Cookie Policy

Staging version — updated 9 November 2026. This policy includes the cookies and browser storage observed in Chrome on 9 November 2026, before a choice, after acceptance, after refusal from a clean start, and after withdrawing an earlier acceptance. Unverified details are stated explicitly.

Website and contact

The website presents The Windmill Club and Windmill 2, trading as Windmill Pattaya, on Soi Diamond, Pattaya, Thailand. The Windmill Club’s available venue address is 29/79 Soi Diamond, Pattaya, Thailand. Windmill 2 is directly opposite. The legal operator’s name and registered address and a dedicated privacy email have not yet been confirmed. For an enquiry, use the contact form. See also the Privacy Policy.

What cookies do

Cookies and similar browser storage can remember choices, support website functions and measure visits. Some cookies are used only when a particular service is used or an administrator signs in.

Consent choices

Complianz shows the consent banner, WP Consent API shares the selected categories with supported plugins, and Google Site Kit passes Consent Mode signals to Google.

• Accept: allows the optional categories shown in the banner.
• Deny: refuses optional categories. Functional consent remains enabled.
• View preferences: lets you choose individual optional categories.

Open “Manage consent”, available on the website, to review or change your decision. Withdrawing optional consent removes the Google Analytics cookies listed below. It does not remove necessary consent records or administrator login cookies. You can also delete cookies or block them through your browser settings; doing so can remove saved choices or affect functionality.

Measured cookie inventory

The 12 consent-record cookies below use windmillpattaya.com, path /. The two Google Analytics cookies use .windmillpattaya.com, path /, so their domain covers subdomains. Consent records are functional storage, including records that an optional category has been refused. Analytics identifiers are optional statistics storage.

Cookie name	Provider / purpose	Browser expiry measured from setting or renewal
cmplz_consented_services	Complianz. Records service-level consent choices.	365 days
cmplz_policy_id	Complianz. Records the version of the cookie policy associated with the choice.	365 days
cmplz_banner-status	Complianz. Remembers whether the consent banner has been dismissed.	365 days
cmplz_functional	Complianz. Records the functional category choice.	365 days
cmplz_preferences	Complianz. Records the preferences category choice.	365 days
cmplz_statistics	Complianz. Records the statistics category choice.	365 days
cmplz_marketing	Complianz. Records the marketing category choice; this is a consent record, not an advertising identifier.	365 days
wp_consent_functional	WP Consent API. Shares the functional consent state with supported plugins.	30 days
wp_consent_preferences	WP Consent API. Shares the preferences consent state with supported plugins.	30 days
wp_consent_statistics	WP Consent API. Shares the statistics consent state with supported plugins.	30 days
wp_consent_statistics-anonymous	WP Consent API. Shares the anonymous-statistics category state. This flag was allow after refusal; it is separate from the main statistics flag.	30 days
wp_consent_marketing	WP Consent API. Shares the marketing consent state with supported plugins.	30 days
_ga	Google Analytics via Site Kit. Google Analytics identifier used to distinguish browser visitors.	400 days observed in Chrome
_ga_MWRD0WHEQV	Google Analytics via Site Kit. Google Analytics cookie used to persist session state.	400 days observed in Chrome

These durations describe browser-cookie expiry, not how long a provider retains information on its servers. Expiry can be renewed. Google’s documentation describes a default of two years for Analytics cookies; the actual expiry returned by the tested Chrome browser was 400 days. See Google’s cookie purposes and cookie configuration information.

Verified Analytics data retention

On 9 November 2026, the Analytics property connected to staging (404395249, G-MWRD0WHEQV) was inspected: event data retention and user data retention were both set to 14 months. Reset on new user activity was enabled, so new activity can restart the user-identifier retention period. These settings concern user-level and event-level data, not browser-cookie expiry or a universal deletion deadline for aggregated reports. No Analytics settings were changed. See Google’s explanation of data retention.

What the consent tests showed

Test state	Observed result
Clean visit, before choosing	No new first-party cookies or Google-hosted reCAPTCHA cookie were observed on the tested routes. Google requests can still occur without cookies.
Accept	All 12 consent records and both Analytics cookies were present: 14 cookies.
Deny from a clean start	The 12 consent records were present. The two Analytics cookies were not created. Statistics, marketing and preferences were false in WP Consent API; functional consent was true. The separate anonymous-statistics flag remained true.
Accept, then withdraw with Deny	Retested on 9 November 2026 after enabling Complianz CookieShredder and registering the Analytics cookie group: both _ga and _ga_MWRD0WHEQV were removed after withdrawal. Neither cookie reappeared on the homepage, contact page or Windmill Club page. Statistics, marketing and preferences were false; functional consent remained true. Site Kit sent analytics_storage, ad_storage, ad_user_data, ad_personalization and personalization_storage updates with denied.

