Cookie Policy

This is an English translation of the Spanish version. If the versions differ, the Spanish version prevails.

1. What are cookies?

Cookies are small text files that websites save on your device (computer, mobile phone or tablet) when you visit them. They allow the website to remember your actions and preferences (such as language or region) for a time, so you do not have to enter them again whenever you visit the site or move between pages.

Alongside cookies, we use similar technologies for the same purpose:

1.1. Local storage

A browser mechanism that allows data to be saved on your device, like cookies, but with greater capacity and no expiry date: the data remains until it is deleted or you clear the site data in your browser. Where an entry has its own retention period, we state it in its description.

1.2. Session storage

A browser mechanism similar to local storage, whose data is deleted when you close the tab.

1.3. Tracking pixels

Small invisible images embedded in web pages or emails that allow a page visit or the opening of a message to be recorded.

In this policy, “cookies” refers to all these technologies. The policy applies to the energio.es website and Energio’s client app and partners’ app; where a cookie is used only in one of them, we say so.

2. Cookie categories

Cookies are organised into four categories that match the options in the “Cookie configuration” banner:

2.1. Necessary (always active)

These are essential for the basic operation of the website and apps. They enable essential functions such as security, network management and storing your cookie decision. They do not require your consent because the website cannot function properly without them.

2.2. Preferences

These allow the website to remember options you have chosen (such as the interface language or display settings) to give you a more personalised and convenient experience. Enabling them requires your prior consent. We do not currently use preference cookies.

2.3. Analytics

These collect information about how you use the website and apps: which pages you visit, how long you spend on them and whether you encounter errors. They may include pseudonymous identifiers, browsing data and usage events; Energio uses them to produce aggregate reports and improve the operation of the website and its services. The providers are PostHog, our analytics tool hosted in the EU, and, on the website only, Google Analytics. If session recording is active, PostHog also records how you move through pages (clicks, scrolling and changes on screen), with form fields masked. Enabling them requires your prior consent.

2.4. Marketing

These are used to measure the effectiveness of advertising campaigns, create audiences and show you personalised advertising. They allow conversions to be recorded and website visits to be associated with earlier interactions with ads. Meta and LinkedIn use them. They also allow Apollo to identify companies visiting the website (from their IP address and browsing data) for B2B prospecting. They are used only on the website, and enabling them requires your prior consent.

3. Controller and legal basis

The controller is Ahora Energio SLU (“Energio”), with NIF B88686951 and registered office at Ronda del General Mitre, 126, 6th floor, 08021 Barcelona, Spain. Data protection contact: dpd@energio.es.

Necessary cookies do not require your consent (Article 22.2 of Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico, the Spanish law on information society services and electronic commerce). The others are installed only if you accept them (Article 22.2 of that law and Article 6.1.a of Regulation (EU) 2016/679, the General Data Protection Regulation or GDPR).

We keep a record of your cookie decision so that we can demonstrate it, in compliance with a legal obligation (Articles 6.1.c, 5.2, 7.1 and 24 of the GDPR).

Meta and LinkedIn are joint controllers with Energio for the collection of the data obtained by their cookies and tags on the website and its transmission; afterwards, each processes it as an independent controller. Apollo processes visit data on behalf of Energio and, when matching it against its own database, as an independent controller.

See your rights and the rest of the information about the processing of your data in the Privacy Policy.

4. First-party cookies (Energio)

Energio, or a provider working on its behalf (PostHog or Framer, which hosts the website), installs these on the energio.es domain and its subdomains, and only Energio uses their data:

• framerCookiesConsentMode: necessary; local storage; website. Stores your decision for each category so it can be applied on later visits. It is created on your first visit, before you decide, with all categories disabled. We apply your decision for 24 months; after that, the banner asks you again. It contains no identifier.

• framerCookiesDismissed: necessary; local storage; website. Indicates that you have already made a cookie decision, so you are not asked again while that decision remains valid (24 months). It contains no identifier.

• cookie_consent: necessary; local storage; apps. Stores your decision for each category, the version of the banner text you accepted or rejected and the decision date. The banner asks you again if that text changes or 24 months have passed since your decision. It contains no identifier.

