Its operation can depend on the current pixel configuration and consent state. | Exact live durations have not been independently verified for this storefront. | |
| MAYSA storefront and ipify |
utm, lastExternalReferrer, lastExternalReferrerTime, _ip and _user_agent
|
Campaign, referrer and checkout attribution. The current storefront contacts the ipify IP-lookup service and stores the returned IP address in attribution storage. These technologies were observed before a recorded choice in the Netherlands test. | The first-party _ip and _user_agent cookies are configured for up to 90 days. The listed local-storage entries have no automatic browser expiry. |
| Cart Bot |
cartbot_data_cart and Cart Bot scripts |
Cart and offer functionality. The app embed is enabled and its scripts or storage were observed. | Local storage has no automatic browser expiry; the provider-controlled duration has not been independently verified. |
| Loox | Loox scripts and review requests | Product ratings and reviews. The app embed is enabled and Loox resources were observed. | No Loox cookie duration is stated because no exact Loox storage identifier and duration were verified in this inventory. |
7. Klaviyo
Klaviyo may be used for email delivery, email flows and email engagement. Its onsite storefront app embed is disabled in the current live Shopify theme, and no Klaviyo storefront resource or Klaviyo-named storage was observed in the current public-page test. This is a bounded current finding, not a claim that Klaviyo is absent from email processing, every route or historical activity.
8. Checkout on another domain
The store may move you to another domain to complete checkout or payment. That domain may use its own cookies or similar technologies and may present separate information or controls. A choice recorded on the storefront does not necessarily control storage or access on a separate checkout domain. The complete storage, recipient, duration and consent position for the external checkout has not been verified, so this policy does not claim that storefront consent is inherited there.
9. Third-party access
Depending on the technology, route, configuration and recorded choice, information may be accessible to Shopify, Shop, Cookiebot, Stripe, Microsoft, Google, Meta, TikTok, Pinterest, ipify, Cart Bot, Loox and providers supporting store or checkout functions. Our Privacy Policy explains how personal information is used and disclosed. A provider’s own notice can provide additional detail but does not replace information or consent required from us.
10. Updates
We may update this policy and inventory when the store, providers, purposes, durations or evidence change. We will show the updated date and request a new choice where required.
11. Contact
Maysa B.V.
Da Costastraat 119 O
1053ZK Amsterdam
The Netherlands
Email: iris@maysaunderwear.co.uk
Dutch Chamber of Commerce (KvK): 42097847