Cookie policy

Cookie policy

Effective Date: 26 October 2026

This cookie policy explains how the brand whose website you are visiting ("we", "us", "our") uses cookies and similar technologies in its digital services. It should be read together with our Privacy Policy. If you have questions about this policy, contact us at [email protected].

1. What Are Cookies

1.1. Cookies are small text files stored on your device when you visit a website or use a web application. They help the service remember your actions and preferences.

1.2. Similar technologies include local storage, session storage, pixels, and device identifiers, which serve comparable purposes. In this policy, "cookies" covers all of them.

2. Cookie Categories

2.1. Necessary cookies are required for our services to work and to keep them secure. They are always on and cannot be switched off.

2.2. Marketing cookies help us measure whether our advertising leads to visits, sign-ups, bookings, and purchases. They are used only if you give your consent, and only on websites where we work with an advertising partner.

2.3. We do not use analytics cookies. We do not use tracking pixels or web beacons in our emails, and we do not track whether you open an email. For links in our newsletters, we count how many times each link is clicked in total, without recording who clicked it and without setting a cookie.

3. Necessary Cookies

3.1. The necessary cookies we set ourselves:

- Name: orbit-session. Purpose: maintains your session, including your login state and security tokens. Expiry: 2 hours after your last activity. - Name: XSRF-TOKEN. Purpose: protects against cross-site request forgery. Expiry: 2 hours after your last activity. - Name: remember_web_ followed by a fixed code. Purpose: keeps you signed in on this device; set only when you sign in. Expiry: 12 months, or when you sign out. - Name: guest_locale. Purpose: remembers the language you chose. Expiry: 12 months. - Name: load balancing. Purpose: routes you to a healthy server for reliable delivery. Expiry: when you close your browser. - Name: orbit_consent. Purpose: records your cookie choice and the policy version it was made against, so we can respect it without asking on every visit. Expiry: 12 months.

3.2. We also keep a few settings in your browser's storage. Local storage holds your light or dark display choice (until you clear it), that you dismissed a notice (7 days), and an unfinished party booking request so you do not lose it (30 days, or until you send it). Session storage holds short-lived technical markers, for example to avoid reporting the same visit twice; it is cleared when you close the tab.

3.3. Our payment processor (Nets) may set cookies that are strictly necessary to process payments securely. These are essential for completing transactions.

3.4. If you authenticate via social login (Google, Apple, Facebook), the provider may set cookies as part of the authentication flow.

3.5. Our security provider (Cloudflare) sets cookies that protect our services against bots and abuse:

- Name: __cf_bm. Purpose: distinguishes people from automated bots. Expiry: 30 minutes. - Name: cf_clearance. Purpose: remembers that your browser passed a security check, so you are not asked again. Expiry: 30 minutes.

3.6. Legal basis: necessary cookies are exempt from consent requirements under the ePrivacy Directive Article 5(3) because they are strictly necessary for the service you have requested.

4. Marketing Cookies and Partners

4.1. Marketing cookies and the partners below are used only after you have accepted marketing cookies. The legal basis is your consent (GDPR Art. 6(1)(a) and the national rules implementing the ePrivacy Directive Article 5(3)).

4.2. Meta Platforms Ireland Ltd (advertising on Facebook and Instagram). After you consent, our server sends Meta information about what happens on our website, such as viewing a page, starting a checkout, signing up, confirming a booking, or completing a purchase (Meta's Conversions API). Each event includes the page address and, for bookings and purchases, what was booked, the amount and currency, and an order reference. With each event we send your email address and phone number in hashed (irreversibly scrambled) form where you have given them to us, a hashed form of your account ID if you are signed in, your IP address, your browser's user agent, advertising click identifiers, and the browser identifier described in section 4.5. Where the site operator has enabled it, Meta's browser pixel also runs on the page and sets these cookies:

- Name: _fbp. Purpose: lets Meta recognise your browser so it can measure the results of advertising. Expiry: 90 days. - Name: _fbc. Purpose: stores the identifier of the Meta ad you clicked to reach our website. Expiry: 90 days.

Because the pixel loads from Meta's own servers, Meta can also receive cookies it has set on its own domains (such as facebook.com), for example if you are logged in to Facebook or Instagram. These are described in Meta's cookie policy (facebook.com/privacy/policies/cookies).