You can remove existing cookies through your browser settings. The focused withdrawal retest passed for the two Analytics cookies on the three routes listed above. This does not establish every aspect of consent compliance.

Other browser storage

Storage item	Purpose and observation	Duration
_grecaptcha in local storage	Google reCAPTCHA spam protection. It was recreated when the enquiry form was focused before a choice and after refusal, and was also present after acceptance. No form was submitted.	No cookie-style expiry or retention field was exposed in the 9 November 2026 check. No local retention setting was found in the staging integration. The provider’s deletion schedule remains unconfirmed.
wpEmojiSettingsSupports in session storage	WordPress emoji-support detection/cache. Observed during the visitor tests.	Browser tab session; session restoration can affect when a browser removes session storage.

No TranslatePress language cookie was observed when navigating the German version. No new cookie attributable to Trustindex reviews or profile-image hosts was identified in these runs. External requests can disclose connection information even without placing a cookie. Existing Google account cookies and older reCAPTCHA cookies belonging to other domains in this Chrome profile were not attributed to this website.

reCAPTCHA retention check

The staging reCAPTCHA integration was inspected on 9 November 2026. Neither the Contact Form 7 reCAPTCHA integration nor the theme’s lazy loader defines a local retention or expiry setting. The browser contained _grecaptcha in local storage after focusing the contact form; no expiry or retention field was exposed. No _GRECAPTCHA cookie was found on the checked site, google.com or recaptcha.net URLs in this run, so no cookie lifetime was verified for it. Google’s server-side reCAPTCHA retention and the local-storage deletion schedule remain unconfirmed; no duration is assumed from a default or from the lifetime of a verification token. See Google’s reCAPTCHA information.

Administrator and historical cookies

The initial signed-in browser also contained WordPress wordpress_logged_in_* and wordpress_sec_* cookies, marked as browser-session cookies, plus wp-settings-1 and wp-settings-time-1 with approximately 364 days remaining. These support login and administration preferences; their original setting time was not tested. An existing HttpOnly _lscache_vary cookie supports cache variation; its full original lifetime was not established. These were excluded from the clean public-visitor runs and the login session was restored afterwards.

An existing session cookie ff_news_session and an older Analytics cookie _ga_EQDN3BWDSD were present initially but were not recreated in the clean tests. They are historical observations, not evidence that Flow-Flow or that older Analytics property is currently active.

Scope of the inventory

Public browsing was checked on the homepage, both club pages, drink prices, photo archive, Our ladies, testimonials, About us, blog index, contact page, work-in-progress page, both legal pages and the German homepage: 14 routes. The contact form was focused without sending a message. Cookie metadata, including HttpOnly cookies available for the tested domains, browser expiry and consent flags were inspected. The measured table covers the cookies found in these flows, not every possible cookie in every browser, external destination, future article or authenticated feature. Browser settings and existing third-party sessions can change what external services store.

Google Consent Mode

Site Kit updates Google’s analytics, advertising and personalisation consent signals from your choices. Refusing optional storage does not necessarily stop all Google requests: Consent Mode can send limited, cookieless signals. The functional and security categories remain enabled. Consent Mode is a signalling mechanism and is not itself a cookie inventory.

External services and requests

Google reCAPTCHA is configured for contact-form spam protection. The website also loads Trustindex for reviews, external review images, and Girls Pattaya profile images hosted on Google Cloud Storage. These connections can disclose technical information such as IP addresses even where no cookie has been established. Social media and Google Maps links open external services. See Google’s privacy information and Trustindex’s privacy information.

Details still to confirm

The measured cookie names, purposes and browser expiry periods are listed above. The reCAPTCHA local-storage deletion schedule and Google’s server-side reCAPTCHA retention, provider processing locations and transfer arrangements remain unconfirmed. The verified Analytics retention settings are described above. Historical cookies from earlier configurations are not evidence that those services remain active.

The legal operator and dedicated privacy contact remain to be supplied. These gaps are also listed in the Privacy Policy. No unverified retention period or company identity has been filled in.