Cookie Policy

This Cookie Policy (the "Policy") is issued by BL PLATFORM S.L. (hereinafter, the "Provider", the "Company" or "We") in its capacity as Data Controller and describes, with the precision required by the regulatory framework set out in Article III, the cookies and similar technologies installed on the User's terminal device upon access to the websites accessible at blocalapp.com, www.blocalapp.com and any subdomain operated by the Provider (collectively, the "Platform").

The Policy is to be read jointly with the Privacy Policy, the Legal Notice and the GDPR Rights Notice, all of which together form the data-protection framework binding upon the User.

This Policy is drafted in compliance with: (i) Article 22(2) of Spanish Law 34/2002, on Information Society Services and Electronic Commerce ("LSSI-CE"), as amended by Royal Decree-Law 13/2012; (ii) Article 5(3) of Directive 2002/58/EC ("ePrivacy Directive"), as transposed into Spanish law; (iii) Regulation (EU) 2016/679 ("GDPR"); (iv) Spanish Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"); and (v) the technical guidance issued by the Agencia Española de Protección de Datos ("AEPD") on the use of cookies, in its current version.

A cookie is a small file of data that a web server transmits to the User's terminal device upon visit of a website and which the device returns to the same server upon subsequent requests. Cookies enable the Platform to recognise the User's device, to preserve session state, to remember preferences, to ensure security and, where consent has been granted, to measure usage or to personalise content. Cookies do not by themselves execute programmes and cannot, under normal conditions, deliver viruses to the User's device.

Cookies are classified, by origin, as first-party cookies (set by the domain blocalapp.com) and third-party cookies (set by a domain other than blocalapp.com, typically by a sub-processor enumerated in the Privacy Policy). The inventory in Article VIII indicates the origin of each cookie.

Cookies are classified, by duration, as session cookies (erased upon termination of the browser session) and persistent cookies (preserved on the terminal device until their expiry date or their express deletion by the User). The inventory in Article VIII indicates the duration of each cookie.

The following table sets out the cookies deployed on the Platform at the effective date of this Policy. The inventory is reviewed periodically and may evolve. Any material change shall be reflected herein and shall, where applicable, trigger a fresh consent request.

In addition to cookies in the strict sense, the Platform makes use of the following client-side state-keeping mechanisms:

The Provider expressly confirms that the public Platform does not deploy Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Hotjar, FullStory, session-replay tools, advertising pixels or any equivalent third-party marketing or behavioural-advertising technology. Should any such technology be introduced in the future, its deployment shall be conditioned upon the User's prior, granular, freely-given and revocable opt-in consent, expressed through the consent banner described in Article XII.

Upon first visit to the Platform, the User is presented with a consent banner permitting the User to: (i) accept all non-essential cookies; (ii) reject all non-essential cookies; or (iii) configure granular preferences per cookie category. The "reject all" option is presented with the same prominence as the "accept all" option, in line with EDPB Guidelines 03/2022. No non-essential cookie is deposited prior to the express affirmation of consent.

The record of consent — including the time stamp, the version of the Policy in force at the moment of consent and the categories accepted — is preserved as evidence in accordance with the accountability principle of Article 5(2) GDPR.

The User may at any time review, modify or withdraw consent without prejudice to the lawfulness of the Processing carried out prior to such withdrawal, by clicking the "Cookie Preferences" link in the footer of the Platform or the button below:

In addition to the in-product preferences centre, the User may configure the User's browser to block, restrict or selectively erase cookies. The blocking of strictly necessary cookies may, however, render certain functionalities of the Platform inaccessible. Instructions issued by the principal browser publishers are available at the following addresses:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

The Platform honours, on a best-efforts basis, the Global Privacy Control (GPC) signal. Where the GPC signal is transmitted by the User's browser, the Provider shall treat such signal as a valid expression of refusal of any non-essential cookie. The legacy DNT ("Do Not Track") header is, in light of the absence of an industry consensus on its semantic meaning, not relied upon as a definitive expression of preference; the User is encouraged to rely on the in-product preferences centre.

Certain cookies originate from sub-processors established outside the European Economic Area, in particular Cloudflare (security cookies) and, where applicable, Stripe (payment-related cookies on checkout flows). Any international transfer of personal data resulting from such cookies is governed by the Article 46 GDPR mechanisms described in the Privacy Policy (Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework).

The retention period of each cookie is set out in the inventory at Article VIII. As a general rule, persistent cookies relating to consent and to the basic functioning of the Platform are retained for a maximum of twenty-four (24) months, after which a fresh consent shall be requested. The User may at any time erase any cookie through the controls described in Articles XIII and XIV.

The Provider reserves the right to amend the present Policy at any time, in particular in order to reflect changes to the cookies deployed on the Platform or to the applicable regulatory framework. Material amendments shall be reflected in the version indicator above and, where they entail the deployment of a new category of cookies subject to consent, shall trigger a fresh request for the User's express opt-in.