Cookie policy

1. What are cookies and similar technologies

Cookies are small text files that websites store on the user's device (computer, mobile phone, tablet) when they visit a web page. These cookies allow the website to remember information about the user's visit, such as their language preferences, login data and other settings, thereby facilitating navigation and improving the user experience.

In addition to traditional cookies, Viuzi uses similar technologies such as:

• Local Storage: Allows data to be stored persistently in the user's browser without an automatic expiry date.
• Session Storage: Similar to local storage, but data is automatically deleted when the browser tab or window is closed.
• JWT Tokens (JSON Web Tokens): Authentication tokens stored locally to manage user sessions securely.

This cookie policy applies both to the web version of Viuzi (viuzi.com) and to the mobile applications for iOS and Android, insofar as they use equivalent local storage technologies.

2. Types of cookies used

2.1. Essential or necessary cookies

These cookies are essential for the basic functioning of the platform. Without them, Viuzi would not be able to provide the services requested by the user. They do not require prior consent under the ePrivacy Directive, as they are strictly necessary for the provision of the service.

Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in the security and operation of the platform).

They are used for:

• User session management and authentication (JWT tokens).
• Protection against cross-site request forgery (CSRF).
• Storage of the user's language preference.
• Recording the user's cookie consent status.
• Operation of the payment cart and transactional processes.

2.2. Functional cookies

These cookies allow the platform to remember choices made by the user and provide enhanced and personalised features. Their use requires prior consent from the user.

Legal basis: Art. 6(1)(a) GDPR (consent).

They are used for:

• Remembering the user's configuration preferences (visual theme, interface layout).
• Storing regional and localisation settings.
• Maintaining display preferences and applied filters.

2.3. Analytical cookies

Forward-looking section: This section describes the analytical cookies that may be used on the Platform. As of the date of this Policy, Viuzi does not use third-party analytical cookies in production (see Section 3.3).

These cookies allow Viuzi to collect information about how users interact with the platform, in order to improve its operation and user experience. The data collected is pseudonymised and aggregated, in accordance with the EDPB guidelines on anonymisation. Analytics identifiers do not allow the direct identification of the User, but constitute pseudonymised, not anonymous, data for the purposes of GDPR. Their use requires prior consent from the user.

Legal basis: Art. 6(1)(a) GDPR (consent).

They are used for:

• Analysis of usage and navigation patterns.
• Recording of pages visited and features used.
• Measurement of platform performance.
• Identification of errors and areas for improvement.

2.4. Marketing cookies

If implemented, these cookies would be used to display relevant advertisements to users and to measure the effectiveness of advertising campaigns. Their use requires prior and explicit consent from the user.

Legal basis: Art. 6(1)(a) GDPR (consent).

They would be used for:

• Personalised advertising based on user interests.
• Tracking advertising conversions.
• Remarketing on third-party platforms.

Note: As of the date of this policy, Viuzi does not use marketing cookies. Should they be incorporated in the future, this policy will be updated and the corresponding consent will be requested.

3. Table of specific cookies

3.1. Essential cookies

3.1.1. Notes on the classification of essential cookies

Cookie viuzi_lang: Classified as essential because the Platform operates in multiple languages and the interface cannot be rendered correctly without determining the user's language. However, if the competent supervisory authority considers this classification inappropriate, the cookie would be moved to the functional category under the same consent conditions.

Cookie __stripe_mid: Classified as strictly necessary because Viuzi is a services platform whose core functionality includes payment processing. Fraud detection in payment transactions is an essential and inseparable component of the service requested by the user, in accordance with the interpretation of Article 5(3) of the ePrivacy Directive for e-commerce platforms with integrated payment processing. This classification is based on the fact that its primary function (fraud prevention in payment transactions) is strictly necessary for the provision of the payment processing service, in accordance with the EDPB opinion on cookies necessary for fraud prevention. VIUZI ESP, SL will monitor the guidance of competent supervisory authorities on this classification and will adjust it if necessary. In the event of reclassification, this cookie would move to the functional category with the same consent mechanisms.

3.2. Functional cookies

3.3. Analytical cookies

As of the date of this policy, Viuzi does not use third-party analytical cookies in production. If third-party analytics services are implemented in the future (such as Google Analytics or others), this section will be updated with the full table of cookies, their purposes and durations. Such services will be configured with full IP anonymisation and without cross-tracking features (Google Signals or equivalents), and will be included as sub-processors in the Data Processing Agreement and in the Privacy Policy. Prior user consent will be requested before activating any analytical cookies.

