Cookie Policy
Last updated: 13 October 2026
This policy explains which cookies and similar technologies the bosfora.ro / bosfora.eu / bosfora.tr website uses, for what purpose, on what legal basis, and how you can manage your choice.
Controller: ROMANYA VATANDASLIGI SRL ("Bosfora Group"), tax ID (CUI) 50106890, Trade Register no. J40/10083/2024, registered office: Bucharest, Bd. Regina Elisabeta nr. 7-9, 2nd floor, room 34, Sector 3; business office: Louis Blanc Offices, Str. Arhitect Louis Blanc nr. 1, Et. 4, Sector 1, Bucharest, Romania; email: office@bosfora.ro (opens in a new tab).
1. What cookies and similar technologies are
Cookies are small files stored in your browser by the site you visit (first-party cookies) or by a third-party provider (third-party cookies). Similar technologies (localStorage, tags, pixels, identifiers in the URL) are treated the same way in this policy.
2. Legal basis
- Strictly necessary cookies do not require consent (art. 4(6) of Romanian Law no. 506/2004, transposing art. 5(3) of Directive 2002/58/EC, the "ePrivacy Directive").
- Analytics and marketing cookies are set only with your prior consent (art. 4(5) of Law no. 506/2004; art. 6(1)(a) GDPR). Refusing does not limit your access to the site in any way.
- You can withdraw your consent at any time (art. 7(3) GDPR), as easily as you gave it (see section 5). Withdrawal does not affect the lawfulness of processing carried out before.
- The cookieless statistics tool (section 4) runs on our legitimate interest in understanding how the site is used (art. 6(1)(f) GDPR), without storing anything on your device.
3. What cookies and similar technologies we use
Essential (no consent required)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
cookie-consent | Bosfora (localStorage + cookie) | Remembers your cookie choice (categories, date, policy version) | 6 months |
NEXT_LOCALE | Bosfora | Remembers your language (ro / en / tr) | 12 months |
Analytics (only with consent)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics 4 (Google Ireland Ltd.) | Pseudonymous identifier to distinguish visitors and measure traffic | 24 months |
_ga_* | Google Analytics 4 | Keeps the current session state | 24 months |
Google Analytics 4 is loaded through Google Tag Manager only after you enable the "Analytics" category.
Marketing (only with consent)
| Name | Provider | Purpose | Duration |
|---|---|---|---|
ad_click_ids | Bosfora | Keeps the click identifiers of the advertising campaign that brought you to the site, so that a later enquiry can be attributed to the right campaign. Parameters kept: gclid, dclid, gbraid, wbraid (Google Ads), fbclid, igshid (Meta), msclkid (Microsoft), ttclid (TikTok), twclid (X), mc_cid, mc_eid (Mailchimp), _hsenc, _hsmi (HubSpot) and utm_* | 90 days |
_gcl_au | Google Ads (Google Ireland Ltd.) | Conversion measurement for Google Ads campaigns | 90 days |
_gcl_aw, _gcl_dc, _gcl_gb and _gcl_ls (localStorage) | Google Ads (Google Ireland Ltd.) | Keep the Google Ads click identifier (Conversion Linker) so an enquiry can be attributed to the ad | 90 days |
_fbp, _fbc | Meta Pixel (Meta Platforms Ireland Ltd.) | Conversion measurement for Meta (Facebook / Instagram) campaigns | 90 days |
The Google Ads and Meta Pixel tags are loaded through Google Tag Manager only after you enable the "Marketing" category. If you submit the contact form with this category enabled, your email address and, if you provided it, phone number are sent to Google Ads and Meta, and your first name to Meta only, in pseudonymised form (SHA-256 hash) to measure the campaign conversion ("enhanced conversions"). A hash is still personal data: the provider can match it against data it already holds about you. Links between bosfora.ro, bosfora.eu and bosfora.tr carry a _gl parameter (Google cross-domain linker) only with this category enabled; the site removes it from the address bar once it has been read. Details in the Privacy Policy.
Third-party content
The site loads no embedded third-party content (maps, video, fonts). The map on the Contact page is a static image hosted on our own server; it contacts no external provider and sets no cookies. The "Open in Google Maps" link takes you to Google's site only if you click it.
4. Cookieless statistics
Basic traffic statistics are collected through a cookieless analytics tool (Rybbit, an instance we operate ourselves on servers rented from Hetzner Online GmbH in Germany; the data is not passed to any other party) that stores nothing on your device, does not track you across other sites and produces aggregated data only (pages visited, country, device type). Your IP address is not retained.
We rely on our legitimate interest in knowing which pages are useful so we can improve the site. We weighed it against your interests: nothing is stored on or read back from your device later, there is no tracking across sites or profiling, and only aggregate figures come out. You can object to this processing at any time (art. 21 GDPR) by writing to office@bosfora.ro (opens in a new tab).
5. Managing your choice
- On your first visit, the cookie banner lets you accept all categories, keep only the necessary cookies, or pick categories individually under "Preferences".
- At any later time, click "Cookie settings" in the footer of every page to change or withdraw your choice. On withdrawal, the analytics and marketing cookies set by us and by the tags loaded through Google Tag Manager are deleted, and those tools are no longer loaded.
- Your choice is remembered for 6 months; after that, or after a change to this policy, the banner will ask again.
- You can also block or delete cookies in your browser settings (Chrome (opens in a new tab), Firefox (opens in a new tab), Safari (opens in a new tab), Edge (opens in a new tab)). Clearing the site's data makes the banner reappear.
- Additional opt-outs offered by the providers: Google Analytics opt-out (opens in a new tab), Google Ads settings (opens in a new tab), Meta ad preferences (opens in a new tab).
6. Transfers outside the EEA
Google and Meta also process the data from their cookies in the United States. Transfers rely on the adequacy decision for the EU-U.S. Data Privacy Framework (Google LLC and Meta Platforms, Inc. are certified) and, in addition, on the standard contractual clauses approved by the European Commission. Provider policies: Google (opens in a new tab) · Meta (opens in a new tab).
7. Your rights
You have the right of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, as well as the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP). Details and how to exercise them in the Privacy Policy.