Cookie Notice
Get Me A Techie — Cookie Notice
Last updated: 26 July 2026 · Version 3.0
1. About This Notice
1.1 This Cookie Notice ("Notice") explains how Get Me A Techie ("we", "us", "our") uses cookies when you visit our website at getmeatechie.com or use any related applications (together, the "Service").
1.2 We have deliberately designed the Service to be as privacy-friendly as possible in its use of cookies. We set no cookies at all on visitors who are not signed in and who have not consented to advertising cookies. We use two categories of cookie: (a) strictly-necessary authentication and session cookies, set only when you sign in; and (b) advertising cookies, which we use to measure the effectiveness of our advertising and which are set only where you give your prior, explicit consent via our cookie banner. We use no cookies of any kind for a user who has neither signed in nor accepted advertising cookies.
1.3 This Notice explains what those cookies are, why we use them, and what your rights are in relation to them. It is issued in accordance with our obligations under:
(a) Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) ("PECR");
(b) The UK General Data Protection Regulation ("UK GDPR") as retained in UK law by the European Union (Withdrawal) Act 2018; and
(c) The Data Protection Act 2018 ("DPA 2018").
1.4 This Notice should be read alongside our Privacy Notice (available at https://getmeatechie.com/privacy), which sets out how we process personal data more broadly.
1.5 If you have any questions about our cookie practices, please contact us using the details in Section 11 below.
2. What Are Cookies?
2.1 Cookies are small text files that a website places on your device (computer, smartphone or tablet) when you visit it. They are stored by your web browser and may be read by the website on subsequent requests. Cookies can be used for a wide range of purposes, including keeping you signed in to an account, remembering your preferences, and — in the case of third-party cookies — tracking your browsing activity across multiple websites for advertising purposes.
2.2 Cookies can be characterised in two ways:
First-party vs. Third-party
A first-party cookie is set by the domain you are visiting (getmeatechie.com). A third-party cookie is set by a different domain — for example, by an analytics or advertising provider. The authentication and session cookies used by the Service are all first-party cookies set by us. The only third-party cookies are the Google advertising cookies described in Section 5, which are set only where you have given your consent.
Session vs. Persistent
A session cookie is a temporary cookie that is deleted from your device automatically when you close your browser. A persistent cookie remains on your device until a specified expiry date or until you manually delete it. The Service uses both session and persistent cookies, as described in the table in Section 5 below.
3. How We Use Cookies on This Service
Privacy first: The Service sets no cookies on your device until you either sign in or give your consent to advertising cookies. A visitor to any public page — the homepage, jobs listings, candidate profiles, company pages, and this Notice itself — who has not signed in and has not accepted advertising cookies receives zero cookies. Our own server sends no Set-Cookie header to such a visitor.
3.1 If you visit getmeatechie.com without signing in and without accepting advertising cookies, your device will receive no cookies from us. Our server sets cookies only at sign-in; the advertising cookies described in Section 5 are set only if you accept them via the banner.
3.2 The only cookies the Service uses are set at the point of user sign-in, and only when a user actively chooses to authenticate. These cookies are:
(a) gmat_access — an access token cookie;
(b) gmat_id — an identity token cookie;
(c) gmat_refresh — a session refresh token cookie; and
(d) gmat_pkce and gmat_state — two short-lived login-handshake cookies that exist only for the duration of the sign-in process and are automatically deleted once sign-in is complete; and
(e) gmat_ui and, for administrators, gmat_admin — non-sensitive session flags (containing no personal data and performing no tracking) that let the signed-in interface display the correct navigation.
3.3 Each of these cookies is described in detail in Section 5 below. All of them are strictly necessary for the operation of the sign-in feature. Without them, it would be impossible for a user to remain authenticated whilst using the Service.
3.4 Other than the advertising cookies described in Section 5 (which are set only where you have given your consent), we do not use cookies for any of the following purposes:
(a) analytics or performance measurement;
(b) tracking your behaviour across websites we do not operate;
(c) profiling users; or
(d) any purpose other than authentication, session management and the consented advertising measurement described in Section 5.
