Notice version: 2026-09-10.6, published 10 September 2026.
This website is operated by Integral Zagreb d.o.o., Paromlinska 2/a, 10000 Zagreb, Croatia, OIB 11154562870. For privacy questions and rights requests contact info@integral-zagreb.hr. Office addresses are on the Contact page; additional information is in our Privacy statement.
Cookies are records stored by your browser for a website. We also use browser localStorage. Connecting to an external service can disclose your IP address, browser and page information even when no cookie is set. Analytics and advertising data are not anonymous merely because they do not include a name.
Your choice
Analytics, advertising and external content start off. You can accept all, reject optional purposes equally easily, or save an individual selection. Scrolling, continued use and closing settings are not consent. Analytics tags and measurement requests start only after permission has been successfully saved (Basic Consent).
Change or withdraw your choice using , also available at the bottom of the existing footer. Withdrawal stops further loading immediately, without waiting for the server. We remove accessible first-party optional cookies and the associated localStorage and sessionStorage records for withdrawn purposes, including residual identifiers from the former help widget and the Meta session record, but cannot erase other domains' cookies or undo information already sent. A local safety record keeps withdrawn purposes off if saving fails. New permission requires a successful save.
Basic content, addresses and forms remain available after rejection. Disabled maps show an explanation. Video opens through a clearly labelled link on the provider’s website in a new tab; no YouTube player loads inside this website, even after acceptance. The external website provides its own privacy information and controls. Newsletter permission is separate and is not required to contact us or buy a service. Sharing links connect to the selected service only when clicked.
Storage and purposes on this website
Storage and integrations, version 2026-09-10.6
Record / provider and domain
Purpose and activation
Duration and type
integral_consent_receipt — www.integral-zagreb.hr
Necessary signed choice verification against the latest server state, after saving acceptance, rejection or a change.
Cookie: 182 days from saving. Secure, HttpOnly, SameSite=Lax, Path=/.
integral_consent_ui — www.integral-zagreb.hr
Displays your settings; this cookie alone never authorizes tracking.
Cookie: 182 days from writing. Secure, not HttpOnly, SameSite=Lax, Path=/.
integral_consent_pending — www.integral-zagreb.hr
Safety restriction during every save and after failure, preventing old permission from returning; cannot grant new permission.
Cookie up to 182 days, Secure, not HttpOnly, SameSite=Strict, Path=/; plus localStorage without built-in expiry. Both are removed after a confirmed save.
integral_request_ref — www.integral-zagreb.hr
Random technical reference for a requested form/favourites function, not a device fingerprint. Forms may pass it to the inquiry processing system.
Page memory; cookie written with the action, up to 7 days. Secure, not HttpOnly, SameSite=Strict, Path=/.
compare, favorite, favorite_registered — first party
User-requested comparison and favourites, or favourites registration status; not analytics permission.
Code sets 7 days for compare/favorite. The favorite_registered call has no persistent expiry; session restoration can affect duration. Not observed on a fresh ordinary visit.
_ga, _ga_ZJ46MFVTCZ — Google Analytics, integral-zagreb.hr; connections to googletagmanager.com and google-analytics.com
Analytics of public pages only with analytics permission. Existing GA4 measurement is retained without advertising features in this category.
Cookies: approximately 400 days from writing/renewal in tested browsers. Secure, not HttpOnly, SameSite=Lax, Path=/. This is not the Analytics account's data retention period.
_gcl_au, potentially _gcl_* — Google Ads, integral-zagreb.hr; google.com, doubleclick.net, googleadservices.com
Ad measurement and remarketing with separate advertising permission. Ad identifiers also depend on arrival from an advertisement.
_gcl_au measured at about 90 days, Secure, not HttpOnly, SameSite=Lax, Path=/. Other _gcl_* periods were not measured using a real advertising click.
Checks whether the browser can accept cookies as part of Google advertising services. On this website it belongs to the optional Advertising category and may be set after permission for that category, for example by choosing Accept all. Google labels its technical purpose Functionality; that does not make it necessary for the basic operation of this website.
15 minutes from being set, according to Google’s official list. This is a third-party cookie and the browser may block it. This website cannot directly delete a cookie on .doubleclick.net. Google’s official cookie list
Advertising and measurement with advertising permission; existing Meta pixel and SDK.
_fbp measured at about 90 days, not HttpOnly, without Secure in the test, SameSite=Lax, Path=/. _fbc not observed without an ad click. SDK localStorage has no built-in expiry and is removed on advertising withdrawal.
