Cookie Policy

01What a cookie is, and what this policy covers

A cookie is a small text file that a website stores in your browser when you visit, and can read again on later visits. It remembers information about that visit — how you arrived, which pages you saw, whether you have already passed a form check — so that the next one is quicker, or so that use of the site can be measured in aggregate.

Other technologies have the same effect and are used alongside cookies: browser storage (localStorage and sessionStorage), web beacons or tracking pixels, and third-party scripts. Everything said here about cookies applies to them too, as the regulations require.

Throughout this document the standard classifications are used:

By who sets them: first-party, served from HAKI's own domain, and third-party, served from an external provider whose code the page loads.
By how long they last: session cookies, deleted when you close the browser, and persistent cookies, which stay on your device for the period stated in each case.
By what they are for: strictly necessary, preference, analytics or measurement, and marketing, attribution or behavioural advertising.

One fact shapes everything below: this site's own code stores exactly one thing in your browser — the answer you give the cookie panel. Not even the language is saved: it is decided by the URL you visit — the domain root for Spanish, /en for English — and is never inferred from your browser settings. Everything else described below comes from third-party services the site loads only if you accept them.

02Cookies and technologies this site uses

These are the services the site loads and the identifiers they set, by category.

Strictly necessary

These are the ones without which the site cannot work, or cannot deliver a service you have expressly asked for. Article 22.2 LSSI-CE exempts them from the prior consent requirement — including, on the AEPD's own reading, storing a user's refusal or cookie preferences.

There are two items in this category, and only two. The first is the record of your cookie decision: when you accept, reject or configure the categories in the panel, your choice is stored in your browser's local storage (under the key "haki.consent") for twelve months, along with the date you made it. It exists precisely so that your answer is respected and you are not asked again on every page; it never travels on a request to the server and contains no identifier of yours. After those twelve months it expires and you are asked again.

The second is the technology used by Cloudflare Turnstile, the anti-spam check protecting the contact form and the newsletter sign-up: to confirm that a submission comes from a person rather than a bot, it briefly stores a single-use token in your browser which expires within minutes. It does not identify you, does not follow you across sites and is not used for analytics or advertising. More at https://www.cloudflare.com/privacypolicy/

Analytics and measurement

If you accept this category, the site loads Google Tag Manager (container GTM-NBS6QGZ). Tag Manager is a tag container: it sets no cookies itself, but it is what fires the scripts described in this section and the next. If you reject every category it is never loaded at all, so none of those scripts is so much as downloaded.

Through it, Google Analytics 4 runs, measuring in aggregate which pages are visited, where traffic comes from, which device and browser are used and which content proves useful. It sets the following cookies in your browser, from HAKI's own domain:

_ga — tells browsers apart using a random identifier, so unique visitors can be counted. Persistent, 2 years.
_ga_<ID> — keeps the measurement session state for the corresponding Analytics property. Persistent, 2 years.

The purpose is statistical: these let us understand how the site is used and improve it, not identify you personally or make decisions about you. Google processes this data as a processor and, in certain cases, for its own purposes under its terms. Its cookie information is at https://policies.google.com/technologies/cookies and its privacy policy at https://policies.google.com/privacy

Marketing and attribution

If you accept this category, the same Tag Manager container additionally fires two third-party tags:

lemlist (Lempire SAS, France), the tool we run our outbound email campaigns with. Its website tracking tag lets a visit be recognised as coming from one of those campaigns and attributed to it. It sets its own identifiers from the app.lemlist.com domain. Privacy policy: https://www.lemlist.com/privacy-policy
Sortlist (Sortlist SA, Belgium), the agency directory where HAKI is a verified partner — the badge shown in the footer. Its collector measures the visits and enquiries originating from the directory so that they can be attributed to the platform. It sets its own identifiers from the collector.sortlist.com domain. Privacy policy: https://www.sortlist.com/privacy-policy

These tags are not used to show you personalised advertising on this site, and HAKI neither sells nor discloses your browsing history: their purpose is measurement and commercial attribution. They are still not necessary for the site to work, so they are only switched on if you accept this category in the panel.

Services embedded on specific pages

The meeting scheduler is provided by Cal.com and is not loaded across the site: it lives on two pages reached by direct link — the booking page and its confirmation — which are not indexed and load neither Tag Manager nor any of the tags above. Inside its iframe, Cal.com may set its own cookies to handle the booking and prevent abuse; those are governed by its own policy, available at https://cal.com/privacy

What this site does not use

For transparency, and because many cookie policies list technologies the site never actually loads:

There are no Meta, LinkedIn, TikTok or X advertising pixels in the site's code, and no first-party behavioural advertising or audience-resale cookies.
The typefaces come from Google Fonts but are downloaded when the site is built and served from our own domain: your browser makes no request to Google's servers to display them and discloses no IP address to them.
Images and video are served from our own storage and set no cookies.
No device fingerprinting techniques and no Flash cookies are used.