3.5 Where you consent to advertising cookies, we use Google Ads (a service provided by Google) to understand which of our adverts led you to sign up. This helps us spend our advertising budget effectively and keep the Service free to use. This measurement happens only after you have accepted advertising cookies; if you decline, no advertising cookie is set and no such data is collected.
3.6 Save for the Google Ads measurement described above (which occurs only with your consent), we do not share cookie data with any third-party advertisers, analytics providers, or data brokers.
4. Our Cookie Consent Banner
4.1 The strictly necessary authentication and session cookies described in Section 5 are exempt from the consent requirement under Regulation 6(4) PECR. The ICO confirms that cookies which are essential to provide a service the user has explicitly requested — such as login and session-management cookies — fall squarely within this exemption. We do not, and are not required to, ask for your consent to those cookies, and they are set only after you have actively chosen to sign in.
4.2 The advertising cookies described in Section 5 are not strictly necessary and therefore do require your prior consent under Regulation 6 PECR. We obtain that consent through a cookie banner, which is shown to you before any advertising cookie is set.
4.3 By default, no advertising cookie is set. The banner offers a clear "Accept" and "Decline" choice, presented with equal prominence, and we set advertising cookies only if you choose "Accept". This is enforced technically using Google Consent Mode: advertising storage remains denied until you consent.
4.4 You can change or withdraw your consent at any time, as easily as you gave it, using the "Cookie settings" link in the footer of every page.
4.5 We do not use pre-ticked boxes or other design choices intended to nudge you towards accepting advertising cookies, and declining is at least as easy as accepting.
4.6 We are required by Regulation 6(2) PECR to provide users with clear and comprehensive information about the cookies we use. This Cookie Notice fulfils that obligation.
5. Our Cookies — Detailed Reference Table
5.1 The following table sets out every cookie used by the Service. The authentication and session cookies are strictly necessary and require no consent. The advertising cookies are not strictly necessary and are set only where you have given consent; you may decline, or withdraw your consent, at any time.
| Cookie Name | Set When | Purpose | Party / Type | Duration |
|---|---|---|---|---|
| AUTHENTICATION AND SESSION COOKIES — Strictly Necessary — No consent required | ||||
| gmat_access | On sign-in | Stores the JWT access token issued by Amazon Cognito following a successful login. Used by the Service to authenticate each request you make while signed in, and to verify your identity and permissions. The Service cannot function for a signed-in user without this cookie. | First-party / Persistent | Short-lived (typically 1 hour; refreshed automatically by gmat_refresh) |
| gmat_id | On sign-in | Stores the JWT identity (ID) token issued by Amazon Cognito following a successful login. Used to identify you as a signed-in user and to retrieve your account profile and preferences within the Service. | First-party / Persistent | Short-lived (typically 1 hour; refreshed automatically) |
| gmat_refresh | On sign-in | Stores the refresh token issued by Amazon Cognito. Used to obtain new access and identity tokens automatically when they expire, so that you remain signed in without needing to log in again. This is the only persistent authentication cookie. | First-party / Persistent | 30 days (or until sign-out) |
| gmat_pkce | During login flow only | A short-lived cookie set during the OAuth 2.0 / PKCE authentication handshake between the Service and Amazon Cognito. Stores the PKCE code-verifier — a one-time cryptographic value that protects the login against authorisation-code interception attacks (RFC 7636). Deleted as soon as the handshake completes. | First-party / Session | Up to 10 minutes; deleted the moment login completes |
| gmat_state | During login flow only | A second short-lived cookie set during the OAuth 2.0 / PKCE authentication handshake. Stores the OAuth 2.0 state value — a random token that protects the login against cross-site request forgery (CSRF). Deleted as soon as the handshake completes. | First-party / Session | Up to 10 minutes; deleted the moment login completes |
| gmat_ui | On sign-in | A non-sensitive flag (the value "1") that lets the site's server-rendered pages know you are signed in, so the correct navigation (for example the "Dashboard" link) can be shown without reading the secure token cookies. Contains no personal data and performs no tracking. Readable by the site's own scripts. | First-party / Persistent | 30 days (or until sign-out) |
