Cookie Policy
Last reviewed: 10 November 2026. This notice explains cookies and similar technologies on the Alcaidesa Marina website, the purposes they may serve, when consent is needed, and how individuals should be able to control them. It reflects Article 22(2) of Spanish Law 34/2002, the GDPR and Spanish Data Protection Agency guidance and supplements our Privacy Policy.
1. What are cookies and equivalent technologies?
Cookies are small files or identifiers that a website can store or access on a browser or device. Similar technologies may include local storage, session identifiers, pixels, software tags or other ways of accessing information on a terminal. Their legal classification depends on their purpose and operation rather than their technical label.
Some are needed to run a requested function; others measure audience behaviour, personalise content, embed external services or create profiles. Cookies may involve personal data when they are linked to IP addresses, persistent identifiers, browsing patterns or other information. It is incorrect to assume that every cookie is anonymous.
2. Controller details
The controller for its own processing is ALCAIDESA SERVICIOS, S.A., tax ID A11344827, Avenida Príncipes de Asturias, s/n, 11300 La Línea de la Concepción, Cádiz, Spain. Email: emorillas@alcaidesa.com; telephone: +34 956 021 660. Third-party providers may be processors or independent controllers depending on the service.
3. Categories by purpose
- Strictly necessary or technical: enable essential navigation, security, communication transmission, requested form handling or the storage of a privacy choice. An exemption only applies when its legal criteria are truly met.
- Preferences: store language, display settings or user-chosen options. Whether consent is required depends on necessity, the user’s request and the exact function.
- Analytics and audience measurement: track visits, interactions or site performance; these generally require prior consent unless all conditions for a valid exemption are met.
- Advertising and profiling: measure campaigns, build audiences or deliver tailored advertising; non-exempt tracking requires prior consent and an appropriate GDPR lawful basis.
- External content: videos, maps, social widgets, reviews and other embedded modules can load external identifiers and should not set non-essential cookies before consent.
4. First-party, third-party, session and persistent technologies
First-party cookies are operated through the site’s domain; third-party cookies involve another provider. Session cookies usually expire at the end of a session; persistent cookies remain until expiry or deletion. A short-lived identifier can still be personal data and may still require consent.
5. Identified components and technologies requiring verification
The list below describes technical components identified on the website or associated with its installed functions. It is not an audited list of cookies actually set on every device. Names, expiration dates, hosts and consent behaviour must be verified in a real browser audit across page types, languages and consent states. Obsolete cookies appearing in older versions of this policy are not repeated without evidence that they are still used.
| Component / service | Possible purpose | Category and consent | Duration / provider |
|---|---|---|---|
| WordPress | Website operation, security and session or administrative preferences where applicable. | Strictly necessary only where the relevant exemption is met. | Depending on session and configuration; first-party. |
| Gravity Forms and rate calculator | Submission, validation, requested calculations and continuity of form interactions. | Technical only to the extent required by the requested operation; optional tracking must be assessed separately. | According to the actual function and session. |
| Trustindex review widget | Displaying reviews and contacting a third-party service. | External integration; any non-exempt tracking requires prior consent. | According to the provider’s actual implementation; a cdn.trustindex.io resource has been identified. |
| Embedded videos, maps or social content, if loaded | Displaying third-party media, controls and maps. | External service; non-essential identifiers must be blocked until consent. | Variable by provider. |
| Analytics and advertising tools, if enabled | Audience analysis, attribution, marketing and profiles. | Non-essential; prior consent unless a substantiated exception applies. | Specific identifiers and expiration must be determined from the actual configuration. |
| Chatbot or AI assistant, if introduced | Conversation continuity, security and connection to an assistant provider. | Only indispensable session storage may be exempt; separate analytics or profiling requires consent where applicable. | Provider and duration must be disclosed before launch. |
6. What does not constitute consent?
Simply visiting the website, scrolling, dismissing a notice, remaining inactive or continuing to browse does not, by itself, amount to valid consent for non-essential cookies. Optional categories must not be preselected. Consent requires an appropriate affirmative choice before the relevant non-exempt identifier is installed or accessed.
7. Accepting, rejecting and configuring preferences
Where non-exempt cookies are used, a clear initial notice must provide equally prominent “Accept” and “Reject” options and, where appropriate, settings by purpose. A second layer should explain providers, purposes, retention and transfers. Rejecting optional cookies must not unjustifiably prevent access to services that do not require them.
Publishing this notice is not a substitute for consent management. Choices must be recorded and respected technically. If a functioning preference panel has not been implemented in a particular site version, optional cookies should not be activated until an appropriate mechanism exists. The implementation of that control requires a separate technical check.
8. Withdrawing consent and browser settings
Users must be able to withdraw consent as easily as they give it. Where a preference manager is installed, it should remain accessible to review or change settings. Browser deletion and blocking controls also exist, although they do not replace the controller’s duty to provide a suitable withdrawal mechanism when required.
Browser guidance: Chrome, Firefox, Safari and Microsoft Edge. Blocking necessary technology may impair certain site functions.
9. Consent duration and changes
A choice must be retained for a reasonable period and reviewed when purposes, providers or technologies materially change. Spanish regulatory guidance commonly refers to a maximum indicative period of 24 months before renewal of a user’s choice as a best-practice approach; consent should not be assumed indefinitely. A strictly limited cookie remembering a user’s privacy selection may be exempt from consent.
10. Third parties and international transfers
Embedded reviews, media, maps, social content and marketing services may receive connection information if their resources are loaded. Where required, the controller must assess processing arrangements, the role of each supplier and any transfer outside the European Economic Area under Articles 44–49 GDPR. Neither EU-only processing nor the automatic unlawfulness of an international connection should be assumed without examining the supplier and safeguards.
11. Chatbots and conversational AI
If an AI assistant or chat service is added later, it may need session identifiers or communication with external servers. The interface must clearly identify automation when the law requires it and provide relevant privacy information. Opening a conversation does not justify unrelated advertising, analytics or profiling cookies.
Messages may contain personal data even where no cookies are used. The Privacy Policy therefore also addresses potential AI-assisted processing. Provider identity, training uses, international transfers, retention and access must be confirmed and disclosed before activation. Users should avoid submitting sensitive or third-party confidential data in general-purpose conversations.
12. Retention of identifiers and underlying information
Individual cookie lifetimes must reflect actual purpose and technical settings. The expiration of a browser identifier is not necessarily the same as retention of information on a provider’s servers. Both periods must follow data minimisation and applicable law, and exact values must be determined when a service is enabled.
13. Data protection rights
Where identifiers involve personal data, access, rectification, erasure, objection, restriction, portability and withdrawal of consent may be available as appropriate. Contact emorillas@alcaidesa.com or the Spanish Data Protection Agency. See our Privacy Policy for the full procedure.
14. Amendments and legal references
This policy should be updated when the actual website configuration, providers or legal requirements change. Core references include Spanish Law 34/2002, Article 22(2), the GDPR, Organic Law 3/2018 and the AEPD Cookie Guide. New consent must be obtained when a material change requires it.