This page lists every cookie this website can set, what each one does, and which of them you get to refuse. Nothing optional is loaded before you say so — not loaded and switched off, not loaded and blocked. Not loaded.
Cookies you cannot refuse
These four are how the site works. Article 22.2 of Spanish law 34/2002 (LSSI-CE), which implements the European ePrivacy Directive, exempts what is strictly necessary to provide a service you asked for, so we do not ask permission for them — asking would imply you could say no, and the site would not function if you did.
| Name | What it does | How long | Set by |
|---|---|---|---|
csrftoken |
Stops another website submitting a booking form in your name. A random value with nothing about you in it. | One year | This site |
sessionid |
Keeps the owner signed in to the administration. Only ever set after somebody logs in, so unless you work here you will never have one. | Until the browser closes, or two weeks | This site |
django_language |
Remembers that you chose to read the site in a particular language. Set only when you use the language switcher, never before. | One year | This site |
roadstar_consent |
Remembers the choice you made about the cookies below, so we stop asking. It records the answer, the date, and which version of this page you were shown — and nothing else. | Six months | This site |
There is a certain irony in a cookie whose job is to remember that you refused cookies. It is unavoidable: the alternative is asking you again on every page.
Cookies you choose
Analytics — off unless you turn it on. If you agree, we use Google Analytics to see which pages people actually use and which ones they leave. It tells us that a page is confusing; it does not tell us who you are, and we do not use it for advertising.
| Name | What it does | How long | Set by |
|---|---|---|---|
_ga, _ga_… |
Tells one browser apart from another, so a person reading four pages is counted once rather than four times. | Up to two years | Google Analytics |
We have turned off Google's advertising features and its cross-site signals, and IP addresses are truncated before storage. Google acts as our processor; transfers to the United States are covered by the European Commission's standard contractual clauses and Google's certification under the EU–US Data Privacy Framework.
How the choice works
Until you answer, the analytics tag is not in the page at all. Not present and disabled, not loaded and then blocked — the server does not send it. That distinction is the whole point: a script that has already loaded has already told Google you were here.
- Refusing is one click, the same size as accepting, on the first thing you see. We do not hide it behind a settings screen.
- Nothing is pre-ticked. The analytics switch starts off and stays off unless you move it.
- The banner never blocks the page. Ignore it entirely and you can read the whole site; nothing optional runs.
- Changing your mind is the same one click. "Cookie settings" in the footer of every page reopens the choice, and turning analytics off deletes the cookies it set.
- Your answer expires after six months, and we ask again if this page changes in a way that matters.
What this site still does not load
No advertising or remarketing tags. No social media buttons that phone home. No embedded maps, no embedded video, no comment widget. No fonts, stylesheets or scripts from anyone else's server. With analytics refused or switched off, Google Analytics is the only third party that could load and it does not — which leaves nothing at all.
One thing you may notice in a browser console: our network provider,
Cloudflare, tries to insert its own analytics script into every page. Our
content security policy blocks it, so it never runs and sets nothing. A
blocked script from cloudflareinsights.com is that working as
intended.
Cloudflare does sit between you and our server, and therefore sees your IP address in order to route and protect the connection. That is described in the privacy policy.
Refusing or deleting them in your browser
Every browser lets you see, block and delete cookies, usually under Privacy
or Site settings. You can block ours without being asked to. Blocking
csrftoken will stop the booking form working, because the form
refuses to submit without the token that proves it came from this site — that
is the protection doing its job, not a fault.
Changes
If we add anything else that requires consent, this page changes first, the version at the bottom changes with it, and everyone is asked again. We will not add a tracker quietly.
Version 2026-08-20b, in force since 20 August 2026. Earlier versions are kept, so a booking can always be shown the wording it was made under.