| gmat_admin | On sign-in (administrators only) | A non-sensitive flag (the value "1"), set only for administrator accounts, that lets the interface display the "Admin" link. This is only a display hint — the actual administrator authorisation check is always performed on the server. Contains no personal data and performs no tracking. | First-party / Persistent | 30 days (or until sign-out) |
| ADVERTISING COOKIES — Not strictly necessary — Set only with your consent | ||||
| _gcl_au | Only after you accept advertising cookies | Set by Google's tag as a "conversion linker". Helps us measure whether one of our adverts led you to sign up, so we can understand which advertising is effective. Set only where you have consented, and never for a visitor who declines. | First-party (set via Google's tag) / Persistent | Approximately 90 days |
| Google advertising cookies (for example IDE, test_cookie, NID), set on Google and DoubleClick domains | Only after you accept advertising cookies | Set by Google to attribute conversions and measure the performance of our adverts. These are governed by Google's own privacy policy (https://policies.google.com/privacy). | Third-party (Google) / Session and Persistent | From the end of your browsing session up to approximately 13 months |
6. Authentication Cookies and Your Privacy
6.1 The authentication cookies described in Section 5 contain JSON Web Tokens (JWTs) issued by Amazon Cognito, our identity provider. These tokens contain personal data about you as a signed-in user, including:
(a) your user identifier (a unique ID assigned to your account by Amazon Cognito);
(b) your email address;
(c) the time at which the token was issued and the time at which it expires; and
(d) your account role or access level within the Service (for example, whether you are registered as a Candidate or a Company).
6.2 This information is stored in the cookie solely for the purpose of authenticating your requests to the Service whilst you are signed in. It is not used for any other purpose.
6.3 The JWTs stored in these cookies are signed by Amazon Cognito using asymmetric cryptographic keys. This means that any attempt to alter or forge the contents of the tokens can be detected and rejected by the Service. The tokens cannot be used to access your account on any other platform.
6.4 Amazon Web Services (AWS) provides Amazon Cognito as a data processor on our behalf, under a Data Processing Addendum. AWS does not use the authentication data for its own purposes. Further details of our data-sharing arrangements with AWS are set out in our Privacy Notice.
6.5 The gmat_access and gmat_id cookies are short-lived (typically valid for one hour, as configured in our Amazon Cognito User Pool settings). When they expire, the Service uses the gmat_refresh token to obtain new access and identity tokens silently in the background, without requiring you to sign in again. The refresh token itself expires after 30 days, at which point you will be prompted to sign in again. On signing out, the access, identity and refresh tokens are revoked, and all authentication and session cookies are deleted from your device.
6.6 Lawful basis: We process the personal data contained in these authentication cookies on the basis of Article 6(1)(b) UK GDPR (performance of a contract: providing you with the signed-in functionality of the Service that you have requested) and Article 6(1)(f) UK GDPR (our legitimate interests in maintaining the security and integrity of user accounts).
7. If We Add Non-essential Cookies in the Future
Important commitment: The consented advertising cookies described in Sections 4 and 5 are the only non-essential cookies we use. If we ever introduce further non-essential cookies (for example, analytics), we will update this Notice, implement a fully PECR-compliant consent mechanism before any such cookies are set, and obtain your explicit, prior consent.
7.1 Other than the consented advertising cookies described in Sections 4 and 5, the Service uses no analytics, tracking or other non-essential cookies.
7.2 If at any future point we decide to introduce further non-essential cookies — for example, to measure how users interact with the Service — we will, before doing so:
(a) update this Cookie Notice to describe the new cookies accurately, including their names, purposes, providers and durations;
(b) implement a Cookie Management Platform (CMP) that presents a compliant consent mechanism, including a "Reject All" option that is at least as prominent as any "Accept All" option;
(c) ensure, technically, that non-essential cookies cannot be set until after a user has actively and affirmatively consented to them; and
(d) provide a means of withdrawing consent at any time that is as easy to use as the means of giving it.
7.3 We will not use pre-ticked boxes, dark patterns or other design choices intended to nudge users towards accepting non-essential cookies.
7.4 We will notify signed-in users of any material change to our cookie practices in advance of such changes taking effect, as described in Section 10 below.
