Cookie Policy

Last updated: 19 May 2026

Version 2.0

1. What Are Cookies?

Cookies are small text files that websites place on your device when you visit them. They allow the website to recognise your device and remember information about your visit, such as your preferences, session state, or actions taken. Some cookies are essential for the website to function, while others are optional and used for analytics, personalisation, or marketing.

This Cookie Policy explains what cookies and similar tracking technologies Wholeding uses, why we use them, and how you can manage your preferences.

2. How We Use Cookies

Wholeding follows a consent-first approach to cookies. Strictly necessary cookies — those required for authentication, security, and core functionality — are set without consent because they are exempt under Article 5(3) of the ePrivacy Directive. All other cookies, including analytics and advertising cookies, are set only after you have given explicit consent via the cookie banner.

Until you accept, no analytics or advertising cookies are written to your device, and no measurement or advertising data is sent to any third party. You can change or withdraw your consent at any time using the Manage Cookie Preferences control.

3. Strictly Necessary Cookies

These cookies are essential for the platform to function. They do not require your consent under GDPR because they are covered by the legitimate interest legal basis (Article 6(1)(f)) and the ePrivacy Directive exemption for cookies strictly necessary to provide a service you have requested.

  • Authentication session: set by Supabase when you sign in to keep you logged in across pages. Expires when you sign out or after a period of inactivity.
  • Cookie consent preference: stored in your browser's local storage (not a cookie, but a similar technology) to remember your consent choice so we do not show the banner on every page.

These cannot be disabled through the preference controls because the platform cannot function without them.

4. Bot Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile on sign-up, sign-in, password reset, and contact forms to protect against automated abuse, credential stuffing attacks, and spam. Turnstile is a privacy-focused CAPTCHA alternative that does not set tracking cookies and does not profile users across websites.

Turnstile collects minimal data (IP address and basic browser signals) to verify that you are a human rather than a bot. This processing is based on our legitimate interest in protecting the platform and our users (GDPR Article 6(1)(f)) and is classified as strictly necessary because the forms it protects are essential security entry points.

Because Turnstile is a security measure, it does not require your consent under the ePrivacy Directive's exemption for communications transmitted over an electronic communications network.

5. Analytics Cookies (Google Analytics 4)

With your consent, we use Google Analytics 4 (property G-N8J2V47W6K) to understand how visitors discover and use the platform, measure the performance of the public site (including Core Web Vitals such as LCP, CLS, INP, FCP and TTFB), and inform improvements to the funnel from landing page to booking. We use this data in aggregated form; we do not use it to identify individual visitors.

We have configured Google Analytics to minimise privacy impact:

  • IP anonymisation is on by default in GA4 — your full IP address is never stored.
  • Google Signals is disabled, so no cross-device or demographic tracking from Google's signed-in user graph is performed.
  • Authenticated client users only are stitched to a stable internal identifier (a Supabase user ID — an opaque UUID, not your email or name) so that we can measure the funnel from anonymous landing to authenticated client. Administrator and provider sessions are not tracked.
  • Event data retention is set to 14 months, after which event-level data is automatically deleted.

The cookies set by Google Analytics on the .wholeding.eu domain are:

  • _ga — distinguishes unique users. Expires after 2 years.
  • _ga_N8J2V47W6K — session state for the GA4 stream. Expires after 2 years.
  • _gid — distinguishes unique users for 24 hours (may be set by GA in some configurations). Expires after 24 hours.

If you withdraw consent, these cookies are cleared from your browser and no further events are sent.

6. Advertising Cookies (Google Ads)

With your consent, we use Google Ads (account AW-18159589539) to measure the effectiveness of paid campaigns that bring visitors to the platform — for example, attributing a completed booking back to the ad that introduced you to Wholeding. We do not use these cookies to display ads to you on third-party sites; their purpose is conversion measurement, not retargeting.

The Google Ads tag is linked to the Google Analytics property described in Section 5 for cross-attribution. The cookies set by Google Ads on the .wholeding.eu domain are:

  • _gcl_au — Conversion Linker; used to attribute conversions to ads. Expires after 90 days.
  • _gcl_aw — set when a visitor arrives via a Google Ads click. Expires after 90 days.
  • _gcl_dc — equivalent to _gcl_aw for Display & Video / DoubleClick. Expires after 90 days.

Bundled consent: for simplicity and transparency, a single consent toggle covers both analytics (Section 5) and advertising (Section 6) cookies. Accepting via the cookie banner enables both; declining or withdrawing consent disables both. We use Google Consent Mode v2, which means that when you have not consented, the Google tags are loaded in a restricted, cookieless mode and no measurement or advertising data is transmitted.

7. Third-Party Cookies

When you use certain features of the platform, third-party services may set their own cookies:

  • Stripe (payment processing): Stripe sets cookies on its own payment forms when you complete a booking. These cookies are strictly necessary for fraud prevention and secure payment processing. See Stripe's cookie settings for details.
  • Google Meet (video sessions): When you join a video session, Google may set cookies under its own terms. These are governed by Google's cookie policy and are outside Wholeding's control.

We recommend reviewing the cookie policies of these third parties if you want full information about their practices.

8. Vercel Analytics (Not Currently Active)

We have integrated the infrastructure for Vercel Analytics and Vercel Speed Insights, but these services are not currently active — no data is being sent to Vercel at this time. If we enable them in the future, we will update this Cookie Policy and re-prompt for consent before activation. Vercel Analytics, when active, does not use tracking cookies and does not track individual users across sessions.

9. International Data Transfers

Google LLC, the provider of Google Analytics and Google Ads, is established in the United States and may process the data described in Sections 5 and 6 outside the European Economic Area. Where this occurs, transfers are governed by the European Commission's Standard Contractual Clauses and the supplementary measures Google publishes for its advertising and measurement products. You can read Google's data processing terms at business.safety.google/adsprocessorterms.

10. Managing Your Preferences

You can manage your cookie preferences at any time by:

  • Clicking the Manage Cookie Preferences button at the top of this page.
  • Clicking the Cookie Preferences link in the footer of any page.
  • Clearing your browser's cookies and local storage — this will cause the cookie consent banner to reappear on your next visit.

Withdrawing consent stops further analytics and advertising data from being sent and clears the corresponding cookies from your browser on the next page load. For more information about how we process your personal data, see our Privacy Policy.

11. Changes to This Policy

We may update this Cookie Policy from time to time to reflect changes in the technologies we use, legal requirements, or our practices. When we make material changes, we will update the version number and "Last updated" date at the top of this page.

If we introduce new categories of cookies that require consent, we will re-prompt you for consent via the cookie banner before any new tracking begins.

12. Contact

If you have questions about our use of cookies or this Cookie Policy, please contact us at privacy@wholeding.eu.

We use cookies to ensure our platform works properly. You can choose which optional cookies to allow. Privacy Policy and Cookie Policy.