4. Local storage and session storage

In addition to cookies, Viuzi uses the following browser storage technologies:

4.1. Local Storage

Security note: JWT tokens are stored in Local Storage due to the architectural requirements of the SPA (Single Page Application). To mitigate the risk of XSS attacks, the Platform implements: (a) restrictive Content Security Policy (CSP); (b) sanitisation of all user inputs; (c) short-lived tokens (30 minutes for access_token); (d) automatic rotation via refresh_token; (e) immediate session revocation in the event of suspicious activity. Migration to HTTP-only cookies as an additional protection measure is periodically evaluated.

| user_preferences | User configuration preferences (theme, language, notifications) | Persistent | JSON | | last_viewed | Record of the last items viewed to facilitate navigation | Persistent | JSON |

4.2. Session Storage

Data stored in session storage is automatically deleted when the browser tab or window is closed. Data in local storage persists until the user manually deletes it, logs out of the platform or the tokens are invalidated.

4.3. Storage Technologies in Mobile Applications

Viuzi's mobile applications (iOS and Android) use the following local storage technologies:

Viuzi does NOT use advertising tracking SDKs, advertising identifiers (IDFA/GAID), or third-party analytics tools in its mobile applications.

In the mobile application, consent is managed through the privacy settings panel accessible from the "Settings > Privacy" menu. The options are equivalent to the web banner. On the first launch of the mobile application, the User is presented with a privacy panel equivalent to the web consent banner, where they can accept, reject or customise the local storage categories. This initial consent is a prerequisite for the use of non-essential features. Preferences can be modified at any time from Settings > Privacy.

5. Third-party cookies

Viuzi integrates third-party services that may set their own cookies on the user's device. Viuzi does not control these cookies and recommends consulting the privacy policies of each third party.

5.1. Stripe

Viuzi uses Stripe as a payment service provider. Stripe may set cookies on the user's device during the payment process in order to:

• Prevent fraud and ensure the security of transactions.
• Remember the user's payment details for future transactions (if the user authorises this).
• Comply with the requirements for strong customer authentication (SCA) under PSD2.

Stripe Privacy Policy: https://stripe.com/privacy

5.2. Google (OAuth)

Viuzi offers the option to log in via Google OAuth. During this process, Google may set cookies in order to:

• Manage user authentication via Google.
• Maintain the authentication session status.
• Verify the user's identity.

Google Privacy Policy: https://policies.google.com/privacy

5.3. Google Firebase / FCM

Viuzi uses Google Firebase Cloud Messaging (FCM) to send push notifications in mobile applications. Firebase may process device identifiers in order to:

• Deliver push notifications related to the user's activity on the platform.
• Manage the registration and delivery of push messages.

Google Firebase Privacy Policy: https://firebase.google.com/support/privacy

5.4. Apple Push Notification Service (APNS)

Apple Inc. provides the push notification service for iOS devices. APNS uses device tokens for the delivery of notifications, which are stored securely on the device (iOS Keychain). Apple may act as an independent controller for certain aspects of the processing of device tokens. Apple Privacy Policy: https://www.apple.com/legal/privacy/

6. International transfers

Stripe cookies involve data transfers to the USA, covered by the EU-US Privacy Framework (Decision C(2023) 4745) and, subsidiarily, Standard Contractual Clauses (Decision 2021/914). Google cookies are covered by the same mechanisms.

If the Platform uses CDN services or infrastructure that install additional technical cookies (CloudFront, etc.), these will be documented as essential infrastructure cookies in the table in Section 3.1.

CDN infrastructure cookies. As of the date of publication of this policy, the Platform does not use AWS CloudFront or other CDN services that install additional cookies. In the event that CDN services are incorporated in the future, the associated technical cookies will be documented in this section as essential infrastructure cookies and this policy will be updated before their activation.

7. How to manage and delete cookies

The user has full control over the cookies stored on their device. The various options available are described below.

7.1. Through browser settings

Each browser offers options to manage cookies. Below are links to instructions for the most widely used browsers:

• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/kb/cookies-information-websites-store-on-your-computer
• Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471
• Microsoft Edge: https://support.microsoft.com/microsoft-edge/delete-cookies

7.2. Through platform settings

Viuzi provides a privacy settings panel accessible from the user's account, where it is possible to:

• Review and modify cookie consent preferences.
• Delete locally stored data associated with the account.
• Revoke consent previously given for specific categories of cookies.

7.3. Deleting local and session storage

To delete data stored in Local Storage and Session Storage, the user can:

• Use the browser's developer tools (usually accessible with the F12 key).
• Clear all site data from the browser settings.
• Log out of Viuzi, which will automatically delete the authentication tokens.

8. Impact of disabling cookies

Disabling certain cookies may affect the functioning of the platform as follows:

8.1. Disabling essential cookies

• It will not be possible to log in or maintain an active session.
• CSRF protection will stop working, which will prevent the submission of forms.
• Language preferences will not be remembered between visits.
• The payment process via Stripe may not work correctly.
• The platform will become essentially unusable.

