Cookies are small text files that websites save on your device when you visit them. They are used to remember things like session state or preferences, so you do not have to set them up every time you visit.

Besides cookies in the strict sense, imotrack may use similar technologies such as tracking pixels or browser local storage (localStorage / sessionStorage). For the purposes of this Policy, we call them all "cookies".

The applicable Spanish rule is art. 22.2 of Law 34/2002 (LSSI-CE), combined with art. 6.1.a GDPR for cookies that require consent. The design of our banner follows the AEPD January 2023 guidelines.

2.1. By whether they need your consent

Technical or strictly necessary cookies: Without them the platform does not work. They do not need your consent (art. 22.2 LSSI-CE).

Analytics and marketing cookies: Only installed if you accept them in the banner. Detailed in section 3.

2.2. By origin

First-party cookies: Generated directly by imotrack, like the JWT session token.

Third-party cookies: Generated by Google and Meta under their own policies. imotrack does not directly control the information they collect.

2.3. By duration

Session: Disappear when you close the browser.

Persistent: Remain on your device for the period indicated in section 3.

Full table of cookies imotrack installs or plans to install shortly:

Cookie / ID	Provider	Type	Duration	Purpose	Legal basis
TECHNICAL - No consent required
access_token (JWT)	imotrack (first-party)	Technical / session	30 days from last access	Keeps your session active. Without it the platform does not work.	Performance of contract (art. 6.1.b GDPR). Exempt from consent (art. 22.2 LSSI-CE).
ANALYTICS - Consent required
_ga	Google LLC (GA4)	Analytics	2 years	Identifies unique visitors to measure platform usage. Anonymised IP active.	Consent (art. 6.1.a GDPR / art. 22.2 LSSI-CE).
_ga_[ID]	Google LLC (GA4)	Analytics	2 years	Maintains GA4 analytics session state.	Consent (art. 6.1.a GDPR / art. 22.2 LSSI-CE).
_gid	Google LLC (GA4)	Analytics	24 hours	Distinguishes unique from recurring visitors over 24 hours.	Consent (art. 6.1.a GDPR / art. 22.2 LSSI-CE).
MARKETING - Consent required
_gcl_au / _gcl_aw	Google LLC (Google Ads)	Marketing / conversion	90 days	Measures conversions of Google Ads campaigns and links clicks to platform actions.	Consent (art. 6.1.a GDPR / art. 22.2 LSSI-CE).
_fbp	Meta Platforms Ireland Ltd.	Marketing / conversion	90 days	Identifies browsers to measure Facebook and Instagram conversions (Meta Pixel).	Consent (art. 6.1.a GDPR / art. 22.2 LSSI-CE).
_fbc	Meta Platforms Ireland Ltd.	Marketing / attribution	90 days	Stores the fbclid parameter from the click for conversion attribution.	Consent (art. 6.1.a GDPR / art. 22.2 LSSI-CE).
Meta CAPI (server-side)	Meta Platforms Ireland Ltd.	Marketing / server	No local cookie	Server-side conversion events. Only active if you accept marketing cookies.	Consent via banner. Only activated if user accepts the "marketing" category.

We have a consent management system letting you choose which cookies you accept before any non-essential cookie is installed on your device.

4.1. Banner design - Compliance with AEPD 2023 guide

The imotrack cookie banner meets the AEPD January 2023 guide criteria. Specifically:

• "Accept" and "Reject" buttons have the same visual weight: same size, same graphic style, same typography. We do not give greater prominence to acceptance. This is not aesthetic, it is a legal requirement.
• The banner appears on the first visit, before any non-technical cookie is installed.
• You can see the detail of each cookie category before deciding.
• We do not infer consent from continued browsing, scrolling or any other passive action.
• Rejecting is as easy as accepting: both options are on the banner first level, with no navigation maze.

4.2. Categories you can manage

• Necessary cookies: always on, not configurable.
• Analytics cookies: Google Analytics 4. Independent consent.
• Marketing cookies: Google Ads and Meta Pixel / Meta CAPI. Independent consent.

4.3. Change or withdraw your choice

You can change your cookie preferences at any time from the "Manage cookies" link in the footer, both on the public website and inside the app. Withdrawing consent does not affect what we did before withdrawal (art. 7.3 GDPR).

4.4. Consent record

We keep a record of consents given, with date, Policy version and accepted categories. This lets us demonstrate that processing is lawful if the AEPD ever asks for justification (art. 5.2 GDPR, accountability principle).

Provider	Location	Privacy policy
Google LLC (GA4 + Google Ads)	EEA (Standard Contractual Clauses for transfers)	https://policies.google.com/privacy
Meta Platforms Ireland Ltd. (Meta Pixel + CAPI)	Ireland (EU)	https://www.facebook.com/privacy/policy

Analytics and marketing cookies may involve transfers of data to servers in the United States (Google LLC, Meta Platforms, Inc.). These transfers rely on Standard Contractual Clauses adopted by the European Commission (art. 46.2.c GDPR). We never install these cookies without your prior consent.

Regardless of your banner choice, you can manage or delete cookies directly from your browser:

• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/es/kb/habilitar-y-deshabilitar-cookies-sitios-web
• Safari (macOS / iOS): https://support.apple.com/es-es/guide/safari/sfri11471/mac
• Microsoft Edge: https://support.microsoft.com/es-es/microsoft-edge/eliminar-las-cookies-en-microsoft-edge-63947406

Note that if you block the session token (JWT) from the browser, you will need to authenticate every time you enter the platform.

We will update this Policy when we change tools, add new cookies or when the rules change. We will warn you before changes take effect. If we add cookies that require consent, we will ask for it again.

If you have questions about the cookies we use, write to [email protected] or use the contact form in the imotrack.com footer.