7.5 We have honoured this commitment in respect of the advertising cookies now described in Sections 4 and 5, which were introduced only after this Notice was updated and a compliant consent mechanism was implemented.
8. Managing Cookies Through Your Browser
8.1 In addition to the "Cookie settings" control described in Section 4, you can view, manage and delete cookies at any time through your browser settings. Most browsers allow you to:
(a) view all cookies currently stored on your device;
(b) delete individual cookies or all cookies;
(c) block cookies from specific websites; and
(d) be notified when a cookie is set.
8.2 Settings for the most common browsers:
Google Chrome: chrome://settings/cookies
Mozilla Firefox: about:preferences#privacy
Apple Safari: Preferences > Privacy > Manage Website Data
Microsoft Edge: edge://settings/privacy
8.3 General guidance on managing cookies across different browsers is available at: www.allaboutcookies.org
8.4 Please be aware that if you block or delete the authentication cookies used by the Service (gmat_access, gmat_id, and gmat_refresh), you will be signed out and will need to sign in again. Public pages of the Service (which set no cookies) will continue to work normally.
9. Your Data Protection Rights
9.1 The authentication cookies described in this Notice process personal data about you (as described in Section 6.1). In relation to that personal data, you have the following rights under UK data protection law:
(a) Right of access (Article 15 UK GDPR): the right to obtain a copy of the personal data we hold about you, including data processed through cookies.
(b) Right to rectification (Article 16 UK GDPR): the right to have inaccurate personal data corrected.
(c) Right to erasure (Article 17 UK GDPR): the right to request deletion of your personal data, subject to applicable legal exemptions. In relation to authentication cookies, this right can be exercised in practice by deleting the cookies from your browser (which signs you out) or by deleting your account (which removes all associated personal data from our systems, subject to our legal retention obligations as described in our Privacy Notice).
(d) Right to restriction of processing (Article 18 UK GDPR): the right to request that we restrict our processing of your data in certain circumstances.
(e) Right to object (Article 21 UK GDPR): the right to object to processing based on legitimate interests. In relation to authentication cookies, this right is limited because such processing is necessary to provide the signed-in service you have requested.
9.2 Full details of your rights and how to exercise them are set out in our Privacy Notice at https://getmeatechie.com/privacy.
9.3 To exercise any of the above rights, please contact us at catherine@getmeatechie.com.
10. Changes to This Notice
10.1 We may update this Cookie Notice from time to time to reflect changes in the cookies we use, changes in applicable law, or changes in guidance from the ICO.
10.2 The date at the top of this Notice indicates when it was last reviewed. We recommend that you check back periodically.
10.3 If we make any material change to this Notice — in particular, if we introduce any non-essential cookies — we will:
(a) update this Notice before the change takes effect;
(b) notify signed-in users by email or by prominent notice on the Service; and
(c) where the change requires your consent under PECR, implement a consent mechanism and obtain that consent before setting any new non-essential cookie.
11. Contact Us and How to Complain to the ICO
11.1 If you have any questions about this Cookie Notice, about the cookies we use, or about the personal data processed through those cookies, please contact us:
Get Me A Techie — Data Protection Team
Email: catherine@getmeatechie.com
11.2 If you are not satisfied with our response, or if you wish to raise a concern about our use of cookies directly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), which is the United Kingdom's independent supervisory authority for data protection and privacy rights:
Information Commissioner's Office (ICO)
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113 (local rate) | 01625 545 745 (national rate)
Website: www.ico.org.uk
Report a concern: https://ico.org.uk/make-a-complaint/
PECR complaints: https://ico.org.uk/make-a-complaint/data-protection-complaints/
11.3 Complaints to the ICO relating to cookies are assessed under PECR, which is enforced separately from the UK GDPR. The ICO has the power to investigate complaints, issue enforcement notices and impose monetary penalties under PECR.
This Cookie Notice was last reviewed and approved on 26 July 2026 by Catherine Welling, Founder
© Get Me A Techie Ltd trading as Get Me A Techie. All rights reserved.
Questions about our use of cookies? Contact us, or email catherine@getmeatechie.com.