The cookies of this house

The moment you arrive, the site tells Google that every consent is denied — statistics, advertising, user data and personalisation — as the first command your browser runs. Straight after, it loads Google’s measurement script in cookieless mode (“advanced Consent Mode”): until you choose, or if you decline, it writes nothing on your device and on every page sends Google only a short cookieless signal. That signal contains no cookies and no identifiers that last over time, but it is not anonymous: Google receives your IP address, as with any request, and uses it to derive an approximate location; it also receives browser and device type, language, date and time, consent status, the page address — including any campaign parameters you arrived with, the ad click identifier among them —, the referring page and a temporary identifier created in the page, which is not stored and changes at every full page load. Google uses these signals in aggregate form to estimate the visits and conversions it could not count without consent. If you then consent, Google may use that same temporary identifier as the value of the _ga cookie, linking the pages already seen in the current visit.

Then a bar appears at the bottom with two buttons of the same size and the same weight, “Accept” and “Reject”, and a “Preferences” link where statistics and marketing are switched on separately. Refusing costs exactly one click, the same as accepting. Closing the bar with the X in the top right corner, or with Esc, counts as a refusal: no statistics or marketing cookie is written and only the cookieless signals described above remain.

Your choice stays on your device for six months, in the ps_consent cookie. You change it or withdraw it whenever you like from the “Cookie preferences” link at the foot of every page.

For every choice we keep an anonymous receipt in our consent register, held by Netlify, Inc., the provider that hosts the site: what you chose for each category, date and time, version and fingerprint of this notice, language, page (without parameters) and a random code, ps_consent_id, which stays in your browser’s local storage and is not linked to your name, your email or your IP address. Its only purpose is to show, should anyone ever ask, that the question was put and how you answered; we keep it for five years from the choice, then an automatic procedure deletes it. If you withdraw a consent given earlier, the Google cookies already written are deleted at once and the tool already loaded stops sending any data for the rest of the visit; from the next visit the cookieless mode applies again. If you withdraw marketing, the _fbp and _fbc cookies are deleted too and the Meta pixel, if it was loaded, stops sending data at once; from the next page it is no longer loaded.

The moment you arrive, the site creates in your browser a random visit identifier (ps_vid), an identifier in the format Meta uses (fbp) and — if the address you arrived with contains the fbclid parameter — a second one (fbc); and it notes the session’s arrival data: landing page, source, campaign parameters and click identifiers (gclid, gbraid, wbraid, fbclid). Until you choose, or if you refuse, all of this lives ONLY in the browser’s session storage: no cookie, no local storage, and these identifiers are not sent to Google, to Meta, to Google Analytics or to our server (the page address, which may contain the campaign parameters, reaches Google only inside the cookieless signal described above); the “Book” link stays clean, the stay enquiry goes out without this data, no conversion and no audience. When you close the tab, it all disappears.

If you consent — even after refusing, in the same session — those same identifiers and arrival data are linked to the visit that already took place: with consent to statistics or marketing ps_vid becomes a 90-day cookie and travels on the “Book” link and in the stay enquiry; with marketing consent fbp and fbc become the _fbp and _fbc cookies (90 days) with the same values; the arrival data becomes the ps_attr entry described below. If you withdraw, the persistent copies are deleted at once.

These are the ones without which the site cannot do its job: remembering the choice you have just made, making the enquiry form work. They do not profile you and they do not ask for consent, so they cannot be switched off from here.

They count visits in aggregate form: how many people read the site, which pages, which channel they arrive from. The Google Analytics cookies (_ga and _ga_…) are written only if you consent. If you decline, Google Analytics stays loaded but writes no cookies and sends only the cookieless signals described at the top of this page. With this consent we also remember where you came from (the ps_attr entry, below) and, if you send us an enquiry or move on to the booking engine, we tie the enquiry or the booking to the visit with Google Analytics’ two pseudonymous identifiers.

They measure our advertising campaigns on Google and on Meta (Facebook and Instagram) and serve to show you relevant ads. The marketing cookies are written only if you consent; without consent Google Ads receives only the cookieless signal described at the top, in which the click identifier is redacted. With this consent Google writes the _gcl_au and _gcl_aw cookies on our domain, which link the visit to a click on one of our ads, and may link the visit to your Google account — if you have one and have turned on ad personalisation — in order to measure conversions across different devices and to build advertising audiences. Always and only with this consent, the advertising click identifier travels on the “Book” link to the booking engine and inside the stay enquiry, and the details you type in the form reach Google Ads as a fingerprint, as the privacy notice explains.

Always and only with this consent, and only on www.palazzoscotto.com, the site also loads the Meta pixel, the tool of Meta Platforms Ireland Limited that measures campaigns on Facebook and Instagram. On every page the pixel sends Meta a “page view” and, when you send us a stay enquiry, an “enquiry” (Lead): each with a random event code, the page address including any campaign parameters, the referring page, your IP address, the browser type and the values of the _fbp and _fbc cookies. The details you type in the form are neither read nor sent to Meta. Meta may link these events to your Facebook or Instagram account, if you have one, to measure the campaigns and build the audiences the ads are shown to, and may set its own cookies on its own domains. Without marketing consent the pixel is not loaded and no request leaves our site for Meta.

There is no other advertising tool beyond Google’s and the Meta pixel. There is no newsletter, so there are no cookies tied to a mailing.

Meta privacy policy

Beyond cookies, the site uses the browser’s local storage, which is a different store but still sits on your device. It saves there a copy of your cookie choice, the random receipt code ps_consent_id and — only if you consented to statistics — an entry called ps_attr with the page you came in on, where you came from and any campaign parameters present in the address, which expires after 90 days; the advertising click identifier ends up there only if you also consented to marketing. With any consent a copy of the visit identifier ps_vid (90 days) goes there too; with marketing consent Google Ads uses this storage as well (the _gcl_ls entry).

The ps_attr entry is not used for advertising: if you send us a stay enquiry it travels attached to the enquiry, so we can tell which channel produced it, and its campaign parameters are added to the “Book” link to the booking engine. If you refuse or withdraw statistics, it is not created or it is deleted. Everything is also cleared by clearing the site data in your browser settings.

On the “Location” page a Google Maps map is embedded, because getting here by car deserves a real map. When that page loads, Google receives your IP address and may set its own cookies on its own domains, under its own privacy notice. It is the only third-party content embedded in the site.

Google privacy notice

The form for asking for a quote, present on every page, is the Mr PRENO service by TITANKA! S.p.A. and is loaded from the forms.mrpreno.net domain. It sets a technical cookie of its own to recognise enquiries already sent and avoid duplicates.

The Mr PRENO privacy notice

The “Book” button takes you to booking.bedzzle.com, which is a different site from ours. Only with your consent does the link carry the visit identifier ps_vid, the campaign parameters, the technical identifier _gl with which Google Analytics recognises the same visit on both sites, the visit’s two pseudonymous Google Analytics identifiers (ga_cid and ga_sid, only with statistics consent) and, with marketing consent, the advertising click identifier; without consent the link is clean. The cookies you meet there are not ours and this page does not govern them: the privacy notice and the choices of that service apply.

Beyond the bar on this site, every browser lets you block or delete cookies from its own settings, usually in the privacy section. Blocking them all, however, can break functions on this and on any other site: the simplest way to change your mind here remains the “Cookie preferences” link at the foot of the page.

If we add or remove a tool, we update this table and change the date you read at the top.