Cookies, consent and visitor controls
Cookie Policy
This policy explains how Zakynthos.net may use cookies and similar technologies, which tools are essential, when consent is required and how visitors can change their choices.
Essential technologies may operate to deliver and protect the website. Analytics, advertising, embedded media and other optional technologies should remain disabled until the visitor makes the required choice.
01
What cookies and similar technologies are
A cookie is a small text file that a website asks a browser to store on a computer, telephone or other device. It can contain an identifier, a preference, a timestamp or limited information needed to continue a session. Some cookies disappear when the browser closes, while persistent cookies remain until their stated expiry or until the visitor removes them. A cookie does not automatically identify a person by name, but an identifier can become personal data when it is linked with an IP address, account, transaction, device or other information.
Websites can also use technologies that perform similar functions without placing a traditional cookie. Examples include local storage, session storage, tracking pixels, software development kits, server-side identifiers and link parameters. A consent rule should be applied according to what a technology does, not merely what it is called. This policy uses the word “cookies” as a convenient collective term where the same explanation applies to these related methods.
First-party cookies are set from the Zakynthos.net domain. Third-party cookies or requests come from another provider whose service appears on the site, such as an analytics company, advertising network, video host, map provider or affiliate platform. The distinction affects who can read the identifier, but it does not by itself determine whether the technology is necessary or optional. The purpose, data flow and legal requirements must be assessed before a tool is enabled.
02
Essential technologies
Strictly necessary technologies support a service requested by the visitor or a function required to operate the website safely. They can be used for load balancing, fraud prevention, security, network routing, accessibility preferences, form protection and storage of the visitor’s privacy choice. WordPress may also set session or administration cookies for signed-in editors. Ordinary readers should not receive administrative cookies unless they use a feature that genuinely requires them.
Essential does not mean convenient for the operator. A technology is not necessary simply because it improves audience reports, advertising revenue or marketing attribution. Its use must be limited to the function that cannot reasonably be delivered without it. Information from essential security or consent tools should not be repurposed for advertising, behavioural profiling or unrelated measurement without an appropriate legal basis and, where required, consent.
Blocking every cookie can affect essential functions. A contact form may need short-lived anti-abuse information, and a consent manager needs to remember that a visitor rejected optional categories so the question is not repeated on every page. These uses should be proportionate, documented and retained only as long as necessary. The live cookie declaration should identify the actual essential tools used by the installed website rather than relying only on examples in this policy.
03
Analytics and performance measurement
Optional analytics can help the publisher understand which destination guides are useful, how visitors move between pages, which devices encounter errors and whether a redesign improves navigation. Depending on configuration, an analytics service may process a cookie identifier, truncated or full IP address, browser characteristics, approximate location, referring source, visited pages, interaction events and campaign parameters. Even when reports are aggregated, collection at the device can still require consent.
Zakynthos.net should not load optional analytics before the required consent has been recorded. The consent interface should describe the category in plain language, and rejection should be as easy as acceptance. Where a genuinely cookieless or privacy-preserving measurement mode is considered, the operator must assess the actual data transmitted and applicable law rather than assuming that a vendor label removes all privacy obligations.
Analytics data should be configured with sensible retention, access controls and data minimization. Internal traffic and accidental collection of form content should be excluded where possible. Page URLs, event names and search terms must not be designed to expose sensitive information. Adding a new tag manager, heatmap, session replay or testing tool requires a renewed audit because these services can collect substantially more detail than basic audience statistics.
04
Advertising, affiliate attribution and commercial links
The website may later display advertising or links to travel marketplaces, accommodation platforms, tour providers and other partners. Advertising technologies can use cookies or identifiers to limit repetition, measure delivery, detect invalid traffic, personalize content or build an interest profile. Personalized advertising is optional and should not operate before valid consent where consent is required. Contextual advertising may still create technical requests and must be assessed according to its real configuration.
Affiliate links normally contain a referral parameter so the external partner can recognize that a visitor arrived from Zakynthos.net. When a visitor deliberately follows the link, the partner may place or read its own cookie and may attribute an eligible booking or purchase for a defined period. The external provider controls its checkout, account, payment, cancellation and related tracking practices. Visitors should review the provider’s cookie and privacy information before completing a transaction.
Rejecting optional cookies on Zakynthos.net does not necessarily remove a referral parameter from a link the visitor chooses to open. The handoff itself can be necessary to provide the requested commercial route, while any later tracking by the partner is governed by that partner and applicable law. Affiliate relationships are explained separately in the Affiliate Disclosure. They must not be hidden inside consent wording, and consent must not be presented as a condition for reading ordinary editorial content.
