Privacy controls
Cookie and local-storage policy
What is stored on your device, which third parties may load, and how to change your choice.
Effective: 22 July 2026
1. Consent rule
Essential storage may be used without consent when strictly necessary to provide the service requested by the user. Optional measurement storage and the Google map are each disabled until the user consents to them — two separate choices. Rejecting optional storage does not prevent access to the hotel information or the external map link.
The legal basis is Article 399 of the Polish Electronic Communications Law and, where personal data is involved, GDPR Article 6(1)(a) for optional storage and the applicable non-consent basis for strictly necessary processing.
2. Current device-storage inventory
| Provider / item | Purpose | Category | Duration |
|---|---|---|---|
| Aparthotel Stare Miasto: ahsm-cookie-consent (cookie and local storage) | Remembers the consent decision so the banner and optional services follow the user’s choice. | Strictly necessary | 365 days unless cleared earlier |
| Aparthotel Stare Miasto: NEXT_LOCALE (cookie) | Remembers which language version of the site (English or Polish) is being viewed, so links and redirects keep it. Set when a page is served; it holds only the language code. | Strictly necessary | Until the browser is closed |
| Aparthotel Stare Miasto: ahsm-locale-choice (local storage) | Remembers the language the user chose (English or Polish), so the suggestion to switch language is not shown again. Written only when the user picks a language. | Strictly necessary | Until cleared by the user |
| Google Maps embed | Displays the interactive location map. Google may access or place identifiers under its own policies after consent. | Optional — Google map (a separate choice from measurement) | Set by Google; may vary by service and account state |
| PostHog customer-journey analytics: ph_<project>_posthog and __ph_opt_in_out_<project> (local storage), ph_<project>_posthog and ph_<project>_primary_window_exists (session storage) | Measures navigation, viewed content, scrolling, engagement, web performance, interactions and booking-engine handoffs, using a random identifier stored on the device. The identifier is not linked to a name, but it recognises the browser on later visits. Session recording is switched off. | Optional measurement | Stored entries: until consent is withdrawn (they are then deleted) or cleared. Collected events: see section 3 |
| Aparthotel Stare Miasto: ahsm_journey_attribution_v1 (session storage) | Keeps the campaign source of the current visit (utm parameters and landing page) so the booking link opened later in the same visit can be attributed to it. Written only after measurement consent. | Optional measurement | Until the browser tab is closed, or deleted on withdrawal |
| Google Analytics: _ga, _ga_<measurement id> (cookies) | Distinguishes one visitor's device from another so that page views and the moment the booking engine is opened can be counted as a single visit, including when that visit continues into the booking engine on its own domain. No advertising cookies are set. | Optional measurement | Up to 13 months (400 days, the longest a browser keeps a cookie) unless cleared earlier; collected event data is deleted after two months |
3. Third-party services
The embedded Google map is not rendered until the user allows the Google map, which is a separate choice from measurement. Google’s current privacy and technology notices govern identifiers it may use after the map loads.
Customer-journey analytics is not loaded before measurement consent: declining leaves no PostHog script, identifier or request. Provider details: PostHog (EU Cloud). Used only after you accept the measurement category. It records which pages and sections you view, which booking links you click (with the dates and number of guests and apartments in that search) and basic performance timings, so we can see where the booking journey fails. Data is processed in the European Union under PostHog's data processing agreement. Events are kept for one year and then deleted automatically; this is the retention period PostHog applies to our plan, and it cannot be shortened. Session recording is switched off, so no recording of your visit is ever made. No personal profile is built: the analytics are not linked to a named person. Declining leaves the analytics software undownloaded — no identifier or event is created at all..
Google Analytics is likewise not loaded before consent: declining leaves no Google script, cookie, stored value or request on this website. When it is active it also links the visit to the booking engine's own Google Analytics, so a booking completed there can be attributed to the visit that started here. Details: Google Analytics 4, provided by Google. Used only after you accept the measurement category, and loaded only then: decline and no Google script, cookie or request is created at all. It records which pages you view and when you open the booking engine, and — because the booking engine uses the same measurement — it lets us see that a visit here led to a booking there, which is the only way we can tell which parts of this website actually help guests book. Google does not log or store individual IP addresses from visitors in the EU, Switzerland or the UK: your address is used to derive an approximate location and is then discarded, so no IP address is stored. Event data is retained for two months and then deleted. No advertising cookies are set and no advertising or ad-personalisation signals are sent — advertising storage is refused by the website itself, not left to a setting, and Google Signals is switched off. Google processes this data as our processor under Google's data processing terms; where data reaches the United States, Google LLC is certified under the EU-U.S. Data Privacy Framework, with the European Commission's Standard Contractual Clauses applying where the Framework does not (GDPR Chapter V).
OnePageBooking opens as a separate website. Its own storage and privacy controls apply there: shown as "Privacy Policy" in the footer of the booking engine itself (it opens in the page rather than at its own web address). The hotel website does not treat visiting OnePageBooking as consent to unrelated optional cookies on this website.
4. Change or withdraw your choice
Use “Cookie preferences” in the footer at any time. Accept and reject options are both available; optional categories are not preselected. Withdrawal is as easy as giving consent and applies going forward; withdrawing measurement also deletes the analytics entries listed above from this browser.
Browser settings can also delete or block storage. Blocking essential storage may cause the consent choice to be requested again.
5. Updates and contact
The inventory is reviewed when a provider or feature changes. Questions may be sent to reservations@ahsm-krakow.com.
Need help?
Contact us about a booking, privacy, cookies or accessibility.