Information about the use of cookies
Last updated: September 2026
This Cookie Policy is provided in compliance with art. 22.2 of Law 34/2002 (LSSI-CE), with art. 5.3 of Directive 2002/58/EC (ePrivacy) and with the AEPD's Guidance on the use of cookies, as well as with Regulation (EU) 2016/679 (GDPR) and the LOPDGDD.
Scope of this information. The turbohost.es site uses cookies and analogous technologies of a strictly technical nature, exempt from consent pursuant to art. 22.2, last sentence, of the LSSI-CE, a cookieless analytics solution (Umami) and, subject to the user's prior consent, the analytics cookies of Google Analytics 4 and PostHog (non-exempt services). In addition, only if the user accepts the «Advertising» category, Google Ads and Meta campaign measurement cookies may be used (section 3.6). For this reason the site does provide a consent banner with accept all, reject all and per-category options (Analytics, Advertising): the non-exempt analytics cookies (Google Analytics 4 and PostHog) are stored only after the user has given their consent. Until consent is given — and if the user rejects — Google Analytics 4 operates in a cookieless mode (Google Consent Mode v2) and PostHog runs without cookies, with neither of the two storing anything on the user's device. The technical cookies and the cookieless analytics, by contrast, do not require consent.
Cookies are small text files that websites store on the user's device (computer, smartphone, tablet) during browsing. They are used for various purposes, including the technical operation of the site, the storage of the user's preferences and traffic analysis.
In addition to traditional cookies, there are other technologies for storing and retrieving data on the user's terminal (such as local storage and tracking pixels) that may perform analogous functions. This policy applies to all of these technologies.
In Spain, the use of data storage and retrieval devices on the user's terminal (cookies and analogous technologies) is governed by art. 22.2 of Law 34/2002 (LSSI-CE), which transposes art. 5.3 of Directive 2002/58/EC (ePrivacy). That rule allows the use of non-exempt cookies provided the user has given their consent after receiving clear and complete information on their use.
The same rule, in its last sentence, exempts from the consent requirement those cookies whose sole purpose is to carry out the transmission of a communication or that are strictly necessary to provide a service expressly requested by the user. The site's technical cookies (see section 3) and its cookieless analytics system fall within this exemption and do not require consent. By contrast, the Google Analytics 4 and PostHog analytics cookies are non-exempt and are installed only with the user's prior consent obtained through the consent banner (art. 22.2 LSSI-CE; legal basis: consent, art. 6.1.a RGPD).
These cookies are strictly necessary for the communication or for the provision of a service expressly requested by the user and are therefore exempt from the consent requirement pursuant to art. 22.2, last sentence, of the LSSI-CE. They cannot be disabled without compromising the use of the service.
| Cookie | Ownership | Purpose | Duration |
|---|---|---|---|
| Session and security | First-party | Maintain the session state during the ordering process and ensure browsing security | Session |
| CSRF protection | First-party | Prevent Cross-Site Request Forgery attacks (user security) | Session |
| th_cs | First-party | Show your order summary on the confirmation page after payment, without exposing the payment identifier in the page address (HttpOnly cookie, sent only to the order status service) | 1 day |
| Language/locale preference | First-party | Store the language chosen by the user (interface customization requested by the user) | Persistent |
According to the AEPD Guidance, exempt cookies include user-input cookies, authentication or session-identification cookies, security cookies, load-balancing cookies and user-requested interface-customization cookies.
For the analysis of traffic and site usage, TurboHost uses Umami Analytics, a privacy-respecting web analytics platform hosted on a self-hosted instance of the controller.
As it is a cookieless solution that does not store or retrieve data on the user's terminal, Umami Analytics does not fall within the scope of art. 22.2 LSSI-CE and does not require the user's consent.
For audience and traffic measurement and the production of site-usage statistics, TurboHost also uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for users in the European Economic Area; the data may be processed by Google LLC (United States).
These are non-exempt analytics cookies that, pursuant to art. 22.2 of the LSSI-CE, require the user's prior consent (legal basis: consent, art. 6.1.a RGPD). These cookies are set only after the user accepts through the cookie banner; until then, and if the user rejects, Google Analytics 4 runs in a cookieless consent-denied mode (Consent Mode v2) and sets no cookies on the device.
| Cookie | Ownership | Purpose | Duration |
|---|---|---|---|
| _ga | Google (third-party) | Distinguish users for audience/traffic measurement and site-usage statistics | 2 years |
| _ga_<container-id> | Google (third-party) | Maintain the session state for Google Analytics 4 measurement | 2 years |
| _gid (historic) | Google (third-party) | Distinguish users (legacy Universal Analytics cookie) | 24 hours |
The use of Google Analytics 4 may entail an international transfer of data to the United States, carried out under the appropriate safeguards of the GDPR (EU-US Data Privacy Framework and/or Standard Contractual Clauses). For more information, see Google's privacy policy at policies.google.com/privacy.
