Informative translation – in case of any discrepancy, the Slovak version prevails. Slovak version
Cookies and device storage – Rezerva booking pages
1. The rule
Storing information on a user's device, or accessing information stored there, is permitted only with the user's demonstrable consent. Consent is not required if the storage or access is strictly necessary to provide a service explicitly requested by the user (Section 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications, Article 5(3) of Directive 2002/58/EC). The rule applies not only to cookies but also to the browser's local storage and to scripts that collect data from the device (opinion of the Slovak Regulatory Authority for Electronic Communications and Postal Services (Úrad pre reguláciu elektronických komunikácií a poštových služieb) of 12 November 2025 on obtaining consent; EDPB Guidelines 2/2023). Supervision is carried out by the Regulatory Authority for Electronic Communications and Postal Services.
2. What is stored or loaded on the guest-facing pages
| Item | Set by | Type | When | Duration | Purpose | Third-party access |
|---|---|---|---|---|---|---|
cf.turnstile.u | Cloudflare (challenges.cloudflare.com frame) | local storage | only once the guest starts filling in the booking form | Cloudflare does not state a period; it remains until the browser deletes it | distinguishing a human from a bot when a booking is submitted; in doing so, the Turnstile script processes the IP address and browser and connection data | Cloudflare – as processor; it also uses the signals to improve Turnstile, as an separate controller |
__stripe_mid | Stripe (Stripe.js script on the page's domain) | cookie | only on the payment page | 1 year | fraud prevention for card payments | Stripe |
__stripe_sid | Stripe (Stripe.js script on the page's domain) | cookie | only on the payment page | 30 minutes | fraud prevention for card payments | Stripe |
| js.stripe.com and m.stripe.network frames, m.stripe.com domain | Stripe | session storage in the Stripe frames; cookie m on m.stripe.com (lifetime of approximately 13 months according to a test of 6 October 2026) | only on the payment page | as set by Stripe | fraud prevention for card payments | Stripe |
| OpenStreetMap map | OpenStreetMap Foundation (United Kingdom) | no storage; the browser sends the IP address and browser data to the map servers | only after clicking "Show map"; the address is always also given as text | – | showing the location | OpenStreetMap Foundation |
The guest-facing pages set no other cookies or storage items. Fonts are loaded from Rezerva's domain, not from third-party servers. There are no analytics, advertising pixels, social plugins or chat on the guest-facing pages.
3. Administration (client staff only)
| Item | Set by | Type | When | Duration | Purpose |
|---|---|---|---|---|---|
rz_adm | Rezerva | cookie with the HttpOnly, Secure, SameSite=Lax attributes | after login | 180 days; deleted on logout | logging the staff member in to the administration |
cf.turnstile.u | Cloudflare (challenges.cloudflare.com frame) | local storage | on the login page | Cloudflare does not state a period | protecting the login against bots |
| diary display setting (view, selected staff member) | Rezerva | local storage | when the staff member chooses the view themselves | until the staff member or the browser deletes it | remembering the view; not sent to the server |
4. Why the guest-facing pages show no consent banner
- Turnstile is loaded only at the step the guest has started themselves – when filling in the booking form. Without it, the online form could not be protected against automated abuse; the service explicitly requested by the guest is a secure online booking. The guest always has the option of booking by phone.
- Stripe is loaded only on the payment page, which the guest opens themselves, and is used for the secure processing of the payment the guest has requested.
- The map is loaded only after a click; without a click, nothing is sent.
- There is nothing on the pages that serves analytics, advertising or tracking.
Risk. The Regulatory Authority for Electronic Communications and Postal Services proceeds from the assumption that third-party cookies are, as a rule, not necessary. We have not found any decision of the Authority or of a court directly concerning Turnstile or Stripe's anti-fraud cookies; the classification above is our own assessment, and we recommend having it reviewed by a lawyer. As regards the rz_adm cookie, it should be taken into account that the Article 29 Working Party (WP29; Opinion 04/2012) did not consider persistent login cookies that survive the closing of the browser to be automatically exempt from consent.
5. Conditions that must remain true
Operating without a banner is possible only if all of the following hold. Before publication and after every change to the booking pages, this is verified by a clean page load without interaction (developer tools or an automated test): no requests to third parties and no cookies or storage items other than those listed.
- No analytics, advertising pixels, social plugins, chat or other embedded third-party services on the guest-facing pages.
- The Turnstile script is loaded and rendered only when the guest starts filling in the booking form, not when the page loads.
- Stripe.js is loaded only on the payment page.
- The OpenStreetMap map is loaded only after a click, and the address is always also given as text.
- Fonts are hosted on Rezerva's own domain – no Google Fonts or other external font servers, not even in e-mails.
- In the Cloudflare settings for the booking-page domains, no features that add cookies or scripts are enabled: Bot Fight Mode (
__cf_bm), challenges (cf_clearance), rate limiting rules with a cookie (_cfuvid) or automatic injection of Cloudflare Web Analytics; if any of them were enabled, they would have to be added to the table and assessed. - E-mails to guests contain no tracking pixels and no redirected links for measuring clicks.
- Every new item is entered in this document and assessed before deployment.
If any of the conditions ceases to hold, the booking pages need a consent banner that meets the Authority's requirements: consent before storage, a "Reject all" option in the first layer equivalent to "Accept", separate consent for each purpose, no pre-ticked options, withdrawal as easy as giving consent, and asking again no earlier than after 12 months.
6. Booking form on the client's website
If a client embeds the Rezerva booking form on its own website, the client handles the website's own cookies and analytics with its own banner. Under the conditions in section 5, the Rezerva form does not need consent and may be classified as necessary in the banner. The client must not add its own measurement or advertising code to the Rezerva booking pages.