Separately from cookies, the site's hosting provider (Vercel) records the technical details of each request — IP address, user agent and page requested — in its server logs, in order to operate the service and protect it from abuse. These are not cookies and require no consent, but they are worth knowing about.

03Legal basis, consent and withdrawal

The strictly necessary cookies described above are exempt from the consent requirement under article 22.2 LSSI-CE: they load because the service you asked for cannot be delivered without them.

The analytics cookies and the marketing and attribution tags are not exempt: their legal basis is your consent under article 6.1.a GDPR, and their processing is limited to the purposes described in each case.

Consent is collected through a panel shown on your first visit, before any of those tags load. From it you can accept them all, reject them all, or open "Configure" and decide category by category. Accepting and rejecting are the same action, in the same place, with the same appearance: refusing takes no extra screen, and closing or ignoring the notice does not count as acceptance.

Until you choose, the site does not load Google Tag Manager, so neither Analytics nor the lemlist and Sortlist tags are so much as downloaded. On top of that, the site declares Google's consent mode with every permission denied by default, so that tags which honour it stay inactive even once the container does load.

You can change or withdraw your decision at any time from the "Cookie preferences" link in the footer, which reopens the same panel. Withdrawing consent stops the tags loading from that moment on; to also delete cookies already set, use the browser settings described in the next section. Your decision is stored for twelve months, after which you are asked again.

Withdrawing consent does not affect the lawfulness of processing carried out beforehand, and does not stop you using the site: rejecting the analytics and marketing cookies degrades no functionality.

04International data transfers

Some of the providers above are established outside the European Economic Area, or may process data on servers located in third countries, chiefly the United States:

Google (Google Ireland Limited and Google LLC), for Tag Manager and Analytics: certified under the EU-US Data Privacy Framework and, additionally, standard contractual clauses.
Cloudflare, Inc., for the anti-spam check on the forms: certified under the EU-US Data Privacy Framework and standard contractual clauses.
Cal.com, Inc., for the meeting scheduler: standard contractual clauses.
Lempire SAS (lemlist), established in France: processing takes place within the European Union.
Sortlist SA, established in Belgium: processing takes place within the European Union.

In every case the transfer relies on one of the mechanisms set out in Chapter V GDPR. The detail of each safeguard is available in the relevant provider's privacy policy, linked in the sections above.

05How to manage, block or delete cookies

The most direct route is the site's own preference panel, reachable from the "Cookie preferences" link in the footer: what you decide there stops the tags from loading again. Independently of that, you can accept, block or delete cookies already stored on your device at any time from your browser settings. The exact path changes between versions, but the setting always sits under privacy:

Google Chrome: Settings › Privacy and security › Third-party cookies and site data.
Safari: Settings › Privacy › Manage website data.
Mozilla Firefox: Settings › Privacy & Security › Cookies and Site Data.
Microsoft Edge: Settings › Cookies and site permissions.

Beyond browser settings, these options are open to you:

The Google Analytics opt-out add-on, which stops measurement from running on any site that uses it: https://tools.google.com/dlpage/gaoptout
Private or incognito browsing, which discards cookies when you close the window.
The tracker-blocking options built into modern browsers, and the Global Privacy Control (GPC) signal where your browser or an extension can send it.

Two practical warnings. First: blocking cookies and browser storage outright may stop the anti-spam check from validating the forms, and therefore stop you submitting them. Second: clearing your browser's cookies also clears any opt-out that was itself stored as a cookie, so you will need to set it again.

06Personal data and your rights

The identifiers these cookies set may constitute personal data even though they contain no name. What HAKI does with them, and with the rest of the information you provide, is set out in the Privacy Policy on this same site.

You may exercise your rights of access, rectification, erasure, restriction of processing, portability and objection by writing to INFO@HAKI.MARKETING or to PLAÇA GALA PLACIDIA, 1, 08006 BARCELONA, providing proof of identity.

If you believe the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency at https://www.aepd.es

07Changes to this policy

HAKI reviews this policy whenever the services the site loads change, or the applicable regulations do, and updates it accordingly. The version in force is always the one published on this page, with the last-updated date shown above; we suggest checking back from time to time.

If you have any question about the use of cookies on this site, or want us to explain how to block a specific one, write to us at INFO@HAKI.MARKETING