General Information

This Privacy and Cookies Policy applies to all personal data that you, as a user (understood as any natural person accessing the website), provide to Cofrai when you access https://www.cofrai.com, hereinafter the “Website.”

The purpose of this Privacy and Cookies Policy is to inform you about how we process your personal data as a user, as well as to explain the rights you have under the General Data Protection Regulation and other applicable data protection regulations.

Who is responsible?

The entity responsible for processing the personal data collected through the Website is Cofrai, with tax identification number B13983986 and registered office at Calle María de Molina 37 S1D Madrid, Madrid 28006, Spain.

You can contact the Data Protection Officer at the email address dpo@7experts.com to make any inquiries or request information you need about the processing of users' personal data. The personal data we collect will be treated confidentially and will be incorporated into our Record of Processing Activities.

What do we ask your data for?

What is our legal basis for data processing?

Our legal basis for processing personal data is as follows:

• Consent: if you have given your express consent at the time of entering personal data by ticking the corresponding box.
• Performance of a contract: if there is a contractual relationship between you and Cofrai, or if the processing of personal data is necessary for the development of the commercial relationship.
• Compliance with a legal obligation: in cases where Cofrai has a legal obligation applicable to us as data controllers.
• Legitimate interest: in cases where there is a legitimate interest of our own or third parties related to the operation of the Website or the provision of services to the user, provided that the fundamental rights and freedoms of users do not prevail over the legitimate interest.

How long will we keep your data?

The personal data we collect through the Website will be processed and kept for the time necessary to carry out the purpose for which it was collected.

More specifically, the data we collect for the development and execution of a contract with you will be kept as long as the contractual relationship remains in force, but the personal data we collect based on legitimate interest or with your consent will only be kept for the time necessary to fulfill that purpose.

Once the strictly necessary period for the execution of the purposes described above has elapsed, we will keep the personal data for an additional period, which will last until all actions that could arise from our liability derived from each of the processing activities have expired.

Do we share your data with third parties?

In order to carry out the purposes described above, it is necessary to give access to your personal data to other service providers, who will act as our data processors, such as:

• Technology and analytics service providers

• Customer service related service providers

• Suppliers and service partners related to marketing and advertising (printing and distribution, social media platforms, media agencies or advertising agencies, data analysis companies, and public relations agencies)

• Providers of services related to company administration and management

• Fraud detection and prevention entities

• Financial institutions and companies that offer payment solutions

• Suppliers and logistics, transportation, and delivery service providers

• Public administrations and bodies when required by tax, labor, Social Security regulations, or any other applicable regulations.

We have entered into an agreement with the companies acting as data processors that regulates the management and processing of users' personal data, as well as the adequacy of the security measures adopted.

In cases where we have to make transfers to third parties with headquarters or servers outside the European Union or the European Economic Area (Iceland, Norway, or Liechtenstein), and where such country does not offer a level of protection of personal data equivalent to that of the European Union, we will transfer your personal data always respecting the appropriate guarantees and maintaining security standards, in accordance with applicable regulations.

When such transfers are made from the EU/EEA to a third country for which the European Commission has not issued an Adequacy Decision, or we do not have Binding Corporate Rules, we will comply with the provisions established by the European Commission for these cases to provide you with adequate guarantees, and whenever applicable, we will subscribe to the Standard Contractual Clauses and even implement additional protective measures when necessary.

If you want more information about the transfer of personal data that we carry out to countries outside the EU/EEA, you can contact us through the following email address: cofrai@cofrai.com

What are your rights?

You can exercise the following rights at any time and free of charge:

• Access: to know what data we keep and what we do with it.
• Rectification: to inform us of any inaccurate data.
• Deletion: so that we delete your personal data, as far as possible.
• Objection: so that we stop processing your personal data for one of the purposes mentioned above, provided there is no legal obligation preventing it.
• Portability: so that we transfer your personal data to a third party, as far as possible.
• Restriction: so that we suspend your data when you challenge its accuracy, or want us to keep it to exercise some action.
• Not to be subject to decisions based solely on automated processing of your data.

You can exercise any of these rights free of charge by accessing here.

If we do not properly respect these rights as the controller, we inform you that you can file a complaint with the data protection supervisory authority at Agencia Española de Protección de Datos (AEPD), C/Jorge Juan, 6, 28001 Madrid or at the email address internacional@aepd.es.