4.3. We and Meta are joint controllers (GDPR Art. 26) for collecting this data on our website and transmitting it to Meta. Under our agreement with Meta (facebook.com/legal/controller_addendum), we are responsible for informing you and obtaining your consent, and Meta is responsible for enabling you to exercise your rights over the data once Meta has received it. You may exercise your rights with either of us. What Meta does with the data afterwards is Meta's own responsibility.

4.4. Google Ireland Ltd (Google Ads). After you consent, Google's tag (gtag.js) loads in your browser to measure which Google ads lead to actions on our website, using Google Consent Mode to pass on your choice. Where you have given us your email address or phone number, we hash it on our server and share only the hashed value with Google to make this measurement more accurate (enhanced conversions). Google sets cookies including:

- Name: _gcl_au. Purpose: measures how ads lead to actions on our website. Expiry: 90 days. - Name: _gcl_aw. Purpose: stores the identifier of the Google ad you clicked to reach our website. Expiry: 90 days.

Google's tag can also read and set cookies on Google's own domains (such as google.com and doubleclick.net), as described at policies.google.com/technologies/ads. For measuring conversions Google acts as an independent controller; for enhanced conversions it processes the hashed contact details on our behalf.

4.5. Our own marketing cookie:

- Name: orbit_attr. Purpose: remembers the advertising click identifiers and campaign parameters from the link that brought you to our website, the first page you landed on and when, and a random browser identifier that we send to Meta with each event, so that Meta can recognise this browser across your visits even where its pixel is not used. This lets a later sign-up, booking, or purchase be attributed to the right campaign. Expiry: 90 days.

4.6. Not every website uses every partner. The cookie settings dialog lists the partners that are actually enabled on the website you are visiting. If a website has no advertising partner enabled, it uses no marketing cookies and shows no cookie banner.

4.7. Meta and Google also process this data under their own terms and privacy policies, available at facebook.com/privacy/policy and policies.google.com/privacy.

5. Your Consent

5.1. On a website that uses marketing cookies, a cookie banner is shown on your first visit. Accepting and rejecting are equally easy: both options are offered side by side.

5.2. In the cookie settings you can choose per category. Necessary cookies are always on; marketing cookies stay off unless you switch them on.

5.3. Until you have made a choice, no marketing cookie is set, no partner script is loaded, and nothing is sent to any advertising partner, neither from your browser nor from our server. If you reject marketing cookies, this remains the case.

5.4. Your choice applies to the website on which you made it. We ask you again after 12 months, and earlier if we publish a new version of this policy.

6. Withdrawing Consent

6.1. You can change or withdraw your consent at any time via "Cookie settings" in the footer of the website. Withdrawing is as easy as giving consent.

6.2. Withdrawal takes effect immediately: partner scripts are no longer loaded, nothing more is sent to advertising partners, and the orbit_attr cookie is deleted, together with the Meta and Google cookies on our website (_fbp, _fbc, and Google's _gcl_ cookies).

6.3. We cannot delete cookies that Meta or Google set on their own domains. You can delete them in your browser settings (see section 8).

6.4. Withdrawal does not affect the lawfulness of processing based on your consent before you withdrew it.

7. Consent Log

7.1. To be able to demonstrate that we respect your choice (GDPR Art. 7(1)), we keep a record each time you make or change a choice: a random consent ID, the time, your choice per category, the version of this policy, your IP address, your browser's user agent, and, if you are signed in, a link to your account.

7.2. The consent ID is also stored in the orbit_consent cookie, which links your browser to its record. We keep each record for up to 5 years, in line with the consent retention period in our Privacy Policy, and then delete it. Your IP address and browser user agent are removed from the record after 24 months.

8. Managing Cookies in Your Browser

8.1. You can also manage or delete cookies through your browser settings. Most browsers allow you to block or delete cookies, including cookies already set.

8.2. Blocking necessary cookies may prevent our services from functioning correctly. For more information, see your browser's help documentation.

9. Third-Country Transfers

9.1. Meta and Google may transfer data they receive to the United States. These transfers rely on the EU-US Data Privacy Framework, under which both companies are certified, and on EU Standard Contractual Clauses.

9.2. You may ask us for a copy of the safeguards that apply to a specific transfer.

10. Changes to This Policy

10.1. We may update this cookie policy from time to time. Changes will be reflected by the Effective Date shown at the top.

10.2. When we publish a new version, we show the cookie banner again so you can review your choice.