DRAFT. This is a template written for review by a qualified lawyer in each country we sell in. It is not legal advice and it is not in force.
Cookie Policy
Version 1.0 · Effective 10 September 2026
The short version
We set the few cookies the site cannot work without. Everything else — analytics, advertising pixels, embedded video and maps — loads only if you say yes, and you can change your mind at any time from Cookie settings in the footer.
Rejecting is exactly as easy as accepting. We do not use cookie walls, and nothing is pre-ticked.
Categories
Strictly necessary. Keeps your basket and checkout together, protects the site from ticket bots, and remembers your cookie choice. These are always on: without them you could not buy a ticket.
Analytics. Anonymous, aggregated counts of which pages get looked at. We use a cookieless analytics provider, and even so it only loads once you accept.
Marketing. Advertising pixels that measure whether an ad led to a ticket sale. Off unless you turn them on.
Embeds. Video, social posts and maps hosted by other companies. Those load behind a click-to-load panel, so nothing reaches them until you ask for it.
Global Privacy Control
If your browser sends the Global Privacy Control signal, we treat marketing as rejected without asking you.
Changing your mind
Use Cookie settings in the footer. Turning a category off deletes the cookies we can delete from our side; your browser settings can clear the rest.
The cookies we set
The table below is generated from the same configuration the consent manager uses, so it cannot drift from what actually runs on the site.
Cookies and storage in use
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| sm_consentCookie | Santa Maria (first party) | Strictly necessary | Stores your cookie choices and the policy version they were given for. | 6 months |
| sm_orderCookie | Santa Maria (first party) | Strictly necessary | Keeps your ticket selection and pending order together during checkout. | Session (cleared when the order completes or expires) |
| __cf_bm / cf_challengeCookie | Cloudflare Turnstile | Strictly necessary | Tells a human from a ticket bot when you submit a form or start checkout. | Up to 30 minutes |
| Square Web Payments SDK storageLocal storage | Square | Strictly necessary | Set only on the payment step, to process the card payment securely and prevent fraud. Card details never touch our servers. | Session |
| Analytics measurementCookie | Plausible (cookieless) | Analytics | Counts page views and key actions without cookies or cross-site tracking. Loaded only if you accept analytics. | No cookie set |
| _ga, _ga_*Cookie | Google Analytics | Analytics | Counts visits and which pages get looked at, with the IP address shortened and advertising signals switched off. Loaded only if you accept analytics, and only where Google Analytics is configured. | Up to 2 years |