Legal
Last updated: May 2026
Cookies are small text files that a site downloads to your device (computer, smartphone, tablet) when you visit it.
In accordance with the AEPD 2023 Cookie Guide, we group cookies into 3 categories manageable from the consent banner:
These cookies are essential (authentication, session, security). Their installation is exempt from prior consent under Art. 22.2 LSSI-CE and the AEPD Guide 2023 sec. 4.2.
| Name | Provider | Purpose | Duration | Legal basis |
|---|---|---|---|---|
| tp_session | tpcard.es (1st party) | Maintain authenticated user session (HttpOnly + Secure cookie) | Session (at browser close) | Art.6.1.b GDPR (contract execution) + LSSI Art.22.2 exempt technical cookies |
| __Host-tp_admin_key | tpcard.es (1st party) | Admin area authentication token (HttpOnly + Secure + SameSite=Strict) | 24 hours | Art.6.1.f GDPR legitimate interest security + LSSI exemption |
| tp_access | tpcard.es (1st party) | Signed HMAC-SHA256 access cookie (Edge runtime integrity check) | 30 days | Art.6.1.f GDPR legitimate interest security + LSSI exemption |
| tp_cookie_consent | tpcard.es (1st party, localStorage) | Stores user choice on cookie banner (necessary/analytics/marketing) | 12 months | Art.7.1 GDPR proof of consent + LSSI exemption (necessary to manage consent) |
They are loaded only if you accept the "Analytics" category in the banner. Without consent, none of the following are installed. You can revoke consent at any time (Art.7.3 GDPR) from the "Manage cookies" button in the footer.
| Name | Provider | Purpose | Duration | Legal basis |
|---|---|---|---|---|
| tp_sid | tpcard.es (1st party, sessionStorage) | Anonymous session ID for internal metrics (page_view, button_click) | Session (at tab close) | Art.6.1.a GDPR explicit consent + LSSI Art.22.2 |
| _ga / _gid / _gat / _gcl_au | Google LLC (Google Analytics 4) | Analysis of traffic and user behavior. Anonymized aggregated data | _ga: 2 years · _gid: 24h · _gat: 1 min · _gcl_au: 90 days | Art.6.1.a GDPR + Art.44 SCC USA transfer |
| vsi_session | Vercel Inc. (Speed Insights — Web Vitals) | Real performance metrics (LCP, INP, CLS) to optimize speed | Session | Art.6.1.a GDPR + Art.44 SCC USA transfer |
| _clck / _clsk (and associated Microsoft cookies where applicable) | Microsoft Clarity / Microsoft Corporation | Usage analytics and session replay on the public website to understand navigation, clicks, scrolling and experience issues. Clarity is enabled only after analytics-cookie consent. | According to Microsoft: _clck up to 1 year; _clsk 1 day. Other Microsoft identifiers may vary by configuration and browser. | User consent (GDPR art. 6(1)(a) and LSSI-CE art. 22.2). |
They are loaded only if you accept the "Marketing" category. They allow measuring the effectiveness of social media campaigns and showing you relevant ads (remarketing).
| Name | Provider | Purpose | Duration | Legal basis |
|---|---|---|---|---|
| _fbp / _fbc | Meta Platforms Ireland Ltd. (Meta Pixel — Facebook/Instagram) | Conversion measurement + remarketing for Meta advertising campaigns | _fbp: 90 days · _fbc: 90 days | Art.6.1.a GDPR consent + Art.44 intra-EU transfer (Ireland) |
| _ttp / _tt_enable_cookie | TikTok Technology Limited (TikTok Pixel) | Conversion measurement + remarketing for TikTok campaigns | _ttp: 13 months | Art.6.1.a GDPR + Art.44 SCC USA transfer |
| li_at / li_mc / lidc / bcookie / UserMatchHistory | LinkedIn Ireland Unlimited Company (Insight Tag) | B2B conversion measurement + remarketing for LinkedIn campaigns | up to 2 years | Art.6.1.a GDPR + Art.44 intra-EU transfer (Ireland) |
Some providers (Google, Meta, TikTok, Vercel) are based in the USA. The transfer is covered by Standard Contractual Clauses (SCC) approved by the European Commission (Art.44 GDPR). LinkedIn operates from Ireland (EU).
You may modify or withdraw consent at any time by:
Withdrawal of consent does not affect the lawfulness of processing based on prior consent (Art. 7(3) GDPR).
If you believe the processing is not compliant, you can file a complaint with the AEPD (Spanish Data Protection Agency).
For more information: Privacy Policy · info@tpcard.es