Cookies policy
Here we explain which cookies Culpass uses, what the legal basis for their use is, how consent is collected and what mechanisms you have to manage or withdraw it.
Last updated:
This is a courtesy translation of the Spanish original. In case of any discrepancy, the Spanish version prevails.
Consent for the cookies that require it is collected through the cookie banner of culpass.com, ensuring that it is freely given, specific, informed and unambiguous.
1. What are cookies?
A cookie is a small text file that is downloaded and stored on the user's device when accessing certain web pages. Cookies allow the site to remember information about the visit: preferred language, configuration options, browsing behaviour or whether the user has already given their consent.
Although cookies are associated with a device, when the information they obtain can be linked to an identifiable natural person, for example through unique analytics or advertising identifiers, the processing is subject to personal data protection legislation.
2. Who is responsible for the use of cookies?
The controller of the personal data collected through the cookies of this website is:
| Company name | Tax ID (NIF) | Address | Website | |
|---|---|---|---|---|
| CULPASS, S.L. | B67902593 | C/ Teresa Berganza, 76, 28200 San Lorenzo de El Escorial (Madrid) | sales@culpass.com | culpass.com |
The controller acts in accordance with Regulation (EU) 2016/679 (GDPR/RGPD), Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights (LOPDGDD) and Article 22.2 of Law 34/2002 on Information Society Services and Electronic Commerce (LSSICE), as well as with the Guidelines of the Spanish Data Protection Agency (AEPD) on the use of cookies.
3. Legal basis for processing
| Cookie type | Legal basis |
|---|---|
| Technical and necessary cookies | Legitimate interest of the controller (Art. 6.1.f GDPR). They do not require consent. |
| Preference cookies | Prior consent of the user (Art. 6.1.a GDPR and Art. 22.2 LSSICE). |
| Analytics cookies | Prior consent of the user (Art. 6.1.a GDPR and Art. 22.2 LSSICE). |
| Performance cookies | Prior consent of the user (Art. 6.1.a GDPR and Art. 22.2 LSSICE). |
| Advertising cookies | Prior consent of the user (Art. 6.1.a GDPR and Art. 22.2 LSSICE). |
Consent for the cookies that require it is collected through the cookie banner of culpass.com, ensuring that it is freely given, specific, informed and unambiguous.
4. Consent management platform (CMP)
culpass.com uses a consent management banner that operates on a prior-blocking basis: no non-essential cookie or third-party tag, including Google Tag Manager and Google Analytics 4, is loaded before the user has given their express consent.
The banner presents in its first layer the buttons “Accept”, “Reject” and “More options”, and a granular panel with the categories Analytics, Advertising, Performance and Necessary, with all non-essential ones unchecked by default.
The user's consent is recorded by means of the cookieConsent cookie.
5. Categories and cookies used
Cookies are classified into four categories: [N] Necessary, [A] Analytics, [AD] Advertising and [P] Performance. The cookies used are detailed below:
| Cookie | Provider | Purpose | Expiry | Category |
|---|---|---|---|---|
| cookieConsent | Culpass | Stores the user's consent preferences. | Up to 1 year | [N] |
| __stripe_mid / __stripe_sid / m | Stripe | Payment processing and fraud prevention. | Session - 1 year | [N] |
| _ga | Google Analytics 4 | Distinguishes users for statistical measurement. | Up to 13 months | [A] |
| _ga_4B0VSG67R1 | Google Analytics 4 | Maintains the session state of property G-4B0VSG67R1. | Up to 13 months | [A] |
| _gcl_au | Google Ads | Google Ads advertising conversion linker. | 3 months | [AD] |
Note on Google Analytics 4 and Google Ads: when the user does not give their consent, these tools are not loaded on culpass.com and none of their cookies is installed.Technical identifiers of the site: GA4 property: G-4B0VSG67R1.
Google Tag Manager container: GTM-NB9CHD6.
6. Google Consent Mode
Since 15 June 2026, Google Analytics 4 has changed how it operates: Google Signals no longer controls the flow of data to Google Ads, and the ad_storage parameter of Consent Mode is now the only mechanism that determines whether Google Ads can collect advertising signals.
On culpass.com, since the loading of Google tags is blocked until consent is given, the parameters ad_storage, ad_user_data, ad_personalization and analytics_storage are in a “denied” state by default, and only change to “granted” if the user accepts the corresponding category.
This configuration ensures full compliance with Google's new Consent Mode model.
7. International data transfers
Some cookie providers have their parent company in the United States. The associated international transfers are carried out under the following safeguards:
| Provider (EU entity) | Parent company (US) | Transfer safeguard |
|---|---|---|
| Google Ireland Ltd. | Google LLC | Standard Contractual Clauses (SCC/CCT) + EU-US Data Privacy Framework |
| Stripe Payments Europe Ltd. | Stripe, Inc. | Standard Contractual Clauses (SCC/CCT) approved by the European Commission |
8. How to manage or withdraw consent
The user may manage, modify or withdraw their consent at any time, without affecting the lawfulness of the processing carried out prior to its withdrawal, by means of:
- Cookie panel of the site: by reopening the cookie banner from the cookie management link available on the site, where you can review and change your preferences by category.
- Browser settings: in Chrome, Firefox, Safari or Edge you can block or delete cookies by following the instructions of each browser.
9. Updates to this Policy
CULPASS, S.L. reserves the right to update this Cookies Policy due to regulatory changes, the addition or removal of providers, or recommendations from the supervisory authorities.
The current version will always be available at culpass.com. In the event of substantial changes, new consent will be requested, where applicable, through the banner.