Legal information

Cookie Policy

8 min read

Last updated: 30 September 2026. Cookies measured on: 30 September 2026.

This page lists every cookie and every item of browser storage that we found on www.igoumenitsastay.gr, who sets it, why, for how long, and whether it needs your consent. It completes our Privacy Policy.

1. What cookies are

Cookies are small text files that a website stores in your browser. Websites can also store data in your browser in “local storage” or “session storage”. Under Greek law (Art. 4(5) of Law 3471/2006) a website may store or read such information on your device only with your consent, unless it is strictly necessary for a service you asked for.

2. The short version

Until you make a choice, our public pages set no cookies and store nothing in your browser. We checked the home page, articles, listings, beaches and pages with every kind of embedded content, in a clean browser, before any click.
When a page first opens, your browser contacts only our own server. No Google, no Facebook, no analytics, until you allow them.
On your first visit a small bar at the bottom of the page asks whether we may use Google Analytics. It is off unless you choose “Accept” (section 4). Your choice is kept in your browser (section 3).
Our own visit statistics work without cookies (see section 6).
Maps, videos, social posts and widgets from other companies load only when you click the button on them, or automatically if you switch on “External media” in “Cookie settings”. Only then can that company set its own cookies.
If we ever add advertising, we will ask for your consent first.

3. Cookies and storage set by our site

No cookie while you browse the public site.
igs_consent (local storage of your browser): set when you make a choice in the bar or in “Cookie settings”, “Reject” included. It holds the version of the settings, a random consent ID, the date of your choice and the choice itself (“Statistics” and “External media”, on or off), nothing else. It is kept for 12 months; after that it is ignored and deleted, and we ask you again. Strictly necessary: it only remembers the choice you made.
Security check cookie of Imunify360 (for example wsidchk): only if our security system shows a short check page when traffic looks automated. It remembers that your browser passed the check. Short, set by the security system. Strictly necessary.
wp-postpass_…: only if you enter a password on a password-protected page. It lets you see that page. 10 days. Strictly necessary.

Strictly necessary cookies and storage do not need consent.

Record of your choices. Each time you save a choice, your browser also sends it to our server, which keeps it as proof of your consent: the random consent ID, the date and time (UTC), the version of the settings, your choices, the kind of action (accept, reject, your own choices, or withdrawal) and the language of the page. Nothing else: no IP address, no browser details, no page address. We keep each entry for 12 months after your choice expires, so for at most 24 months, and then delete it automatically. You can see your consent ID in “Cookie settings” and quote it if you write to us about your choice. Details are in section 6 of our Privacy Policy.

4. Google Analytics (only if you accept)

We use Google Analytics 4, a service of Google Ireland Limited, to understand how visitors use the guide: which pages are read, how visitors found us, the type of device and browser, and the approximate area (country or city, which Google derives from the IP address). It runs only if you choose “Accept” in the bar or switch on “Statistics” in “Cookie settings”. Before that our pages load nothing from Google and no Google Analytics cookie is set.

When you accept, we tell Google that only storage for statistics is allowed, while storage for advertising, advertising data and personalisation stay denied (Google Consent Mode). Google signals and advertising features are switched off on our side. Logged-in editors are never measured.

_ga (igoumenitsastay.gr and its subdomains, 12 months): a random number that tells Google Analytics that two visits come from the same browser. Statistics, needs your consent.
_ga_VWQSRRPWNH (same domain, 12 months): keeps the state of the current visit (session) for our Google Analytics property. Statistics, needs your consent.

We measured these two cookies on 30 September 2026 after “Accept”, in a clean browser. Google Analytics set no other cookie and used no browser storage. Their 12 months start again with every visit. If you withdraw your consent (section 8), we stop Google Analytics at once and delete both cookies. Google’s policy: policies.google.com/privacy. What data Google Analytics processes, the legal basis, transfers and retention: section 3.4 of our Privacy Policy.

5. Cookies from external content (only when it loads)

Some pages contain content from other companies. We replace each one with a box that names the company and has a button such as “Show map”, “Play the video” or “Show the Instagram post”. Nothing is loaded from that company until you click. Your click is your request, and your consent, to load that specific content. You can also use the plain link under each box to open the content on the other site instead.

In “Cookie settings” you can switch on “External media”: then all this content loads automatically on every page, without the button, until you switch it off. It is off unless you switch it on.

When the content loads, the company receives your IP address and browser details, and may set cookies or use browser storage. This is what we measured in a clean browser that was not logged in to Google or Meta. If you are logged in to those services, they may also recognise you.