• energio_consent_outbox:*: necessary; local storage, until the server confirms the record or, if it has not confirmed it within 23 hours, until your next visit; website and apps. Temporarily stores your cookie decision and the page where you made it until the server confirms that it has been recorded, so we can demonstrate it. Each decision awaiting confirmation has its own entry, which is deleted when the server confirms or rejects the record; if it is not confirmed, retries stop after 23 hours and the entry is deleted on your next visit.

• __ph_opt_in_out_*: necessary; local storage; website and apps. Stores the consent status applied by PostHog: 1 if you have accepted the “Analytics” category and 0 if you have rejected it or withdrawn your acceptance. It is created the first time you accept or reject that category. It contains no identifier.

• energio_partner_code: necessary; local storage; website. Stores the code of the partner whose link you used to reach the website, to attribute your request to that partner. It is created when a page loads with a partner’s code in its address, without waiting for your cookie decision, and the code of the next partner link you use replaces it.

• energio_attribution_v1: analytics; local storage, 90 days per record; website. Whenever you submit a form, it adds a record with the page, the site you came from, the campaign parameters in the address and your Google Analytics and PostHog identifiers, and keeps up to 20 records from the last 90 days to understand how you came to Energio. Advertising identifiers are stored only if you have also accepted the “Marketing” category. It is created only if you accept the “Analytics” category and is deleted if you withdraw consent to that category.

• energio_attribution_landing_page: analytics; session storage; website. Stores the first page of your visit, to attribute your request if you submit a form. It is created only if you have accepted the “Analytics” category; without the “Marketing” category, it is stored without advertising identifiers.

• energio_attribution_landing_referrer: analytics; session storage; website. Stores the site you came from at the start of your visit, for the same purpose and under the same conditions as the preceding entry.

• ph_*_posthog (cookie): analytics; cookie, 1 year; website. Stores PostHog identifiers, such as your browser and session identifiers. It is created only if you accept the “Analytics” category and is deleted if you reject it or withdraw your consent.

• ph_*_posthog (local storage): analytics; local storage; website. Stores your PostHog identifier and the properties PostHog adds to your analytics events, including the identifier of the record of your acceptance, so we can demonstrate it (see the Privacy Policy). It is created only if you accept the “Analytics” category and is deleted if you reject it or withdraw your consent, or when your decision expires after 24 months.

• ph_* (session storage): analytics; session storage; website. Stores the state of the window and analytics session and, if session recording is active, the recording fragments awaiting transmission. It is created only if you accept the “Analytics” category and is deleted in all open website tabs if you withdraw your consent.

In the apps, PostHog does not store identifiers on your device: it keeps them only in the page’s memory while it is open.

5. Third-party cookies

These are installed or read by other companies whose services we integrate into the website through Google Tag Manager. We group them by company and state the domain on which each is installed. They are used only on the website. Google processes Google Analytics data on behalf of Energio, but we group these cookies here because Google manages them using its own tools and terms.

5.1. Google (Google Ireland Limited)

Google Analytics measures how the website is used. It loads through Google Tag Manager and our server-side tagging server (eh.energio.es), which runs on Google Cloud, and only loads and sends measurements if you accept the “Analytics” category:

• _ga: analytics; cookie, 2 years; installed on the energio.es domain. Stores a random pseudonymous identifier to recognise your browser on later visits and distinguish unique visitors. Energio also reads it and adds it to the analytics events it records in PostHog and to your request’s attribution history.

• _ga_HMRZNPDWRP: analytics; cookie, 2 years; installed on the energio.es domain. Stores your session state to count visits. Energio also reads it for the same purpose as _ga.

• FPID: analytics; cookie, 2 years; installed by our server-side tagging server on the energio.es domain. Stores a random pseudonymous Google Analytics identifier to recognise your browser. Your browser sends it only to Energio’s domains and pages cannot read it, so the website cannot delete it: it remains until it expires or you delete it through your browser.

• FPLC: analytics; cookie, 20 hours; installed by our server-side tagging server on the energio.es domain. Stores a value derived from FPID that allows it to be maintained across domains. Energio also reads it for the same purpose as _ga.

Some browsers, such as Chrome, limit cookie lifetimes to 400 days, even if a longer period is configured.