OpenStreetMap Foundation — tile.openstreetmap.org; CARTO — cartodb-basemaps-*.global.ssl.fastly.net
OpenStreetMap displays the contact map and the existing CARTO service displays travel maps, after external-content permission on pages containing maps. Providers receive IP address, browser information and website referrer. Addresses remain available without maps. Mapbox is no longer used.
Network resources and cache; no specific cookie lifetime established for these displays. Cache duration is not provider data retention.
YouTube — youtube.com and associated provider domains
Outbound link to the original video, without loading a player on this website. YouTube is contacted only if the visitor opens that external website.
Storage depends on the provider, settings and browser; no unmeasured universal names or lifetimes are asserted.
Former integration, disabled since version 2026-09-10.4. Help now links to our own contact page without loading ChipBot or requiring external-content permission.
This website no longer creates new records for this widget. Previously transmitted provider data has not been erased by this change; provider retention is unconfirmed.
_gcl_ls — Google Ads; lastExternalReferrer and lastExternalReferrerTime — Meta; first-party localStorage
Advertising attribution and external-referrer information, only after advertising permission.
localStorage has no built-in browser expiry. SDK periods are not confirmed; these keys are removed when advertising permission is withdrawn.
x-cb-sid — cookie, ChipBot on www.integral-zagreb.hr
Residual storage from the former, now disabled widget. Accessible records are removed when checking the choice on a page, even when maps are permitted, and on external-content withdrawal. The new Help link does not create these records.
Observed session cookie without Expires/Max-Age; host-only, Path=/, neither HttpOnly nor Secure, SameSite=Lax in Chromium. Browser session restoration may extend its lifetime.
x-cb-sid and cb-edge-session — localStorage, ChipBot on this website origin
Residual storage from the former, now disabled widget. Accessible records are removed when checking the choice on a page, even when maps are permitted, and on external-content withdrawal. The new Help link does not create these records.
localStorage has no built-in deletion period. SDK internal validity is not the same as physical removal from browser storage.
cb-edge-session-id — sessionStorage, ChipBot on this website origin
Residual storage from the former, now disabled widget. Accessible records are removed when checking the choice on a page, even when maps are permitted, and on external-content withdrawal. The new Help link does not create these records.
Browser-tab storage; session restoration may affect its lifetime. Removed on withdrawal, not only when closing the browser.
fbssls_2336472773071113 — sessionStorage, Meta SDK on this website origin
SDK session status record; this website assigns the SDK to Advertising. Removed when advertising permission is withdrawn.
Browser-tab storage; the SDK also checks internal validity. That period is not presented as automatic physical deletion.
No Drupal session cookies or sessionStorage records were observed on fresh public visits; necessary sessions may still be used in particular requested workflows. Global fonts, icons and Bootstrap are served locally. Help links to our contact page without an external widget, additional fonts or storage. Accessible old ChipBot records are removed when checking the choice on a page. The old cc_cookie authorizes nothing. Browser limits, deletion and session restoration can affect observed durations.
Choice: 182 days; history: 30 days
The confirmed current choice and signed cookie last 182 days from saving; ordinary browsing does not extend the server expiry. Minimal server history records time, action, purposes, language, notice version and a pseudonymous browser reference. Historical events are retained for 30 days and removed by a daily task after expiry, not at the exact second. Current state is kept separately until the choice expires for verification and protection against replay of an old record.
The ledger contains no name, email address, full IP address or device fingerprint. A separate short-lived pseudonymous network reference limits abusive writes; ordinary server access logs are not this ledger. A random reference does not prove a person's identity. With 30-day history, the complete sequence cannot be reconstructed six months later. Deleting browser storage breaks the practical link to previous choices. Archived notices contain no visitor data.
Providers and your rights
The Meta pixel configuration also contains cloud destinations on AWS (on.aws) and Google Cloud (run.app). Connections to these destinations are currently blocked by this integration’s security policy pending confirmation of their operators and roles; complete advertising measurement is therefore not verified. The former ChipBot widget and its Sentry diagnostics are no longer loaded.
Provider information: Google, Meta, OpenStreetMap Foundation, CARTO. Services may involve international processing. This notice does not assume unverified contracts, transfer mechanisms, Google account retention or backup periods.
Contact the controller for information, access, correction, erasure, restriction, portability or objections where applicable. Withdrawing consent does not affect the lawfulness of processing before withdrawal. You may complain to the Croatian Personal Data Protection Agency (AZOP).
Sign up for our newsletter, get extra
discounts and do not miss dream trips