Confidentiality and security measures

Cofrai, as the data controller, commits to respecting the confidentiality of users' personal data and to using it according to the purposes for which it was collected.

We have adopted all appropriate technical and organizational security measures according to the nature of the data being processed and as required by data protection regulations.

Cookie Policy and tracking technologies

Before we start, what is a cookie? What types of cookies exist?

A cookie is a small text file that websites install on the computer or mobile device of users who visit them. Cookies are generally used to make web pages work or work more efficiently, as well as to gather information about their use.

Cookies can be classified as follows:

• According to the entity managing them: own or third-party
• According to the activity duration: session or persistent
• According to their purpose: technical, preference/personalization, analytics, or marketing

Other tracking technologies

In addition to Cookies, we may use other tracking technologies that work similarly and allow us to better understand how you use our website and improve your browsing experience (hereinafter, collectively “Cookies”).
These are:

• Local Storage / Session Storage: allow storing information directly in the browser similarly to a cookie.
• Tracking scripts: code snippets that load when visiting the website and enable analytical, advertising, or personalization tools.
• Tracking pixels: small pieces of code that load when visiting a page or opening an email. When activated, they send information to the hosting server, allowing detection of visits, measurement of interactions, and knowledge of certain actions performed on the website.
  These pixels may collect data such as the type of browser used, IP address, visit frequency, or how the user navigates the site. Their purpose can be analytical (measuring site performance) or advertising (optimizing campaigns and audiences).
• Web beacons: tracking tags inserted into web pages or electronic communications. When loaded, they collect information about content viewing and user activity.

These technologies may collect information about your device, your browser, and your interactions on the website, and are used for analytical, functional, or advertising purposes, just like Cookies. They will only be activated when you have given your consent, except for those necessary for the basic operation of the website.

On what legal basis do we use Cookies?

Technical or strictly necessary Cookies allow the basic functioning of the website and facilitate access to the services we offer. Their use is justified by the relationship established when you decide to visit our website and use its functionalities, so they do not require consent.

Preference/personalization, analytics, or marketing Cookies are based on the consent you give when first accessing the website, which you may revoke at any time.

Who is responsible for the use of Cookies on https://www.cofrai.com?

When you browse our website, some Cookies are installed directly from our own domains, while others come from external companies that incorporate their technologies on our site with our authorization and allow us to offer services such as analytics, measurement, content personalization, or advertising.

At Cofrai, together with the third parties identified in the Cookies list included in this Policy, we are responsible both for the installation of these technologies when you access our website and for the access to the data that can be obtained from them.

What Cookies do we use?

The following table explains the cookies we use and their purposes:

How can you manage or modify your consent regarding Cookies?

You can modify your Cookie usage preferences at any time with the tool for Configure Cookies.
You may need to refresh the page for the settings to take effect.

Through this tool you can:

• Independently enable or disable preference/personalization, analytics, and marketing Cookies.
• Keep only technical (strictly necessary) Cookies enabled.
• Modify your initial choice or withdraw it whenever you consider appropriate.

Each category includes different Cookies whose specific uses can be consulted in the table included in this Policy. Disabling certain categories may limit some functionalities or prevent content from being adapted to your preferences.

How can you delete Cookies?

In addition to managing your consent through our tool, you can also control most Cookies directly from your browser settings.

You can do this in the most common browsers by following their instructions:

• Google Chrome
• Microsoft Edge
• Mozilla Firefox
• Microsoft Internet Explorer
• Opera
• Apple Safari

To find information related to other browsers, you can visit the corresponding browser's website.

At https://www.cofrai.com we use Google Consent Mode v2 to transmit consents to the different purposes.
More information here.

International data transfers with the use of Cookies

By using this website and accepting certain Cookies or tracking technologies, some of the generated data may be processed by providers located in third countries. In particular, certain services may involve data transfers to the United States or other territories located outside the European Economic Area (EEA).
When these transfers are made to entities located in the United States, the processing may be based on a European Commission adequacy decision, provided that the provider is adhered to the EU–U.S. Data Privacy Framework. If the provider is not listed in the “Data Privacy Framework List,” or when the transfer is directed to countries that do not have an adequacy decision, the guarantees provided in the GDPR will apply.

Changes to the Privacy and Cookies Policy

This Privacy and Cookies Policy was last updated on 17/12/2025, Cofrai reserves the right to update and modify some aspects of it to adapt it to legislative and jurisprudential developments, so we recommend reviewing it periodically.