5.2. Meta (Meta Platforms Ireland Limited)

The Meta pixel loads through Google Tag Manager only if you accept the “Marketing” category:

• _fbp: marketing; cookie, 90 days; installed on the energio.es domain. Stores a random pseudonymous identifier for your browser to measure the effectiveness of Meta ads, create audiences and show you personalised advertising.

• _fbc: marketing; cookie, 90 days; installed on the energio.es domain. Stores the identifier of the click on a Meta ad that brought you to the website.

• lastExternalReferrer: marketing; local storage; installed on the energio.es domain. Stores the last external site you came from, which the Meta pixel uses to attribute advertising conversions.

• lastExternalReferrerTime: marketing; local storage; installed on the energio.es domain. Stores the date and time of that arrival, for the same purpose.

With the “Marketing” category accepted, your browser also sends page visit and interaction events to our server-side tagging server, which forwards them to the Meta Conversions API without installing cookies. If you also accept the “Analytics” category, PostHog sends the conversion to Meta when you submit a form, with _fbp, _fbc or fbclid. The data for each route is described in the Privacy Policy.

5.3. LinkedIn (LinkedIn Ireland Unlimited Company)

The LinkedIn Insight Tag loads through Google Tag Manager only if you accept the “Marketing” category. With its Website Actions feature, it also sends LinkedIn the pages you visit, the time you spend on them and your clicks (see the Privacy Policy). The lifetimes are those in LinkedIn’s cookie table.

The tag may install these cookies on the energio.es domain:

• li_fat_id: marketing; cookie, 30 days; installed on the energio.es domain. Stores the identifier of the click on a LinkedIn ad that brought you to the website. The Insight Tag sends it to LinkedIn and, if you also accept the “Analytics” category, PostHog sends it with the conversion when you submit a form.

• li_giant: marketing; cookie, 7 days; installed on the energio.es domain. Stores an indirect identifier for groups of LinkedIn members to measure conversions.

• oribi_cookie_test: marketing; session cookie; installed on the energio.es domain. Checks whether Website Actions measurement can be enabled.

• oribili_user_guid: marketing; cookie, 1 year; installed on the energio.es domain. Counts unique visitors for Website Actions.

• ln_or: marketing; cookie, 1 day; installed on the energio.es domain. Checks whether Website Actions measurement can be enabled on the website.

• ar_debug: marketing; session cookie; installed on the energio.es domain. Enables integration with Google’s Attribution Reporting API.

The tag may also install or read these cookies on LinkedIn’s domain (linkedin.com), which the website cannot delete:

• bcookie: marketing; cookie, 1 year. Identifies your browser to detect abuse and run diagnostics.

• li_gc: marketing; cookie, 6 months. Stores your decision about LinkedIn’s non-essential cookies.

• lidc: marketing; cookie, 24 hours. Selects LinkedIn’s data centre.

• __cf_bm: marketing; cookie, 30 minutes. Installed by Cloudflare, LinkedIn’s provider, to detect bots.

• UserMatchHistory: marketing; cookie, 30 days. Records when advertising identifiers were last synchronised.

• AnalyticsSyncHistory: marketing; cookie, 30 days. Records when lms_analytics was last synchronised.

• li_sugr: marketing; cookie, 90 days. Probabilistically matches your identity for advertising purposes.

• lms_ads: marketing; cookie, 30 days. Identifies LinkedIn members outside LinkedIn for advertising purposes.

• lms_analytics: marketing; cookie, 30 days. Identifies LinkedIn members outside LinkedIn for analytics purposes.

5.4. Apollo (ZenLeads Inc.)

The Apollo pixel loads through Google Tag Manager only if you accept the “Marketing” category. It does not install cookies:

• apolloAnonId: marketing; local storage; installed on the energio.es domain. Stores a random pseudonymous identifier for your browser so Apollo can identify, from your IP address and visits, the company from which you visit the website.

• 6a1df683cbe965000c2e3290_eventQueue: marketing; local storage; installed on the energio.es domain. Stores the queue of Apollo pixel events awaiting transmission.

• 6a1df683cbe965000c2e3290_canTrack: marketing; local storage; installed on the energio.es domain. Stores the Apollo pixel’s tracking status. It contains no identifier.

