Cookie policy

In accordance with Article 22.2 of Ley 34/2002, de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI), the GDPR and the guidelines of the Agencia Española de Protección de Datos (Spanish Data Protection Agency), we inform you of the cookies used by www.pekata.ch, of what else it stores in your browser and of how you can manage it.

1. What are cookies?

A cookie is a small file that is downloaded to your device when you access certain websites in order to store and retrieve information about your browsing. Similar technologies, such as the browser's local storage, perform equivalent functions, and this policy also covers them. The information collected by these means may constitute personal data, in which case our Privacy policy also applies.

2. What this site stores in your browser

This is the full inventory, divided into four groups: technical storage, essential for the site to function and exempt from consent; measurement and advertising cookies, which are only installed if you accept them in the cookie notice; those for card payment, which are only loaded if you pay by card for samples or a purchase; and the video player, which only loads if you click on a product video.

a) Technical storage, exempt from consent

• pekata_merch_quote (local storage · first-party · technical · until you delete it): the products, quantities and branding you have added to your quote, so that they are still there if you close the tab and come back another day.
• pekata_merch_quote_form (session storage · first-party · technical · until you close the tab): what you have typed into the quote form, so that it is not lost when moving from one step to the next.
• pk-consent and pk-consent-at (local storage · first-party · technical · 24 months): whether you accepted or rejected cookies and the date on which you did so, so that we do not have to ask you again on every visit.
• pekata_merch_samples (local storage · first-party · technical · until you delete it): the samples you have chosen (products, colours, sizes and units), so that they are still there until you pay for them.
• pekata_merch_samples_form (session storage · first-party · technical · until you close the tab): what you have typed into the samples form and the reference of the payment in progress, so that they are not lost when moving from one step to the next and a second payment is not opened.
• pekata_merch_checkout_pending (session storage · first-party · technical · until you close the tab): the reference of the purchase whose card payment is part-complete, so that it can take you back to it if you reload the page and a second payment is not opened.

None of them is sent to third parties or used to identify you or track your browsing on other sites. The language in which you view the site is part of each page's address and is not stored in your browser.

b) Measurement and advertising, only if you accept them

They are loaded through Google Tag Manager and are not installed until you accept them: the site starts with Google's consent mode (Consent Mode v2) with everything denied by default.

• _ga (cookie · Google Ireland Limited · analytics · 2 years) and _ga_<stream ID> (cookie · Google Ireland Limited · analytics · 2 years): Google Analytics 4. They make it possible to distinguish visitors and sessions and to measure the use of the site statistically (pages visited, traffic source) in order to improve it.
• _gcl_au (cookie · Google Ireland Limited · advertising · 90 days): Google Ads. It makes it possible to attribute quote requests to an advertisement and thus to measure the effectiveness of our campaigns.
• gclid, gbraid, wbraid, gad_campaignid, msclkid, oppref, utm_source, utm_medium, utm_campaign, first_landing_page and first_referrer (local storage · first-party · advertising · no expiry): where you first arrived at this site from (the page you entered through and the referring website) and, if you came from a Google, Microsoft or OpenAI ad or from a campaign link, its identifier and campaign. They are stored by the site itself, not by Google Tag Manager, and travel with your quote request so that we know which advertising brings us customers. They do not expire by themselves: they stay there until you delete this site's data in your browser, and the ad identifier is replaced if you come in again from another one.
• _fbp and _fbc (cookies · Meta Platforms Ireland Limited · advertising · 90 days): Meta pixel. They make it possible to measure the effectiveness of our campaigns on Facebook and Instagram, by recording whether a visit came from an advertisement, and to show our ads on those platforms to people who have visited this site. The pixel is loaded directly from connect.facebook.net and only after cookies have been accepted. More information: facebook.com/privacy/policies/cookies.
• _uetsid (cookie · Microsoft Ireland Operations Limited · advertising · 1 day), _uetvid (cookie · Microsoft Ireland Operations Limited · advertising · 13 months) and _uetmsclkid (cookie · Microsoft Ireland Operations Limited · advertising · 90 days, only if you arrive from a Microsoft ad): Microsoft Advertising Universal Event Tracking (UET) tag. They make it possible to measure the effectiveness of our campaigns on Bing, by recording whether a visit came from an advertisement, and to show you our ads on the Microsoft network. The tag also keeps a copy of all three in local storage, with their expiry date. It is loaded directly from bat.bing.com and only after cookies have been accepted; Microsoft may also use cookies on its own domains, such as MUID on bing.com. More information: privacy.microsoft.com/privacystatement.
• __oppref (cookie · OpenAI Ireland Limited · advertising · 30 days, only if you arrive from an ad in ChatGPT), __obref (cookie · OpenAI Ireland Limited · advertising · 12 months) and __oaiq_consent (cookie · OpenAI Ireland Limited · advertising · 30 days): OpenAI Ads measurement pixel. The first two make it possible to measure the effectiveness of our campaigns in ChatGPT, by recording whether a visit came from an ad in ChatGPT; the third remembers whether the pixel may measure. The pixel is loaded directly from bzrcdn.openai.com and only after cookies have been accepted; if you withdraw your consent, it deletes the first two and the third records that it may no longer measure. OpenAI may also use cookies on its own domains, such as __cf_bm on bzrcdn.openai.com. More information: openai.com/policies/eu-privacy-policy.

