Legal

Cookie policy

In accordance with Article 22.2 of Ley 34/2002, de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI), the GDPR and the guidelines of the Agencia Española de Protección de Datos (Spanish Data Protection Agency), we inform you of the cookies used by merch.pekata.pt, of what else it stores in your browser and of how you can manage it.

1. What are cookies?

A cookie is a small file that is downloaded to your device when you access certain websites in order to store and retrieve information about your browsing. Similar technologies, such as the browser's local storage, perform equivalent functions, and this policy also covers them. The information collected by these means may constitute personal data, in which case our Privacy policy also applies.

2. What this site stores in your browser

This is the full inventory, in three groups: technical storage, which is essential for the site to work and is exempt from consent; measurement and advertising cookies, which are only installed if you accept them in the cookie notice; and those used for card payment, which are only loaded if you pay by card for samples or a purchase.

a) Technical storage, exempt from consent

pekata_merch_quote (local storage · first-party · technical · until you delete it): the products, quantities and branding you have added to your quote, so that they are still there if you close the tab and come back another day.
pekata_merch_quote_form (session storage · first-party · technical · until you close the tab): what you have typed into the quote form, so that it is not lost when moving from one step to the next.
pk-consent and pk-consent-at (local storage · first-party · technical · 24 months): whether you accepted or rejected cookies and the date on which you did so, so that we do not have to ask you again on every visit.
pekata_merch_samples (local storage · first-party · technical · until you delete it): the samples you have chosen (products, colours, sizes and units), so that they are still there until you pay for them.
pekata_merch_samples_form (session storage · first-party · technical · until you close the tab): what you have typed into the samples form and the reference of the payment in progress, so that they are not lost when moving from one step to the next and a second payment is not opened.
pekata_merch_checkout_pending (session storage · first-party · technical · until you close the tab): the reference of the purchase whose card payment is part-complete, so that it can take you back to it if you reload the page and a second payment is not opened.

None of them is sent to third parties or used to identify you or track your browsing on other sites. The language in which you view the site is part of each page's address and is not stored in your browser.

b) Measurement and advertising, only if you accept them

They are loaded through Google Tag Manager and are not installed until you accept them: the site starts with Google's consent mode (Consent Mode v2) with everything denied by default.

_ga (cookie · Google Ireland Limited · analytics · 2 years) and _ga_<stream ID> (cookie · Google Ireland Limited · analytics · 2 years): Google Analytics 4. They make it possible to distinguish visitors and sessions and to measure the use of the site statistically (pages visited, traffic source) in order to improve it.
_gcl_au (cookie · Google Ireland Limited · advertising · 90 days): Google Ads. It makes it possible to attribute quote requests to an advertisement and thus to measure the effectiveness of our campaigns.
_fbp and _fbc (cookies · Meta Platforms Ireland Limited · advertising · 90 days): Meta pixel. They make it possible to measure the effectiveness of our campaigns on Facebook and Instagram, by recording whether a visit came from an advertisement, and to show our ads on those platforms to people who have visited this site. The pixel is loaded directly from connect.facebook.net and only after cookies have been accepted. More information: facebook.com/privacy/policies/cookies.

For more information about Google's cookies and its use of data: policies.google.com/technologies/cookies and business.safety.google/adscookies.

c) Paying by card, only if you pay by card for samples or a purchase

Samples and direct purchases can be paid for by card on the site itself. When you reach the payment step, and only then, two third-party services that are essential for that payment are loaded; for that reason they do not require your consent:

Stripe (Stripe Payments Europe, Limited · payment and fraud prevention): processes the card payment. To prevent fraud it installs its own cookies on this site, such as __stripe_mid (1 year) and __stripe_sid (30 minutes), and others on its own domains. More information: stripe.com/cookies-policy/legal.
Cloudflare Turnstile (Cloudflare, Inc. · security): checks that the person paying is a human and not an automated program. It is loaded from challenges.cloudflare.com and processes technical data from your browser solely for that check. More information: cloudflare.com/turnstile-privacy-policy.

3. Cookie notice

The first time you visit, we show you a notice with two options, accept or reject, and the link to this policy. Until you accept, nothing for measurement or advertising is installed: Google's consent mode (Consent Mode v2) starts with everything denied by default. If you reject them, the site works normally: you can browse the catalogue, build your quote and send it all the same.

Your decision is stored for 24 months and, once that period has passed, we ask you again. You can change it whenever you like by clicking Cookie settings (also available in the footer), which opens the notice again: withdrawing consent is as easy as giving it. Please note that withdrawing it does not delete cookies that are already installed; you can delete those from your browser settings.

4. International transfers

The provider of the measurement and advertising services for the European Economic Area is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which is responsible for the data collected by its cookies. The processing may involve transfers of data to Google LLC (United States), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which Google is certified. They only take place if you have accepted these cookies.

The provider of the Meta pixel for the European Economic Area is Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). The processing may involve transfers of data to Meta Platforms, Inc. (United States), covered by the adequacy decision on the EU-U.S. Data Privacy Framework, under which Meta is certified. They only take place if these cookies have been accepted.

If you pay by card for samples or a purchase, Stripe and Cloudflare may process data in the United States (Stripe, Inc. and Cloudflare, Inc.), with the safeguards of the adequacy decision on the EU-U.S. Data Privacy Framework, under which both are certified, and, in the alternative, of the European Commission's standard contractual clauses.

5. How to manage cookies from your browser

In addition to the notice, you can view, block or delete the cookies and the storage that this site keeps on your device from your browser settings. If you delete it, any quote you had in progress is emptied and we ask you about cookies again, because your choice is deleted too:

6. Links to other sites

Our footer contains links to other websites, including our profiles on Instagram, LinkedIn and Facebook. They are ordinary outbound links, which by themselves do not set cookies while browsing this site; when visiting those sites, their own cookie policies apply. The Meta pixel described in section 2 is independent of those links and is only loaded if cookies are accepted.