Cookie Policy

1. What cookies are

Cookies are files that a website or third party stores on or reads from a device. Equivalent technologies may also be used, including local storage, pixels, SDKs, identifiers and network requests.

This Policy uses the term “cookies” to refer collectively to those technologies where the relevant law applies to them.

2. Controller and scope

The controller of kuzado.com is KUZTOMER TECH IBERIA, S.L., with tax identification number B93896942 and registered office at Calle Durillo, 1, puerta A, planta 2, 28232 Las Rozas de Madrid, Madrid, Spain.

This Policy applies to kuzado.com and to the domains or applications that expressly link to it. Authenticated applications may use additional technologies required for authentication, security or the provision of a requested function.

Kuzado Consent is the consent-management platform used by Kuzado. It displays information relevant to the domain being visited, records and retains preferences and related evidence, prevents non-essential technologies integrated with its blocking mechanism from being enabled and provides Users with subsequent access to their preferences.

Not every page or application needs to display a banner. Where a domain uses only technical or strictly necessary technologies to transmit communications, authenticate, protect the session, retain a privacy choice or provide a function expressly requested by the User, those technologies may be used without prior consent. If non-exempt preference, analytics, marketing or other non-essential technologies are added, the Kuzado Consent panel will be displayed before they are enabled.

3. Categories

• Essential: enable browsing, preserve privacy choices, protect forms, authenticate the User or provide a requested function. They do not require consent where strictly limited to those purposes.
• Preferences: remember non-essential choices made by the User.
• Analytics: measure website use and performance for statistical purposes.
• Marketing: measure campaigns, attribute conversions or personalize communications or advertising.

Non-essential cookies are enabled only after a valid choice. Their classification depends on their actual purpose and configuration, not solely on the provider that sets them.

4. Technologies and domain-specific inventory

The technologies actually used depend on the domain and the enabled functions. The inventory published through Kuzado Consent forms part of this Policy and must identify, for the domain being visited, the name or identifier, type of storage, provider, purpose, category, domain, duration and, where applicable, third parties and international transfers.

The inventory must distinguish at least the following technologies when they are present:

Technology or family	Scope	Purpose	Category
kz_cmp_visitor and kz_cmp_consent_<domain>	Domains integrated with Kuzado Consent	Assign a pseudonymous identifier, remember the choice and evidence its version	Essential for privacy management
Language and interface preference, including NEXT_LOCALE where used	Website and applications	Remember a choice made by the User	Essential where it responds to the requested choice; otherwise, preferences
__Host-kuztomer_refresh and __Host-kuztomer_csrf cookies, including product-specific variants	Auth and authenticated applications	Maintain and renew the session and prevent CSRF attacks	Strictly essential
Account session storage	Kuzado Account	Authentication, return after access, Organization selection and idempotency	Strictly essential
Cross-tab renewal coordination and local Account preferences	Kuzado Account	Prevent concurrent renewals and remember interface settings	Essential functionality or preferences, depending on the actual purpose
Google Places	Kuzado Account, where address search is enabled	Assist with address search and selection, with manual entry available as an alternative	Functionality subject to prior consent
External identity providers	Auth, where the User chooses Google or Microsoft	Authenticate through the selected provider	Requested service; cookies on the external domain are governed by that provider's policy

Authentication cookies are retained for the session or the configured security period. As a general rule, a renewable session may remain active for up to 30 days of inactivity, subject to an absolute maximum of 90 days. A preference recorded by Kuzado Consent will be retained on the device for the period indicated in the panel, which will not exceed 24 months before a new choice is requested, or until the applicable version changes, the choice is withdrawn or the User deletes local storage.

The presence of a tool in source code or in an available configuration does not mean that it is used on every domain. Before a new technology is published or enabled, it must be added to the relevant domain's inventory and assigned the appropriate category.

5. Management through Kuzado Consent

Where non-essential cookies are used, Kuzado Consent will:

• provide information about the relevant purposes and third parties before enabling them;
• offer Accept and Reject at the same time, at the same level and with equal visibility;
• allow choices to be configured by purpose without preselected options;
• keep non-essential categories disabled by default and prevent their activation before a choice where scripts, tags, iframes or resources are integrated with its blocking mechanism;
• retain evidence of the preference without storing excessive data; and
• allow the choice to be withdrawn or changed at any time.

The evidence will include, at a minimum, the domain, the action taken, the decision by category, the versions of the banner and this Policy and the date of the choice. It may also include a pseudonymous visitor identifier, country, user agent, hashed IP address, the published configuration and its integrity hash. The full IP address is not used as the identifier for the evidence.

Evidence will be retained only for as long as necessary to demonstrate the choice and address applicable liabilities. The specific period must be stated in the domain's inventory or panel before publication and, once it expires, the evidence will be deleted or anonymized in accordance with the applicable configuration. This evidence-retention period is separate from the maximum 24-month period for requesting a new choice on the device.

Kuzado Consent does not automatically make resources compliant where an application loads them outside its integration. Each domain must technically block or condition its non-essential technologies and keep its inventory up to date.

Acceptance of the Terms, the Privacy Policy or a Subscription remains separate from the choice regarding cookies. Continued browsing or inactivity does not constitute consent.

6. How to change your choice

Where a domain uses technologies subject to consent or has deployed Kuzado Consent, the User may reopen the panel through the permanent Manage cookies link, change categories or withdraw consent. Withdrawal applies prospectively and does not affect the lawfulness of processing carried out beforehand.

Users may also delete or block cookies through their browser. Doing so may affect essential functions and does not replace the panel in relation to preferences and evidence managed by Kuzado Consent.

7. Transfers and third parties

Where an authorized technology involves processing outside the European Economic Area, an adequacy decision, Standard Contractual Clauses or another valid mechanism will be used, together with any appropriate supplementary measures. The panel will identify the third party and provide access to its information where applicable.

8. Changes and contact

This Policy will be updated when the technologies, purposes, providers or retention periods change. Where a change requires a new choice, the panel will request it again.

Questions may be sent to privacy@kuzado.com. For more information about personal-data processing, see the Privacy Policy.