Cookie Policy

1. The banner

On the first visit the website uses nothing that is not technical. A banner asks the guest whether they accept statistics (the map is not in the banner: it loads only if the guest presses its button, which explains what happens; section 2.8 of the Privacy Policy):

• the buttons to accept and to reject look the same; closing the banner with the X counts as rejecting, and browsing continues without tracking;
• the choice can be made by category, and at the start every option is off;
• scrolling the page does not count as consent;
• the choice is remembered for 6 months, both yes and no; then the banner appears again. Earlier only if something important changes (for example a new provider) or if the guest clears the browser data;
• the guest can change their mind at any time from the “Cookie preferences” link at the foot of the pages of the website.

1.1 Proof of the choice

To be able to demonstrate the choice (Art. 7(1) GDPR), the website stores in the browser a random code with the choice, the date and the banner version, and sends the same items to the data controller's register (Supabase, section 4 of the Privacy Policy). It does not store the IP address, the name or other browser data. Register entries are deleted after 12 months (section 6 of the Privacy Policy). The data controller also keeps a copy of every version of the banner.

2. Technical tools (always active, no consent needed)

2.1 i18nextLng

• Type: localStorage.
• Set by: the website.
• Purpose: remembering the chosen language.
• When: straight away.

2.2 rib:consenso

• Type: localStorage.
• Set by: the website.
• Purpose: remembering the choice made in the banner (random code, choice, date, version) for 6 months.
• When: when the choice is made.

2.3 rib_map_manual_optin

• Type: sessionStorage.
• Set by: the website.
• Purpose: remembering that the guest has opened the map; it is deleted when the tab is closed or with “Hide map”.
• When: on clicking the map button.

2.4 rib:checkoutLang and rib:checkoutSession

• Type: sessionStorage.
• Set by: the website.
• Purpose: bringing the guest back to the right language and booking after payment.
• When: when the guest goes to pay.

2.5 Cloudflare storage (Turnstile)

• Name: cf.turnstile.u.
• Type: localStorage, in the Cloudflare box (not on the website).
• Set by: Cloudflare.
• Purpose: anti-bot check (Turnstile), strictly necessary for the booking requested by the guest.
• When: at step 3 of the booking.

3. Tools used only with consent

3.1 _ga and _ga_<id>

• Type: cookie.
• Set by: Google (Google Analytics 4).
• Purpose: statistics (section 2.7 of the Privacy Policy); Google keeps the data for 2 months.
• When: only after the “yes” in the banner.

3.2 purchase_tracked_<number>

• Type: sessionStorage.
• Set by: the website.
• Purpose: making Google Analytics count a booking only once.
• When: on the confirmation page, only with consent.

3.3 Google Maps cookies

• Type: cookie.
• Set by: Google.
• Purpose: the map (section 2.8 of the Privacy Policy); Google also uses them for its own purposes, under its privacy policy (policies.google.com).
• When: only after clicking “Show map”.

4. Other websites' tools

• Payment: the payment page belongs to Stripe (checkout.stripe.com). There Stripe uses its own cookies and similar technologies, on its own domain, including to prevent fraud and verify the payment: Stripe manages them, under its privacy policy (stripe.com/privacy). The pages of the website do not load any Stripe tools.
• External links: the links to WhatsApp, Booking.com, Airbnb, Facebook and Google Maps send nothing from the website until the guest clicks on them; after the click the guest is on another website.

The website uses no other tracking tools and does no personalised advertising.