What we actually use
We apply Indonesia's UU PDP and, where they reach you, the EU and UK rules on device storage.
Most of what this site stores is not a cookie at all — it is localStorage, which lives only in
your browser and is never transmitted to us. Your cart, your saved experiences and your currency preference
all work that way, which is why you do not need an account.
Strictly necessary — always on
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| ate.cart.v1 | localStorage | Keeps what you have added to the cart | Until cleared |
| ate.wishlist.v1 | localStorage | Remembers experiences you saved | Until cleared |
| ate.currency.v1 | localStorage | Remembers the currency you chose to view prices in | Until cleared |
| ate.cookieConsent.v1 | localStorage | Remembers your answer to the cookie banner, so we stop asking | 12 months |
| ate.lastBooking.v1 | sessionStorage | Shows your booking summary on the confirmation page | Until you close the tab |
These are essential to the checkout working. Under both the PDPA and the ePrivacy rules they do not require consent, and refusing them would mean the cart could not function.
Analytics
Cloudflare Web Analytics — always on, but stores nothing
Our host, Cloudflare, records a page view for each page loaded. It is cookieless: it writes nothing to your browser, reads nothing back, assigns you no identifier, and cannot follow you to another website. Because it stores nothing on your device, it falls outside the consent requirement that applies to cookies — so it runs whether or not you accept the banner, and we would rather say so than bury it.
What it collects is the page URL, the referrer, and coarse device and country information derived from the request. It is aggregated, it is not sold, and it is not used to build a profile of you.
Optional analytics — only if you agree
If you choose "Accept all", we may set privacy-respecting analytics that tell us which pages help people book and which confuse them. That data is aggregated, IP addresses are truncated before storage, and it is never used to build a profile of you or shared with advertisers. It is retained for 14 months.
Choosing "Necessary only" means no analytics cookies are set at all, and nothing about your visit is recorded beyond the cookieless page count above and the standard server access log described in the privacy notice.
What we do not use
- No advertising or retargeting pixels.
- No social-media tracking scripts.
- No cross-site or cross-device identifiers.
- No Google Analytics, and no third-party analytics that sets a cookie.
- No data brokers, and no sale of any data to anyone.
- No third-party font hosting — our typefaces are served from our own domain, so no request about you goes to a font provider.
Changing your choice
Clear this site's data in your browser and the banner will appear again on your next visit, letting you choose differently. In Chrome, Firefox, Safari and Edge this is under site settings for accesstransitexpress.com. Clearing it also empties your cart and saved list, because those live in the same place.
Questions to privacy@accesstransitexpress.com.