Google Maps (“Show map”), Google. Cookies: NID (.google.com, 6 months; preferences, security, and advertising use by Google), not set on every map. Browser storage: none. Also loads Google fonts and map servers.
Google Calendar (“Show calendar”), Google. Cookies: NID (6 months). Browser storage: none. Also loads Google APIs.
YouTube (“Play the video”), Google, from youtube-nocookie.com (privacy-enhanced mode). Cookies: none measured, before or after playback. Browser storage: 4 items in local storage (player settings). Also loads YouTube image and video servers.
Instagram (“Show the Instagram post”), Meta. Cookies: none measured when not logged in. Browser storage: none. Also loads Instagram image servers.
Airbnb (“Show the Airbnb listing”), Airbnb. Cookies: none measured. Browser storage: none. Also loads the Airbnb image server.
Wikiloc (“Show the Wikiloc trail”), Wikiloc. Cookies: __cf_bm (.wikiloc.com and .wklcdn.com, 30 minutes) and _cfuvid (.wklcdn.com, session), both from Cloudflare bot protection. Browser storage: _gcl_ls (Google Ads link) and mapkit.SpileTestResults. Also loads Google Tag Manager and Facebook, Apple Maps, jsDelivr, cdnjs and Google fonts.
BeachRadar (“Show BeachRadar”), BeachRadar. Cookies: none. Browser storage: 1 item in session storage. Also loads Open-Meteo (weather) and Google fonts.
FuelGR (“Show fuel prices”), FuelGR. Cookies: none. Browser storage: 14 items in local storage, including a device identifier (deviceId). Also loads OpenStreetMap, Cloudflare Web Analytics, Google Maps and Google fonts.
Weather forecast (“Show the weather forecast”), weatherwidget.io / Forecast7. Cookies: none. Browser storage: none.
Map on listing pages (“Show map”), OpenStreetMap Foundation. Cookies: none. Browser storage: none. The map itself is served by our site; only the map images come from tile.openstreetmap.org.

Each company decides for itself which cookies it uses and may change them at any time. Their own policies apply:

Google (Maps, Calendar, YouTube): policies.google.com/privacy
Meta (Instagram): privacycenter.instagram.com
OpenStreetMap Foundation: osmfoundation.org/wiki/Privacy_Policy
Airbnb, Wikiloc, BeachRadar, FuelGR, weatherwidget.io: the privacy policy linked on each company’s own website.

6. Our own statistics without cookies

On listing pages we count views and clicks on buttons such as “Call” or “Directions”, per listing and per day. The counter sends only the number of the listing and the type of action. It does not set or read any cookie or browser storage, does not create any identifier for your device, and we do not store your IP address. Logged-in editors are not counted. This counter is separate from Google Analytics and works whether or not you accept it. Details are in section 3.3 of the Privacy Policy.

These concern only people who log in to manage the site, not visitors.

wordpress_test_cookie: set when the login page opens; checks that the browser accepts cookies. Session. Strictly necessary.
cf.turnstile.u (local storage, challenges.cloudflare.com): set when the login page opens; Cloudflare Turnstile check against automated logins. Until cleared. Strictly necessary.
wordpress_sec_… and wordpress_logged_in_…: after login; keep you logged in. Session, or 14 days with “Remember me”. Strictly necessary.
_lscache_vary: after login; shows logged-in users uncached pages. While logged in. Strictly necessary.
wp-settings-… and wp-settings-time-…: inside the administration; screen preferences. 1 year. Preferences.
wp_lang: only if you pick a language on the login page; language of the login page. Session. Preferences.

8. How to control cookies

“Cookie settings”, at the bottom of every page, lets you switch “Statistics” (Google Analytics) on or off and choose whether maps, videos, posts and widgets load automatically (“External media”). Both are off unless you switch them on, and you can change your choice or withdraw your consent at any time with the same link. If you switch “Statistics” off, Google Analytics stops at once and we delete its cookies. The buttons “Accept all”, “Reject all” and “Save choices” carry the same weight, like “Accept”, “Reject” and “Settings” in the bar. Open Cookie settings
Do not click on external content, or use the plain link under it instead: no cookie from that company is set on our pages.
Delete cookies and site data in your browser settings at any time. Most browsers also let you block third-party cookies.
Opt-out tools of the companies themselves, for example Google’s ad settings at adssettings.google.com, or Google’s browser add-on that turns Google Analytics off on all websites: tools.google.com/dlpage/gaoptout.

9. Changes

We re-check the cookies on the site whenever we add a new kind of embedded content, a plugin, advertising or analytics, and update this page. The date at the top shows the latest version. If the categories in “Cookie settings” change, we ask for your choice again.

10. Contact

Panos Andreou, IgoumenitsaSTAY, igoumenitsastay@gmail.com