Cookies Policy

Last updated: 30 September 2026

This Policy explains which cookies and similar technologies the marmariparadise.com website uses, what each one does and how you can control them.

It works alongside the Privacy Policy.

1. What cookies are

Cookies are small text files stored on your device (computer, mobile, tablet) when you visit a website. They allow the website to "remember" information about your visit.

Alongside cookies there are also similar technologies, such as your browser's local storage (localStorage). This Policy covers all of them, whatever their technical name.

Legal framework: Article 4(5) of Law 3471/2006 (as in force) and the GDPR, as specified by the Recommendations of the Hellenic Data Protection Authority (Ref. No. 1525/25.02.2020) on the use of trackers.

2. Which categories of cookies we use

The website uses:

• Strictly necessary cookies and local storage, which always run (section 3.1) — no consent required.
• Analytics cookies (Google Analytics 4) — only if you consent to the "Statistics" category (section 3.2).
• Marketing cookies (Google Ads, Meta) — only if you consent to the "Marketing" category (section 3.3).
• Cookies for the embedded map (Google Maps) — only if you consent to the "Embedded maps" category (section 3.4).

No optional cookie is stored on your device before you state your consent in the banner — nor if you choose "Reject". We do not use user behaviour recording tools (heatmaps, session recording).

2.1 What always loads — and exactly what it sends

Since 14 September 2026, Google Tag Manager (GTM-WWMD3WRC) — the tool that activates or blocks everything else — loads on every visit: both before you answer the banner, and if you choose "Reject". This way your choice is applied from a single point, using Google's "Consent Mode" mechanism.

What this means in practice, as we measured it on 14/09/2026:

• No cookie is stored and nothing stored on your device is read, for as long as you have not consented. _ga, _ga_MHCGWXDNZE and _gcl_au are not created — neither before you answer, nor after a rejection.
• However, two measurement messages are sent to Google, without any cookie. Each one includes your IP address, the type and version of your browser and operating system, your screen resolution, your language, the address and title of the page you are viewing, and a temporary number that is not stored anywhere and changes on every page.
• These messages carry the "no consent" flag (gcs=G100) and are not used for advertising personalised to you.
• They do not recognise you on a later visit, precisely because nothing remains on your device.

Legal basis for these two messages: our legitimate interest in knowing, at aggregate level, how many people visit the website (Article 6(1)(f) GDPR). Because no information is stored on or read from your device, Article 4(5) of Law 3471/2006, which governs exactly that, is not triggered here. You have the right to object (Article 21 GDPR): write to us at info@marmariparadise.com. You can also block them entirely through your browser (section 6).

If you have JavaScript disabled, an additional hidden frame is loaded from Google (googletagmanager.com/ns.html). We measured it: it is empty, it sets no cookie and it loads nothing else; Google receives only your IP address and basic browser details. In that case there is no technical way to send your choice, because the consent banner needs JavaScript in order to work.

The website's fonts are installed on our own server and are not loaded from an external provider; your visit therefore does not create a connection to third-party servers for that purpose.

The CMS (Sanity), from which the page content (text, photos) is sourced, does not place any cookies and does not communicate with your browser — retrieval happens from our servers. See the Privacy Policy, section 6.4.

3. What we actually use

3.1 Strictly necessary (no consent required)

These are necessary for the website to work, or are placed following an express action on your part in order to provide a service you asked for. They are exempt from the consent requirement (Article 4(5), third subparagraph, of Law 3471/2006).

The mp_consent cookie is necessary so that we can honour your choice — and that applies equally if you choose to reject.

3.2 Analytics cookies — Google Analytics 4

We use Google Tag Manager (GTM-WWMD3WRC) to load Google Analytics 4 (property G-MHCGWXDNZE). Tag Manager always loads (section 2.1); the cookies below, however, are only created if you consent to the "Statistics" category. Without consent — and after a rejection — they are not present on your device (measured 14/09/2026).

Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of Law 3471/2006). As Google Ireland Limited belongs to a group with a US parent entity, a transfer outside the EEA may take place — see section 7 of the Privacy Policy.

3.3 Marketing cookies — Google Ads and Meta

The advertising tool loads together with Tag Manager (section 2.1), but the cookie below is only created if you consent to the "Marketing" category. Without consent — and after a rejection — it is not present on your device (measured 14/09/2026).

The Meta pixel is live (verified 14/09/2026). It is loaded from connect.facebook.net only when you have consented to the "Marketing" category. Without consent — and after a rejection — it does not load at all and _fbp is not created; we measured this over six consecutive page views.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of Law 3471/2006).

Meta as a recipient. With your "Marketing" consent, the Meta Pixel sends to Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) the page view event (PageView) — from the very first acceptance —, the page address, browser and device information, the IP address, and the _fbp/_fbc identifiers. For the collection and transmission of this data we are joint controllers with Meta (CJEU C-40/17 Fashion ID); for any further processing, Meta alone is the controller. Meta belongs to a group with a US parent entity (Meta Platforms, Inc.); the transfer relies on the EU-U.S. Data Privacy Framework — see section 7 of the Privacy Policy. Meta may also use its own cookies on its own domain (e.g. fr), in accordance with its own policy: https://www.facebook.com/privacy/policy · https://www.facebook.com/privacy/policies/cookies

3.4 Third-party cookies for the embedded map

Without your consent the map does not load and no connection to Google is made. In its place a preview image with an activation button is displayed.

• Google privacy policy: https://policies.google.com/privacy
• Google information about cookies: https://policies.google.com/technologies/cookies

Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of Law 3471/2006). Given that Google is a group with a US parent entity, a transfer outside the EEA may take place — see section 7 of the Privacy Policy.

You do not need to accept the map in order to find us: on the same page we set out the full address and written directions.

3.5 Booking system (separate website)

When you click "Book now", you are taken to marmariparadise.reserve-online.net, which is a separate website with its own cookies and its own privacy policy. The choices you make in our banner are not carried over there. Privacy policy: https://marmariparadise.reserve-online.net/privacy-policy

4. How we ask for your consent

The first time you visit the website, a banner appears with three equally weighted options:

• "Accept" — the optional categories are also activated.
• "Reject" — no optional cookie is stored. The website still works fully.
• "Settings" — you choose separately, category by category.

We follow these principles:

• No optional cookie is stored before you state your choice — see section 2.1 for what always loads and what it sends.
• Rejecting is just as easy as accepting — same position, same appearance, same number of clicks.
• No box is pre-ticked.
• Silence, continued browsing or closing the banner do not constitute consent.
• There is no "cookie wall": access to the content does not depend on acceptance.

5. How to change or withdraw your choice

Withdrawing consent is just as easy as giving it (Article 7(3) GDPR):

1. Click the "Cookie settings" link that is permanently available in the footer of every page.
2. Change your choices and save.

Your new choice takes effect immediately. Withdrawal does not affect the lawfulness of processing carried out earlier on the basis of consent.

We will ask you again after 6 months, and whenever a new cookie category is added.

This period is exactly the same whether you accepted or rejected: we do not ask you again sooner because you rejected.

6. Control through your browser

You can also delete or block cookies directly from your browser settings:

• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/kb/cookies-information-websites-store
• Apple Safari: https://support.apple.com/guide/safari/sfri11471/mac
• Microsoft Edge: https://support.microsoft.com/help/4027947

Please note that blocking all cookies may affect how the website works, for example your language choice may not be retained.

7. Changes to this Policy

If we add new cookies or third-party services, we will update this Policy and ask for your consent again for anything that is not strictly necessary.

8. Contact

For questions about cookies: info@marmariparadise.com · +30 27330 52101

Right to lodge a complaint: Hellenic Data Protection Authority (HDPA), Kifissias Ave. 1–3, 115 23 Athens, Greece, https://www.dpa.gr