For more information about Google's cookies and its use of data: policies.google.com/technologies/cookies and business.safety.google/adscookies.

c) Paying by card, only if you pay by card for samples or a purchase

Samples and direct purchases can be paid for by card on the site itself. When you reach the payment step, and only then, two third-party services that are essential for that payment are loaded; for that reason they do not require your consent:

• Stripe (Stripe Payments Europe, Limited · payment and fraud prevention): processes the card payment. To prevent fraud it installs its own cookies on this site, such as __stripe_mid (1 year) and __stripe_sid (30 minutes), and others on its own domains. More information: stripe.com/cookies-policy/legal.
• Cloudflare Turnstile (Cloudflare, Inc. · security): checks that the person paying is a human and not an automated program. It is loaded from challenges.cloudflare.com and processes technical data from your browser solely for that check. More information: cloudflare.com/turnstile-privacy-policy.

d) Product videos, only if you click on one

Some product pages feature a video from the manufacturer. Until you click its thumbnail, you only see an image we provide; when you click it, and only then, a third-party player loads for viewing. As you request it, it does not require your consent:

• Vimeo (Vimeo.com, Inc. · video playback): it loads from player.vimeo.com with the do-not-track option (dnt), which prevents the player from collecting session data and statistics. To serve the video, it receives your IP address and technical data about your browser, and retains some essential cookies on its own domains. More information: vimeo.com/legal/privacy/cookies.

3. Cookie notice

The first time you visit, we show you a notice with two options, accept or reject, and the link to this policy. Until you accept, nothing for measurement or advertising is installed: Google's consent mode (Consent Mode v2) starts with everything denied by default. If you reject them, the site works normally: you can browse the catalogue, build your quote and send it all the same.

Your decision is stored for 24 months and, once that period has passed, we ask you again. You can change it whenever you like by clicking Cookie settings (also available in the footer), which opens the notice again: withdrawing consent is as easy as giving it. Please note that withdrawing it does not delete cookies that are already installed; you can delete those from your browser settings.

4. International transfers

The provider of the measurement and advertising services for the European Economic Area is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which is responsible for the data collected by its cookies. The processing may involve transfers of data to Google LLC (United States), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which Google is certified. They only take place if you have accepted these cookies.

The provider of the Meta pixel for the European Economic Area is Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). The processing may involve transfers of data to Meta Platforms, Inc. (United States), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which Meta is certified. They only take place if these cookies have been accepted.

The provider of the Microsoft Advertising tag for the European Economic Area is Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland). The processing may involve transfers of data to Microsoft Corporation (United States), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which Microsoft is certified. They only take place if these cookies have been accepted.

The provider of the OpenAI Ads pixel for the European Economic Area is OpenAI Ireland Limited (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland). The processing may involve transfers of data to OpenAI OpCo, LLC (United States), covered by the safeguards provided for in the GDPR, such as the standard contractual clauses approved by the European Commission. They only take place if these cookies have been accepted.

If you pay by card for samples or a purchase, Stripe and Cloudflare may process data in the United States (Stripe, Inc. and Cloudflare, Inc.), with the safeguards of the adequacy decision on the EU-U.S. Data Privacy Framework, under which both are certified, and, in the alternative, of the European Commission's standard contractual clauses.

If you click on a product video, Vimeo may process data in the United States (Vimeo.com, Inc.), under the safeguards of the adequacy decision of the EU-U.S. Data Privacy Framework, in which Vimeo participates.

5. How to manage cookies from your browser

In addition to the notice, you can view, block or delete the cookies and the storage that this site keeps on your device from your browser settings. If you delete it, any quote you had in progress is emptied and we ask you about cookies again, because your choice is deleted too:

• Google Chrome
• Safari
• Mozilla Firefox
• Microsoft Edge

6. Links to other sites

Our footer contains links to other websites, including our profiles on Instagram, LinkedIn and Facebook. They are ordinary outbound links, which by themselves do not set cookies while browsing this site; when visiting those sites, their own cookie policies apply. The Meta pixel described in section 2 is independent of those links and is only loaded if cookies are accepted.