Cookie Policy

Last updated: October 2026

This page tells you, plainly, which cookies the site uses and what you get to decide. The short version: the technical cookies that make it work are always there; the analytics and marketing tools are active, but they write nothing until you say yes through the banner. One exception, declared in the list below: the ad click codes (e.g. gclid, fbclid), noted first-party to know which campaign brought the booking — they identify the click, not you.

Today: technical cookies always, the rest only with your yes

The site loads the technical cookies, the ones it needs to work, for which no consent is required. Google Analytics, Google Ads, the Meta Pixel with its Conversions API and the Google Tag Manager container are active in Google Consent Mode, with every signal denied by default: on your first visit a consent banner appears, and analytics and marketing cookies arrive only after you accept. If you refuse, only the technical ones remain — and the site works all the same.

What cookies are, in a nutshell

Small files your browser saves on your device while you browse; similar technologies, such as the browser's local storage, do the same job. They make the site work, remember a few preferences and — if and when activated, with your consent — count visits and tell us whether campaigns are working.

Three families

Technical (necessary): they make the site work — language, session, security. No consent needed; without them, some features would stop working.
Analytics: with your consent, they tell us in aggregate form how the site is used, so we can improve it. Visits may also be counted together with those of the Palazzo Scotto site, the brand of the same company, in a group Google Analytics property, once it is active. They arrive only if you consent through the banner.
Marketing: with your consent, they measure whether our Google, Meta and ChatGPT (OpenAI) campaigns work and make messages more relevant. They arrive only if you consent through the banner.

The list, one by one

NEXT_LOCALETechnical
Provider
This site (next-intl)
What it's for
Remembers the language you chose, so we don't ask on every page.
Duration
6 months
nos_lang_sceltaTechnical
Provider
This site
What it's for
Marks that you chose the language yourself (from the selector or the language suggestion), so the suggestion doesn't come back.
Duration
6 months
nos_consent_choiceTechnical
Provider
This site
What it's for
Keeps your cookie choice, so you never have to repeat it. It appears when you make your choice in the consent banner.
Duration
12 months
Turnstile (Cloudflare)Technical
Provider
Cloudflare
What it's for
Cloudflare's anti-bot check on our forms (e.g. booking) may set a short-lived technical token or cookie to tell people from bots and stop spam and abuse. No marketing involved.
Duration
Session / short-lived
nos_click_idsMarketing
Provider
This site
What it's for
Notes down, first-party, the advertising parameters carried by the link to attribute the booking to the right campaign; the value may also live in the browser's local storage and is not passed to third parties. The click codes alone (e.g. gclid, fbclid) — which identify the click on the ad, not the person — are noted always, on the basis of our legitimate interest in measuring our own campaigns; everything else (e.g. utm, browser identifiers such as _fbp/_fbc) is noted only with your marketing consent.
Duration
90 days
Session and security cookiesTechnical
Provider
This site
What it's for
Keep the session standing and protect browsing (e.g. anti-abuse).
Duration
Session
Plateform widget cookiesTechnical
Provider
Plateform
What it's for
Technical cookies from the booking widget, when shown: it needs them to work.
Duration
Variable (set by Plateform)
Bedzzle widget cookiesTechnical
Provider
Bedzzle
What it's for
Technical cookies from Palazzo Scotto's availability-search widget on the "Beyond the Table" page: it loads only when you use the form, and it needs them to work.
Duration
Variable (set by Bedzzle)
_ga, _ga_VMKT4HEVGHAnalytics
Provider
Google Analytics
What it's for
Aggregate statistics on site use. Set only with analytics active and with consent.
Duration
Up to 24 months
_glAnalytics
Provider
Google Analytics
What it's for
Parameter that, once the group property is active, will be added for a few moments to our links between this site and www.palazzoscotto.com: it will carry the random code of the shared statistics to the other site, so the two visits are linked. It travels in the page address and does not stay on your device. Only with consent to statistics.
Duration
2 minutes
grp_ga, grp_ga_<ID>Analytics
Provider
Google Analytics
What it's for
Statistics shared by the two sites of the same company, NOS and Palazzo Scotto, in the group Google Analytics property, once it is active: the same random code on both, to count the people who visit both. Only with consent to statistics.
Duration
14 months (on Safari, 7 days at most)
_gcl_*Marketing
Provider
Google Ads
What it's for
Attributes Google campaign conversions. Set only with marketing active and with consent.
Duration
Up to 90 days
_fbp, _fbcMarketing
Provider
Meta
What it's for
Measurement and attribution of Meta (Facebook/Instagram) campaigns. Set only with marketing active and with consent.
Duration
Up to 90 days

