Cookies Policy

1. What are cookies?

Cookies are small text files stored by your browser when you visit a site. They allow us to recognise your browser on subsequent visits, keep your preferences and measure site usage.

We also use similar technologies: localStorage, sessionStorage, indexedDB.

2. Categories of cookies we use

We split them into 4 categories. "Strictly necessary" is active by default (no consent needed for the site to function); the other three are explicit opt-in:

• Strictly necessary — login session, shopping cart, CSRF token, language / visual theme / font preference, consent status. Without these the site does not work.
• Functional — the interactive map (Google Maps) embedded on pages showing the restaurant location. Without this consent you only see a link to the map, not the embed.
• Analytics — our own visitor-analytics system (first-party, runs exclusively on our own servers — NOT Google Analytics). It collects: pages visited and time spent on each, clicks and submitted forms, technical page errors, device/browser/operating system, approximate location derived from your IP address, the page you came from (referrer) and campaign parameters (UTM). If you were logged into your account during the visit, we also record the account name + email, linked to that visit. At the end of the visit (after 30 minutes of inactivity) a summary is sent via an internal email to the restaurant administrator.
• Marketing — we currently do NOT use any marketing/remarketing cookie or pixel (no Google Ads, Meta Pixel, TikTok Pixel, etc.). This category exists in the banner in case we ever add such a tool — in which case we will update this page before activation and ask for your consent again.

3. Retention periods

Each category has a defined retention period:

• Login session: 30 days (extended on activity).
• Shopping cart: 7 days.
• Language / visual theme / font preference: 365 days (stored locally, in your browser).
• Cookie consent: 365 days (after which we ask again).
• Our own visitor-analytics system (the "Analytics" category): visit data is automatically deleted from our database 30 days after the session closes. The summary email sent to the administrator is NOT covered by this automatic deletion — its retention follows the restaurant's own mailbox policy.

4. How to manage your consent

On first visit you see a banner with clear options: "Accept all", "Reject all" (equivalent prominence), "Customise". No non-essential cookie is set before your choice.

• Change anytime via the "Cookies" link in the footer.
• Full withdrawal: clear cookies in your browser.
• Browser-level: you can configure your browser to block all cookies (but the site may not function normally).

5. Third-party cookies (sub-processors)

Our own visitor-analytics system (the "Analytics" category) is NOT a third-party cookie — it runs exclusively on our own servers and does not send data to Google, Meta or any other advertising provider. The visit summary is nonetheless emailed to the restaurant administrator (an internal recipient, not an external third party).

The following external providers may receive technical data, ONLY for the site to function or, for the embedded map, with your explicit consent:

• Google LLC — Google Maps embed on pages showing the restaurant location (Functional category, with your consent).
• Stripe Payments — strictly necessary for payment processing (NOT marketing).
• Cloudflare — strictly necessary for security and anti-bot.

6. Your rights

As a data subject you have the right to withdraw consent at any time, and withdrawing must be as easy as giving it. For any questions write to dpo@bistro-etoile.ro.