Cookies Policy

Cookies are files that are installed on the user's browser to track their browsing history. They are commonly used in marketing to offer content, products, or services related to the user's interests.

In order to place a cookie on the user's browser, explicit consent must be obtained. This means that tacit or implied consent is no longer sufficient; it must be effective, voluntary, and unequivocal. For example, by checking an acceptance box.

"On the other hand, the intention to use the user's cookies must be presented through a two-layer information approach. The first layer simply indicates that the website uses third-party cookies, with a link to the second layer, which provides more detailed information about the purpose, whether the data will be shared with third parties, and the duration of retention in the database.

As a general rule, explicit consent from the user is required to place any cookie, but this is not always the case. For example, it is not necessary for cookies related to user input, security, multimedia playback, or authentication.

Legal Notice

The legal notice is a text that must be included on the website whenever it involves:

- Corporate websites
- Websites or blogs with advertising
- Online stores
- Portals offering the provision of some type of service

The legal notice must include the following information:

- Company/user name and contact details
- ID number, Tax Identification Number (NIF), or Foreigner Identification Number (NIE)
- Company registration number, if registered as a business entity
- Information about mandatory administrative authorizations obtained
- In the case of practicing a regulated profession, the details of the Professional Association, academic title, or ethical standards related to the practice of the profession must be provided.

COOKIES INFORMATION

The second paragraph of Article 22 of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce establishes:

“Service providers may use data storage and retrieval devices on the recipients' terminal equipment, provided that the recipients have given their consent after being provided with clear and complete information about their use, particularly regarding the purposes of data processing, in accordance with the provisions of Organic Law 15/1999, of December 13, on the Protection of Personal Data.

"When technically possible and effective, the recipient's consent to accept the processing of data may be provided through the use of the appropriate settings in the browser or other applications. This will not prevent the potential storage or technical access solely for the purpose of transmitting a communication through an electronic communications network or, to the extent strictly necessary, for the provision of an information society service expressly requested by the recipient.”.

In particular, it is important to clarify that, in accordance with the transcribed provision, it applies to any “data storage and retrieval devices” in any “recipient’s terminal equipment”, and that the annex of the aforementioned LSSI defines “Service recipient or recipient” as the “natural or legal person who uses, whether or not for professional reasons, an information society service”.

Therefore, Article 22 of the LSSI and this guide refer to the use of cookies and similar technologies used (such as local shared objects or flash cookies, web beacons or bugs, etc.) to store and retrieve data from terminal equipment (e.g., a computer, mobile phone, or tablet) of a natural or legal person who uses, whether or not for professional reasons, an information society service.

The legal obligations imposed by the regulations are two, namely: the obligation of transparency and the obligation to obtain consent.

Section two of Article 22 of the LSSI establishes that clear and complete information must be provided to users regarding the use of data storage and retrieval devices, and in particular, regarding the purposes of the data processing. This information must be provided, as stated, in accordance with the provisions of the GDPR, which requires that the processing of users' data be carried out transparently for them.

Consequently, the information about cookies provided at the time of requesting consent must be sufficiently complete to allow users to understand their purposes and how they will be used.

The cookie policy must include the following information:

- Definition and general function of cookies.
- Information about the type of cookies used and their purpose.
- Identification of who uses the cookies, that is, whether the information obtained through the cookies is processed only by the publisher and/or also by third parties with whom the publisher has contracted the provision of a service that requires the use of cookies, with identification of these third parties.
- Information on how to accept, deny, or revoke consent for the use of cookies as outlined through the functionalities provided by the publisher (the cookie management or configuration system that has been enabled) or through common platforms that may exist for this purpose.
- If applicable, information about data transfers to third countries carried out by the publisher.
- When profiling involves automated decision-making with legal effects for the user or significantly similar consequences, it will be necessary to provide information about the logic used, as well as the significance and expected consequences of such processing for the user, in accordance with the terms set out in Article 13.2(f) of the GDPR.
- Retention period of the data for the different purposes as established in Article 13.2(a) of the GDPR.
- Regarding the other information required by Article 13 of the GDPR that does not specifically refer to cookies (for example, the rights of data subjects), the publisher may refer to the privacy policy.

For the use of non-exempt cookies, the user's consent will always be required. This consent may be obtained through explicit methods, such as clicking on a section that says “I consent”, “I accept”, r other similar terms. It may also be inferred from an unequivocal action performed by the user, in a context where clear and accessible information has been provided regarding the purposes of the cookies and whether they will be used by the same publisher and/or third parties, in such a way that it is understood that the user agrees to the installation of cookies. In no case does the mere inactivity of the user imply consent by itself.

In accordance with section 2 of article 22 of the LSSI, consent must be given by the “recipients” of the information society services.

In accordance with section d) of the Annex of the LSSI, “Service recipient or recipient” refers to “the natural or legal person who uses, whether for professional reasons or not, an information society service”. And according to the definitions provided in the corresponding section, the term 'recipient' is equivalent to 'user', which is the term used in this guide.

Therefore, the information must be directed directly to the user so that they can express their consent or rejection.