6. Before you decide and if you reject

Until you decide, or if you reject the “Analytics” and “Marketing” categories, we do not send PostHog, Google Analytics, Meta, LinkedIn or Apollo any data about your browsing, from either your browser or our servers, except for the event without identifiers about your decision and, in the apps, the download of the PostHog tool and browser security reports described below. On the website, your browser does not even download the PostHog tool, and neither Google Analytics nor any Meta, LinkedIn or Apollo tag loads. Nor do we record events about your request in PostHog (for example, when you upload a bill) if you have not accepted the “Analytics” category. The website and apps continue to function normally.

Before you decide, the website stores only framerCookiesConsentMode in your browser, with all categories disabled, and energio_partner_code if you arrive through a partner’s link. Once you decide, it also stores the entries needed to remember and demonstrate your decision (framerCookiesDismissed or cookie_consent, energio_consent_outbox:* and __ph_opt_in_out_*). All are described in section 4.

When you choose an option in the cookie banner, your browser sends your decision to our consent records. From that record, we send PostHog an event from our servers with your decision and the status of each category, the language, the version of the banner text, the banner variant, the page (on the website) and, if present in the address, the campaign parameters utm_source, utm_medium and utm_campaign. That event does not include any identifier assigned to you, your IP address or your browser data, although it could potentially be linked to you through the date and page or a campaign parameter personalised for you. It helps us understand how many people accept or reject each category. It relies on the same legal obligation as the consent record, as processing compatible with its purpose (Articles 6.1.c and 6.4 of the GDPR; see the Privacy Policy).

Before you decide, the following also happens:

• On the website, your browser downloads the Google Tag Manager container from Google, the tool we use to load analytics and marketing tags. Google therefore receives the technical data for that download, such as your IP address and browser data, but the container does not activate any tag until you accept the corresponding category.

• Framer, which hosts the website on behalf of Energio, receives the requests for the pages you visit, which are necessary to display them to you.

• In the apps, your browser downloads the PostHog tool and its configuration but does not send analytics events or session recordings until you accept the “Analytics” category. It also sends PostHog browser security reports, regardless of your decision, when a page attempts to load or execute something its security policy does not allow (see the Privacy Policy).

7. International transfers

PostHog hosts analytics data in the EU (Frankfurt, Germany). Google, Meta, LinkedIn and Apollo may process data obtained through their cookies in the United States under the EU-U.S. Data Privacy Framework (Article 45 of the GDPR) or, failing that, standard contractual clauses (Article 46.2.c of the GDPR). Framer, which hosts the website, has its services hosted in the U.S., with the safeguards described in the Privacy Policy. You will find further information in the Privacy Policy.

8. Managing cookies

8.1. “Cookie configuration” banner

On your first visit, the “Cookie configuration” banner asks which cookies you accept. Until you decide, all categories except “Necessary” are disabled. You can:

• “Accept all”: accept all categories.

• “Reject all”: reject all non-essential cookies.

• “Customize”: enable or disable each category separately (“Preferences”, “Analytics” and “Marketing”) and confirm with “Save preferences”.

8.2. Changing or withdrawing your consent

You can change or withdraw your consent at any time, as easily as you gave it, using “Cookie configuration” on the website and in the apps. Withdrawal does not affect the lawfulness of earlier processing.

When you withdraw consent to a category, the page reloads, including in other open website tabs, and we delete the cookies and entries for that category on the energio.es domain from your browser, except FPID, which the website cannot delete. You can delete the cookies LinkedIn stores on its own domain only through your browser settings.

If you withdraw your acceptance of the “Marketing” category, a LinkedIn Insight Tag that has already loaded may continue sending data to LinkedIn until that reload, which normally takes less than a second. If your browser cannot save your decision, the page does not reload and the tag may continue sending data until you leave the website, reload the page or close the tab.

8.3. Browser settings

You can also manage cookies through your browser settings. Instructions for the most common browsers:

• Google Chrome: Delete, allow and manage cookies

• Mozilla Firefox: Clear cookies and site data

• Apple Safari: Manage cookies and website data

• Microsoft Edge: Manage cookies in Microsoft Edge

If you disable cookies through your browser, some website features may stop working properly.

9. Updates to the Cookie Policy

We will update this Cookie Policy when the cookies we use or the rules change; if the change is material, we will ask for your consent again.