FAQs
What are privacy policies?
According to art. 13 of the GDPR, the privacy policy is a legal document which explains to users and visitors how the company collects, transmits, processess or uses their data. It must be in a visible part of the web page and provide the required information in a clear and understandable format.
What information does the privacy policy have to include?
A privacy policy should inform users of the full scope of data processing, what data will be collected, and what will be done with it.
The privacy policy must include:
⦁ What information is going to be collected (name, emails, telephone…).
⦁ The purpose for which the data is collected.
⦁ Data retention time.
⦁ The person responsible for data processing.
⦁ How the data collected is processed.
⦁ Cookie policy (may be separate).
⦁ DSAR rights of users: rights of access, rectification, deletion and portability of their data.
⦁ International transfers: if data transfers are made to third parties outside the EU/EEA or countries with an adequacy decision.
What are cookies?
“Cookies” are data records that are sent from the web server to the user’s browser and stored there for later retrieval. They can be used for a number of purposes: some may be technically necessary for the functioning of your website, and others could be used for advertising or marketing purposes, to analyze user behaviour or provide social media plugins.
What types of cookies are differentiated in a cookie policy?
Cookies can be divided into different categories, which are based on the following criteria:
- Who manages the cookies.
Depending on who manages the cookies, we can differentiate between:
⦁ First-party cookies. These cookies are sent from a source that is managed by the owner of the website you are visiting. They contain some data that makes the website easier for you to use.
⦁ Third-party cookies. These cookies are sent to the user’s end device from a source that is not managed by the owner of the website, and are generally used to track your shopping or other activity across different websites.
The purpose of processing. Depending on the purpose, the cookies can be:
⦁ Technical cookies. Technical cookies are the ones that are essential for the correct functioning of a website. These are cookies that enable the user to surf the website and to use the various options or services on the website.
⦁ Personalisation cookies. These cookies enable the user to predetermine features on his end device according to a number of criteria, such as specify or personalise the language, browser type used to access the service, etc., and some features of the general website options.
⦁ Analytics cookies. Analytics cookies are those that enable their owner to monitor and analyze the behavior of the users of the website to which they are connected.
⦁ Advertising cookies. Advertising cookies are those that store information about user behaviour that is obtained by continuously monitoring surfing habits, which enables the development of a specific profile for displaying advertisements on this basis.
The duration that cookies remain stored:
⦁ Session cookies. These are temporary cookies that are deleted when the browser is closed. If the browser is restarted and you go back to the website, the website will not recognise the user again.
⦁ Permanent cookies. These cookies remain stored in a subfolder of the user’s browser until you manually delete them or their term, which is set in the cookie, has expired.
When is cookie consent required?
Consent is required for all cookies, unless they are ‘technically necessary’ to protect the legitimate interests of the website operator. Many websites incorrectly understand ‘technically necessary’ to mean any cookie they believe is important – this is not the case!
What is the legal notice of a website?
It is a document that must appear within a website and that must inform users about who owns the website and how it works. The legal notice is governed by Law 34/2002 on Information Society Services (LSSI). Any website that receives direct or indirect income, either by carrying out electronic commerce activities or by having or offering advertising, must comply with said law.