8.2. Disabling functional cookies

• Visual theme and regional configuration preferences will not be remembered.
• The user will have to manually configure their preferences on each visit.
• The user experience will be reduced but basic functionality will be maintained.

8.3. Disabling analytical cookies

• Viuzi will not be able to collect pseudonymised usage data.
• It will not affect the functioning of the platform for the user.

8.4. Disabling marketing cookies

• The user will not receive personalised advertising.
• It will not affect the functioning of the platform.

9. Cookie consent mechanism

In accordance with the ePrivacy Directive 2002/58/EC (as amended by Directive 2009/136/EC) and the General Data Protection Regulation (GDPR, Regulation EU 2016/679), Viuzi implements a cookie consent mechanism that is presented to the user on their first visit to the platform.

9.1. Consent banner

When accessing Viuzi for the first time, an informative cookie banner will be displayed offering the following options:

• Accept all: The user consents to the use of all categories of cookies (essential, functional, analytical and marketing).
• Reject all: Only cookies strictly necessary for the functioning of the platform will be used. Functional, analytical and marketing cookies will be disabled.
• Customise: The user can individually select which categories of cookies they wish to allow, with granular control over each type.

Non-essential cookies are NOT installed or activated before the User performs an affirmative consent action, in accordance with the CJEU judgment in case C-673/17 (Planet49).

9.2. Characteristics of consent

The consent given by the user meets the following requirements:

• Free: Access to the platform is not made conditional on acceptance of non-essential cookies.
• Specific: The user can consent by individual categories of cookies.
• Informed: Clear and accessible information is provided about each type of cookie before consent is requested.
• Unambiguous: A clear affirmative action is required from the user.
• Revocable: The user can modify or revoke their consent at any time from the privacy settings in their account.

To withdraw consent from analytical or marketing cookies specifically: (1) click on the "Cookie Settings" link available in the footer of the web platform; (2) deactivate the desired cookie categories; (3) click "Save preferences". Withdrawal of consent will take effect immediately. All cookies whose use is based on the user's consent will be deleted from the device at the time that consent is withdrawn. Analytical data collected before the withdrawal of consent will remain in pseudonymised form.

9.3. Consent Management Platform (CMP)

Viuzi implements a consent management platform (CMP) that follows the principles of the industry's transparency and consent framework. The CMP ensures that user consent is obtained, recorded and managed in a manner compliant with the ePrivacy Directive and GDPR.

9.4. Consent record

Viuzi stores a record of the user's consent that includes:

• Date and time of consent.
• Categories of cookies accepted or rejected.
• Version of the cookie policy in effect at the time of consent.
• Anonymous identifier of the consent session.

This record is retained for the duration of the consent plus an additional three (3) years for accountability purposes pursuant to Article 5(2) of GDPR.

After the expiry of the consent cookie (12 months), the consent banner will be displayed again to obtain renewed consent from the User.

10. Updates to this cookie policy

Viuzi reserves the right to update this cookie policy at any time to reflect changes in the cookies used, in the technologies employed or in applicable legislation.

In the event of material changes:

• Registered users will be notified via the platform or by email.
• The user's consent will be requested again when the changes affect the categories of cookies or their purposes.
• The date of last update will be modified at the top of this document.

Users are advised to periodically review this policy to stay informed about the use of cookies on Viuzi.

11. Contact information

For any query, request or complaint relating to the use of cookies on Viuzi, the user may contact us through the following means:

• General email: hola@viuzi.com
• Privacy email: privacy@viuzi.com
• Postal address: VIUZI ESP, SL, Calle Alejandro Dumas 17 - Oficinas, 29004 Málaga, Spain

Furthermore, the user has the right to lodge a complaint with the competent supervisory authority for data protection:

• Agencia Española de Protección de Datos (AEPD) (Spanish Data Protection Agency)
• Address: C/ Jorge Juan 6, 28001 Madrid, Spain
• Email: https://sedeagpd.gob.es
• Website: https://www.aepd.es

Users in Spain may also lodge complaints with the Spanish Data Protection Agency (AEPD, www.aepd.es), in addition to the Spanish Data Protection Agency (AEPD).

12. Legal basis

This cookie policy is based on the following regulations:

• ePrivacy Directive 2002/58/EC (as amended by Directive 2009/136/EC): Establishes consent requirements for the storage of information on the user's terminal equipment.
• General Data Protection Regulation (GDPR, Regulation EU 2016/679): Regulates consent as a legal basis for the processing of personal data, including the use of cookies that allow the identification of the user.