Last updated: 25 October 2026
Your Bloom account session
Supabase authentication supports your account session. Session storage allows access to your own bookings and passes; signing out closes your current session.
Booking and account access do not require Analytics or Marketing consent. Google Maps remains controlled by External services consent or an explicit request to load the map.
With Marketing consent, purchase measurement may use protected identifiers derived from your email and account identifier, plus available _fbp and _fbc browser identifiers. They allow matching with Meta’s records and are not anonymous. We store permission given while signed in and the linked identifiers; permission lasts 180 days from the original choice. Withdrawal removes stored _fbp and _fbc values and stops information that has not yet been sent. Consent, withdrawal and delivery records are not automatically deleted by that action. Cookie settings cannot withdraw information already sent to Meta.
- We may measure ticket or pass selection and the start of a booking; these do not confirm a reservation or payment.
- Successful reservations and unpaid pass requests may be measured separately; a pass request is not reported as a purchase.
- A newly recorded full payment may be reported after you close the browser. Previously recorded, free, partial, refunded or reversed payments do not create a new purchase report.
- Meta measurement requires Marketing consent; Google Analytics booking measurement requires Analytics consent. Consent must exist both when the action occurs and when information is shared. Later consent does not authorize reporting earlier actions.
bloom_marketing_revoke
- Provider
- bloombydori.hu; the related record is stored by Supabase
- Purpose
- Allows previously granted purchase-measurement permission to be withdrawn from the same browser after sign-out. The cookie contains a random identifier rather than readable account details.
- Category
- Necessary consent-management functionality; not a tracking cookie
- Duration
- Up to 180 days. Purchase-measurement permission expires 180 days after the original cookie choice.
- Activation
- When you consent to purchase measurement while signed in.
- Legal basis
- Storage necessary to manage consent and its withdrawal; it does not itself authorize marketing measurement.
- Withdrawal and deletion
- Disabling Marketing or choosing Necessary only in the footer's Cookie settings revokes permission for accounts linked to this browser and prevents unsent events from being delivered, including after sign-out. If you delete the cookie first, sign in to withdraw account permission or contact us.
- Data transfers
- The withdrawal identifier is not sent to Meta. Vercel and Supabase provide consent management.
How do the settings work?
Technologies necessary for the website to work may operate automatically. Analytics, Marketing and External services are separate optional categories. They are off by default and activate only after the relevant consent or your express request to load external content.
Vercel Web Analytics, Vercel Speed Insights, Google Analytics and Google Tag Manager belong to Analytics. Meta Pixel operates only when the service is enabled and you consent to Marketing. Choosing Marketing does not enable Google advertising data use or personalization. Google Maps does not load automatically.
Meta Pixel may share browser and page information. Purchase measurement may also use protected identifiers derived from email and account identifiers for matching. The privacy notice and the inventory below explain the information, recipients and your choices.
Rejecting optional categories does not prevent enquiries, bookings or pass purchases. We ask visitors with an older consent choice to renew it for purchase measurement; optional measurement stays off until then. Speed Insights requires acceptance of the updated analytics information if an earlier choice did not cover it; this does not change the choices for other categories.
Cookies and similar technologies used
bloom_consent_v1
- Provider
- bloombydori.hu (bloom by Dóri)
- Purpose
- Stores your selected categories, the notice version and the time of your choice so that the website does not ask again on every page.
- Category
- Necessary
- Duration
- 6 months from your most recent choice.
- Activation
- Created automatically when your choice is saved; it does not contain analytics or marketing data.
- Legal basis
- Technical necessity under the rules implementing Article 5(3) of the ePrivacy Directive; where an online identifier is personal data, legitimate interests under Article 6(1)(f) GDPR in recording and applying your choice.
- Withdrawal and deletion
- You can change optional choices at any time through Cookie settings in the footer. If you delete this cookie in your browser, the website will ask for your choice again.
- Data transfers
- The cookie’s contents are not directly sent to an external service. Vercel may process request-related technical data through its hosting infrastructure.
Vercel Web Analytics
- Provider
- Vercel
- Purpose
- Aggregated public page views, successful enquiries and bookings. We do not send personal form fields, booking identifiers or private page paths.
- Category
- Analytics
- Duration
- This configuration does not create analytics cookies or persistent browser identifiers.
- Activation
- Only on the production public website, when enabled and Analytics is accepted.
- Legal basis
- Your consent to the Analytics category.
- Withdrawal and deletion
- You can withdraw Analytics through Cookie settings at any time; further measurement then stops.
- Data transfers
- Vercel processes event and technical information under its own privacy notice. We remove additional information from shared public page addresses.
Vercel Speed Insights
- Provider
- Vercel
- Purpose
- Web Vital measurements of loading and interaction speed on public and signed-in customer pages; admin, pre-sign-in account and unknown paths are excluded.
- Category
- Analytics
- Duration
- This configuration does not create analytics cookies or persistent browser identifiers.
- Activation
- Only on approved public and signed-in customer pages of the production website, when the service is enabled and the updated Speed Insights notice is accepted.
- Legal basis
- Your consent to the Analytics category.
- Withdrawal and deletion
- You can withdraw Analytics through Cookie settings at any time; further measurement then stops.
- Data transfers
- Vercel processes performance and technical information under its own privacy notice. We remove additional information from shared page addresses.
_ga
- Provider
- Google Analytics (Google Ireland Limited)
- Purpose
- Distinguishes website visitors and supports aggregated statistics about how the website is used.
- Category
- Analytics
- Duration
- 2 years by default; its expiry may be refreshed when it is used.