To understand how purchase and service activation are completed (conversion funnel), TurboHost uses PostHog, provided by PostHog Inc. and hosted in its European Union region (Frankfurt, Germany).
Only if the user accepts analytics cookies are a first-party identification cookie (th_vid) and PostHog cookies set. Until the user chooses, and if they reject them, PostHog runs without cookies or on-device storage: visits are counted with an anonymous identifier computed on PostHog's servers, which changes every day and cannot recognise the user. On rejection, only a technical record of the refusal is kept on the device (the __ph_opt_in_out_<key> localStorage entry), needed to honour that choice. No sessions are recorded, automatic capture of clicks and interactions is disabled, and no form input is captured.
| Cookie | Owner | Purpose | Duration |
|---|---|---|---|
| th_vid | TurboHost (first party) | Anonymous visitor identifier to measure the funnel from visit to service activation (HttpOnly cookie) | 1 year |
| th_attr (localStorage) | TurboHost (first party) | Remember which campaign or site you came from (UTM parameters and ad click identifiers) to attribute the order correctly. Only with consent; without consent this data stays in the page memory and is not stored on the device | 90 days |
| ph_<key>_posthog | PostHog (third party) | PostHog analytics measurement state | 1 year |
| __ph_opt_in_out_<key> (localStorage) | PostHog (third party) | Technical: records the user's choice (acceptance or refusal) so that it is honoured | Persistent until cleared |
| Third party | Purpose | Third-party policy | Duration |
|---|---|---|---|
| Stripe, Inc. | Technical cookies for transaction security, fraud prevention and the proper functioning of payment, active exclusively during the payment process (service expressly requested by the user) | stripe.com/privacy | Session/persistent (cf. Stripe's policy) |
Stripe's cookies are technical in nature and are activated only when the user initiates a payment (service expressly requested): they are therefore covered by the exemption of art. 22.2, last sentence, LSSI-CE. These cookies are managed by Stripe, Inc., which may act as an autonomous controller or processor. Where this gives rise to international data transfers (e.g. to the USA), these are carried out under the appropriate safeguards of the GDPR (EU-US Data Privacy Framework and/or Standard Contractual Clauses).
If the user accepts the Advertising category, the site may use Google Ads (Google Ireland Limited) and Meta Pixel (Meta Platforms Ireland Limited) cookies to know which ad brought the user, measure the purchases generated by campaigns and show relevant ads. Without that consent they are not set: Google operates under Google Consent Mode v2 without advertising cookies. As of the date of this policy these tags are not yet active; once activated, they will only load with «Advertising» consent.
| Cookie | Owner | Purpose | Duration |
|---|---|---|---|
| _gcl_au, _gcl_aw | Google (Google Ads) | Link an ad click to the purchase (conversion measurement) | 90 days |
| _fbp, _fbc | Meta (Meta Pixel) | Link the visit to a Meta ad and measure its results | 90 days |
The non-exempt analytics cookies (Google Analytics 4 and PostHog) are set only after the user accepts through the cookie banner. The user may withdraw consent at any time, with effect for the future, by any of the following means:
The exempt technical cookies do not require consent and there is therefore no consent to withdraw in respect of them; the user may nevertheless manage, block or delete them through their browser settings, although disabling them may compromise the operation of the site and access to the services (e.g. the payment process).
Guides for managing cookies in the main browsers:
Access to the site and to the services is not conditional on the acceptance of the non-exempt analytics cookies (no cookie walls): the user may reject Google Analytics 4 and PostHog and continue to browse and use the services normally. The non-exempt analytics cookies currently used (Google Analytics 4 and PostHog) are installed only with the user's consent, obtained through the consent banner in accordance with the AEPD Guidance. Should additional non-exempt cookies be introduced in the future, the controller will extend the consent mechanism accordingly and will update this policy.
TurboHost reserves the right to update this Cookie Policy at any time, to adapt it to regulatory changes or to variations in the services offered. Changes will be published on this page with the new update date indicated.
For any query about this Cookie Policy or about the processing of personal data, you may contact the data controller:
Francesco Antonio Sessa
C. de Fray Ceferino González 9, 28005 Madrid, Spain
NIF: ESZ4443995D
Contact: via our
The user also has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es (arts. 13.2.d and 77 GDPR). For more information on the processing of data, see the Privacy Policy.
This document has been drawn up for informational purposes and does not constitute legal advice. It is recommended to consult a professional to verify its compliance with the applicable regulations. This is a translation for convenience; in the event of any discrepancy, the Spanish version prevails.