05
Embedded maps, video, social content and live inventory
A travel website may use maps, video players, social posts, weather features, review widgets or live tour and accommodation inventory. These features can contact an external server as soon as the page loads, revealing an IP address, browser information, the page being viewed and possibly an existing account identifier held by the external provider. Some services also set cookies for measurement, personalization or advertising.
Optional embeds should be blocked until the relevant choice is made when consent is required. A privacy-friendly placeholder can explain which provider will load and allow the visitor to activate the feature deliberately. Declining an embed should not block the surrounding destination guide. Where practical, the page should offer a direct external link or a text alternative so the core information remains accessible without loading third-party content.
Future Viator, accommodation or other marketplace integrations must be reviewed before launch. Editorial comparison text can remain visible independently of live product cards. The operator should document which requests occur before interaction, what identifiers are used, whether information leaves the European Economic Area and how long attribution or preference data remains. A plugin or API being commercially useful is not enough to classify every related technology as essential.
06
How consent works on Zakynthos.net
When the live site uses optional technologies, visitors should receive a clear choice before those technologies activate. The interface should identify meaningful categories, provide an equally visible way to reject optional use and avoid preselected optional boxes. Consent must be informed, specific, freely given and demonstrated by an affirmative action. Continuing to scroll, closing a banner or merely visiting another page should not be treated as consent.
The consent manager may store the selected categories, policy version and time of choice. That record helps apply the preference consistently and show that the site asked appropriately. If the purposes or providers change materially, the website may ask again. Consent should not be bundled with acceptance of the Terms of Use, and withdrawing an optional choice should not remove access to the editorial site.
Visitors should be able to reopen the privacy settings through a persistent link or control, change individual categories and withdraw consent as easily as it was given. Withdrawal applies to future collection. It does not automatically erase data already processed lawfully, so a separate privacy request may be needed where a visitor wants to exercise rights over existing personal data. The Privacy Policy explains those rights and how to contact the operator.
07
Managing cookies in your browser and device
Most browsers allow visitors to view, delete or block cookies, reject third-party cookies and clear site data. Mobile operating systems and browsers may also restrict advertising identifiers or cross-site tracking. The exact menu differs by product and version, so visitors should use the current help documentation supplied by their browser or device provider. Clearing all cookies can remove saved privacy choices and sign out users from unrelated websites.
Browser controls complement the site’s consent tool but do not replace it. Blocking cookies may not stop every server request, link parameter, pixel or local-storage operation, and a browser signal may not communicate a granular choice for every purpose. Conversely, rejecting optional categories through the site should prevent the relevant scripts even if the browser would technically allow them.
Where legally applicable and technically supported, the operator should assess recognized preference signals such as Global Privacy Control. A signal can express an objection or opt-out for certain processing, but its legal effect depends on jurisdiction and purpose. “Do Not Track” has not developed into one universally interpreted standard. Zakynthos.net should not claim to honour a signal unless the live configuration has been tested to do so.
08
Retention, providers and international transfers
Cookie duration should reflect purpose. A security token may last minutes, a session preference until the browser closes, and a consent record long enough to avoid repeatedly asking the same question. Optional analytics or attribution identifiers should not be retained indefinitely. The current cookie declaration should state the provider, purpose, category and duration for each technology detected on the live site.
Providers that host, secure, measure or monetize the site may process technical data on the operator’s behalf or as independent controllers for their own services. Contracts, access restrictions and security measures should match the relationship. Some providers may process information outside the European Economic Area. Where the GDPR applies, the operator must verify an adequacy decision, approved contractual safeguards or another lawful transfer mechanism and consider supplementary protections where necessary.
The reusable theme cannot truthfully list cookies created by plugins or services that have not yet been installed. Before public launch and after every material plugin, advertising, analytics, embed or affiliate change, the owner should scan the live site, test both acceptance and rejection, verify that scripts remain blocked as promised and update the declaration. An automatically generated list is a useful starting point, not a substitute for checking what each technology actually does.
09
Updates, questions and privacy rights
This policy is reviewed when the website’s consent platform, providers, purposes, ownership or legal obligations materially change. The date above records the latest substantive review. Small formatting corrections do not necessarily require a new date. If a change introduces a new optional purpose, the site should seek the required choice rather than treating an earlier broad preference as permanent permission.
Questions about the live cookie configuration, a provider or a privacy choice can be sent through the Contact page. Include the device, browser, page and approximate time if a preference appears not to work. Do not send passwords, payment information or full booking records. A screenshot can help diagnose a banner problem after personal details and unrelated tabs have been removed.
Where personal data is involved, visitors may have rights of access, rectification, erasure, restriction, portability or objection and the right to withdraw consent. These rights depend on the circumstances and applicable law. The Privacy Policy identifies the responsible contact and explains complaints to a supervisory authority. The Cookie Policy should be read with that policy, the Affiliate Disclosure and the Terms of Use.