- Activation
- Only after Analytics is accepted and Google Analytics loads.
- Legal basis
- Consent under Article 6(1)(a) GDPR and consent to storage of and access to information on the device.
- Withdrawal and deletion
- You can withdraw Analytics through Cookie settings at any time. Future measurement then stops and Google Analytics cookies accessible to the website are deleted. Browser site data can also be cleared separately.
- Data transfers
- Google may process data outside the European Economic Area, including in the United States. Google’s current privacy information describes the applicable safeguards, such as an adequacy decision or standard contractual clauses.
_ga_<identifier>
- Provider
- Google Analytics (Google Ireland Limited)
- Purpose
- Maintains session state for the relevant GA4 data stream and supports aggregated website-usage measurement.
- Category
- Analytics
- Duration
- 2 years by default; its expiry may be refreshed when it is used.
- Activation
- Only after Analytics is accepted and Google Analytics loads.
- Legal basis
- Consent under Article 6(1)(a) GDPR and consent to storage of and access to information on the device.
- Withdrawal and deletion
- Withdrawing Analytics stops future measurement and deletes GA4 cookies accessible to the website; browser site data can also be cleared separately.
- Data transfers
- Google may process data outside the European Economic Area under the applicable safeguards described in its current privacy information.
Google Tag Manager (bloombydori.hu)
- Provider
- Google Ireland Limited
- Purpose
- Controls the loading of consented Google Analytics tags and passes permitted measurement events.
- Category
- Analytics
- Duration
- In the current configuration, it does not set its own separate persistent cookie; the tag manager runs only on permitted page loads.
- Activation
- Only after Analytics is accepted. Before that, the default Google consent states are denied.
- Legal basis
- Consent under Article 6(1)(a) GDPR.
- Withdrawal and deletion
- After Analytics is withdrawn, new analytics tags do not load and the consent state changes to denied.
- Data transfers
- Loading and using the tag may transmit technical data to Google, which may process data outside the European Economic Area under the safeguards described in its current privacy information.
_fbp
- Provider
- Meta Platforms Ireland Limited (Meta Pixel)
- Purpose
- Supports browser distinction, attribution to Meta ads, campaign optimisation and the creation of remarketing audiences.
- Category
- Marketing
- Duration
- Typically up to approximately 3 months under the current Meta Pixel configuration; the actual period may also be affected by Meta’s current technical settings and browser restrictions.
- Activation
- May be created only when Meta Pixel is enabled and after consent to Marketing. Meta Pixel does not load before the Marketing choice is accepted.
- Legal basis
- Consent under Article 6(1)(a) GDPR and consent to storage of and access to information on the device.
- Withdrawal and deletion
- Withdrawing Marketing stops future Meta measurement and deletes the _fbp cookie accessible to the website. Browser site data can also be cleared separately.
- Data transfers
- The identifier and related event and technical data may be sent to Meta Platforms Ireland Limited. Meta may process data outside the EEA, including in the United States, under the applicable safeguards described in its current notice.
_fbc
- Provider
- Meta Platforms Ireland Limited (Meta Pixel)
- Purpose
- Stores an ad-click identifier for visits arriving from a Meta ad so that later consented events can be attributed to the relevant advertisement.
- Category
- Marketing
- Duration
- Created only when a suitable Meta ad-click identifier exists; typically up to approximately 3 months under the current configuration, subject to Meta’s and the browser’s current settings.
- Activation
- May be created only when Meta Pixel is enabled, a valid ad-click identifier exists and the visitor has consented to Marketing.
- Legal basis
- Consent under Article 6(1)(a) GDPR and consent to storage of and access to information on the device.
- Withdrawal and deletion
- Withdrawing Marketing stops future Meta measurement and deletes the _fbc cookie accessible to the website. Information previously received by Meta may remain subject to Meta’s own retention rules.
- Data transfers
- The identifier and related event and technical data may be sent to Meta Platforms Ireland Limited and processed outside the EEA under the safeguards described in Meta’s current notice.
Google Maps
- Provider
- Google Ireland Limited
- Purpose
- Displays the studio’s location on an interactive map.
- Category
- External services
- Duration
- Google may use its own cookies or other storage when the map is loaded; their duration is determined by Google’s current settings.
- Activation
- The map does not load automatically. A connection to Google is created only after selecting Load map or allowing External services.
- Legal basis
- Consent under Article 6(1)(a) GDPR and consent to optional storage of and access to information on the device.
- Withdrawal and deletion
- Withdrawing External services prevents the map from loading automatically in the future. Data already stored by Google can be deleted through the browser’s site-data controls.
- Data transfers
- Loading may send the IP address and browser information, among other technical data, to Google. Google may process data outside the European Economic Area under the safeguards described in its current notice.
Changing or withdrawing consent
You can reopen your choices at any time through Cookie settings in the footer. Withdrawing an optional category is as easy as accepting it and does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
You can also delete or block all site data through your browser. Completely blocking necessary technologies may prevent basic functions, such as remembering your choice, from working correctly.
International data transfers
Vercel, Google, Meta and their supporting providers may process technical or personal data outside the European Economic Area. Any such transfer must rely on an applicable GDPR safeguard, such as an adequacy decision or standard contractual clauses. The exact safeguards should always be checked against the relevant provider’s current privacy notice.
Meta’s information about cookies
Meta Pixel, the cookies Meta uses, processing purposes, retention and Meta’s own controls may change over time. Meta’s official cookie information describes the current details.
Contact and changes
Send questions about cookies or similar technologies to info@bloombydori.hu. We update this notice when services, technical settings or legal requirements change and will request consent again where required.