Name	Provider	What it's for	Category	Duration
NEXT_LOCALE	This site (next-intl)	Remembers the language you chose, so we don't ask on every page.	Technical	6 months
nos_lang_scelta	This site	Marks that you chose the language yourself (from the selector or the language suggestion), so the suggestion doesn't come back.	Technical	6 months
nos_consent_choice	This site	Keeps your cookie choice, so you never have to repeat it. It appears when you make your choice in the consent banner.	Technical	12 months
Turnstile (Cloudflare)	Cloudflare	Cloudflare's anti-bot check on our forms (e.g. booking) may set a short-lived technical token or cookie to tell people from bots and stop spam and abuse. No marketing involved.	Technical	Session / short-lived
nos_click_ids	This site	Notes down, first-party, the advertising parameters carried by the link to attribute the booking to the right campaign; the value may also live in the browser's local storage and is not passed to third parties. The click codes alone (e.g. gclid, fbclid) — which identify the click on the ad, not the person — are noted always, on the basis of our legitimate interest in measuring our own campaigns; everything else (e.g. utm, browser identifiers such as _fbp/_fbc) is noted only with your marketing consent.	Marketing	90 days
Session and security cookies	This site	Keep the session standing and protect browsing (e.g. anti-abuse).	Technical	Session
Plateform widget cookies	Plateform	Technical cookies from the booking widget, when shown: it needs them to work.	Technical	Variable (set by Plateform)
Bedzzle widget cookies	Bedzzle	Technical cookies from Palazzo Scotto's availability-search widget on the "Beyond the Table" page: it loads only when you use the form, and it needs them to work.	Technical	Variable (set by Bedzzle)
_ga, _ga_VMKT4HEVGH	Google Analytics	Aggregate statistics on site use. Set only with analytics active and with consent.	Analytics	Up to 24 months
_gl	Google Analytics	Parameter that, once the group property is active, will be added for a few moments to our links between this site and www.palazzoscotto.com: it will carry the random code of the shared statistics to the other site, so the two visits are linked. It travels in the page address and does not stay on your device. Only with consent to statistics.	Analytics	2 minutes
grp_ga, grp_ga_<ID>	Google Analytics	Statistics shared by the two sites of the same company, NOS and Palazzo Scotto, in the group Google Analytics property, once it is active: the same random code on both, to count the people who visit both. Only with consent to statistics.	Analytics	14 months (on Safari, 7 days at most)
_gcl_*	Google Ads	Attributes Google campaign conversions. Set only with marketing active and with consent.	Marketing	Up to 90 days
_fbp, _fbc	Meta	Measurement and attribution of Meta (Facebook/Instagram) campaigns. Set only with marketing active and with consent.	Marketing	Up to 90 days

Analytics and marketing cookies appear on your browser only after your consent through the banner: until you accept, they do not exist. The durations shown are typical values set by the respective providers.

Google Tag Manager

It is a tag container and runs in Google Consent Mode with every signal denied by default: it sets no analytics or marketing cookie until you say yes through the banner.

Server-side measurement, in plain words

To understand which campaigns truly bring bookings — and only with your marketing consent — the site notes down, first-party, the advertising parameters carried by the link (Google's gclid, Meta's fbclid, the ChatGPT Ads click code) and passes them, together with a few contact identifiers, to a component working on the servers (a Worker on Cloudflare). It is this component that reports conversions to the advertising platforms, server to server: Meta's Conversions API and Google Ads' Enhanced Conversions. Email and phone leave only in hashed form (SHA-256): the platforms receive an encrypted fingerprint, never the data in the clear. For campaigns on ChatGPT (OpenAI) the conversion instead leaves directly from the site, again server to server: with no email, phone or name, only the ad click code and a booking identifier in the form of a salted hash. And the actual purchase conversion never starts from your browser: it is born server-side from the confirmed booking, with an identifier that prevents double counting. Your marketing consent is either a yes to the Marketing category in the banner or the optional box in the booking form, “Also fine for measuring our ads with our advertising partners: Google, Meta and OpenAI (ChatGPT)”, which is never pre-ticked and is not needed to book. Without your marketing consent, none of this happens at all. You withdraw the banner's yes through “Cookie preferences”, and the box's yes by writing to nosristorante@palazzoscotto.com.

Changing your mind, any time

On your first visit a banner lets you choose: accept all non-essential cookies, reject them all, or decide category by category (the necessary ones stay always on). Your choice is recorded, and you can revisit or withdraw it at any moment through the "Cookie preferences" link at the bottom of the site. Consent given with the box in the booking form, which applies to that booking, is withdrawn by writing to nosristorante@palazzoscotto.com: from then on we will no longer use it, without affecting what has already been done. At any time you can also block or delete cookies from your browser settings — knowing that, without some technical ones, a few site features might limp along.

Outside Europe

Some providers of the tools in use (Google, Meta, OpenAI) are based in the United States. Any transfers — only with your consent — rest on the Standard Contractual Clauses (EU Dec. 2021/914) and, where the provider is certified, on the EU-US Data Privacy Framework. The full picture is in the Privacy Policy.

If this page changes

It will change when the site does — for instance if new tools arrive. The date at the top always tells you where we stand.