Last updated: 15 September 2026 · policy version 1
cromoreretreat.com and booking.cromoreretreat.com are one website run by CJO Holdings Ltd, trading as Cromore Retreat. We use a handful of cookies that are needed to take and manage your booking. Everything else, which is Google Analytics and a Google Ads click id, only runs if you say yes in the banner. You can change your mind at any time using in the footer of every page, or the link in this paragraph.
We ask again after six months (183 days), and sooner if we change what we use cookies for. “Reject all” and “Accept all” are the same size and take the same single click. Nothing is pre-ticked.
Cookies are small text files a website asks your browser to keep. The rules that apply to them (the UK Privacy and Electronic Communications Regulations, and the ePrivacy rules for visitors in the EU) also cover other browser storage such as localStorage and sessionStorage, so this page lists those too.
These keep your booking hold, your guest-portal or staff sign-in, and the checkout you are part-way through. Stripe uses two cookies on payment pages to detect fraudulent card use. None of them are used for advertising and they are not shared for any other purpose.
| Name | Set by | Type | Purpose | Lasts |
|---|---|---|---|---|
| cr_consent | Cromore Retreat | cookie | Remembers the cookie choices you made here so we do not ask again. | 6 months |
| cr_holds | Cromore Retreat | cookie | Keeps the suite you are booking held for you while you complete checkout. | 1 hour |
| cr_checkout_params | Cromore Retreat | cookie | Restores your checkout if an app's in-built browser drops the page details. | 2 hours |
| guest-token | Cromore Retreat | cookie | Keeps you signed in to the guest portal. | 7 days |
| __Secure-authjs.* | Cromore Retreat | cookie | Staff sign-in and form protection for the admin area. Only set for staff. | 7 days |
| ga_purchase_sent:* | Cromore Retreat | sessionStorage | Stops a refreshed confirmation page recording the same booking twice. | Until the tab is closed |
| __stripe_mid | Stripe (third party) | cookie | Fraud prevention on payment pages: helps Stripe detect stolen-card testing. Set only where a card form is shown. | 1 year |
| __stripe_sid | Stripe (third party) | cookie | Fraud prevention on payment pages, for the current payment session. | 30 minutes |
Google Analytics sets cookies that tell one visit apart from another, so we can count visitors, see which pages and searches bring people to us, and which parts of the booking journey people abandon. Google processes this data for its own purposes as well as ours, which is why it needs your consent. If you decline, Google still receives an anonymous, cookieless signal that a page was viewed.
| Name | Set by | Type | Purpose | Lasts |
|---|---|---|---|---|
| _ga | Google Analytics (third party) | cookie | Tells one visitor apart from another so visits can be counted. | 2 years |
| _ga_* | Google Analytics (third party) | cookie | Keeps the state of your current visit for Google Analytics. | 2 years |
| cromore_utm (campaign tags) | Cromore Retreat | localStorage | Remembers which website or search engine you came from, so a later booking can be credited to it in our own reports. | 30 days |
When you arrive from a Google ad, Google attaches a click id to the link. With your consent we keep that id (and any campaign tags) for 30 days so that, if you book, we can tell Google the ad worked. We do not build advertising profiles or share your details with other advertisers. This category also lets the Google Maps embed on our contact page load, which sets Google's own cookies.
| Name | Set by | Type | Purpose | Lasts |
|---|---|---|---|---|
| cromore_utm (ad click id) | Cromore Retreat | localStorage | Keeps the Google Ads click id (gclid) so that, if you book, we can report the booking to Google Ads. | 30 days |
| _gcl_aw / _gcl_gb / _gcl_gs | Google Ads (third party) | cookie | Set by the Google tag when you arrive from a Google ad: stores that ad click id so a booking can be credited to the ad. | 90 days |
| _gcl_ls | Google Ads (third party) | localStorage | The Google tag’s own copy of the ad click id, kept in browser storage alongside the cookie above. | 90 days |
| _gcl_au | Google Ads (third party) | cookie | Set by the Google tag to help measure whether advertising leads to bookings. | 90 days |
| Google Maps cookies (NID, CONSENT, …) | Google (third party) | cookie | Set by Google when the live map on our contact page loads. Governed by Google's privacy policy. | Up to 6 months |
Before you have made a choice, and if you reject analytics, Google’s tag runs in “consent mode”: it sets no cookies and sends anonymous, cookieless pings that Google uses only for aggregate modelling. If you reject marketing, any advertising click id is stripped from those pings.
Separately from Google Analytics, we count visits on our own server. When a page loads, your browser tells us the page, the website you came from, and any stay dates you searched; our host adds the country (and, in the UK, which nation) and whether you are on a phone, tablet or computer. Nothing is stored on your device, we do not keep your IP address, and there is no identifier that would let us recognise you on a later visit, so this does not need cookie consent. We rely on our legitimate interest in understanding how our website is used. You can switch it off at any time under “Anonymous site statistics” in , and we also do not count browsers that send a Do Not Track or Global Privacy Control signal. Records are deleted after 13 months.
When you make a choice we store it in the cr_consent cookie and keep a matching record on our own server: a random id, the time, which categories you allowed, and which version of this policy you saw. The id is not linked to your name or email unless you go on to make a booking, in which case it is kept with the booking so we can show what you agreed to at the time. Records are deleted 12 months after the consent they describe has expired.
Use in the footer. Withdrawing analytics deletes the Google Analytics cookies on this site straight away; Google’s own cookies set by the map are cleared by your browser when they expire, or you can delete them in your browser settings. You can also block or delete cookies in your browser at any time, though the booking checkout will not work without the necessary ones.
Questions about this policy or your data: info@cromoreretreat.com. Our Privacy Policy explains everything else we do with personal data, including your rights and how to complain to the Information Commissioner’s Office.