Cookies Policy
Last updated: October 17, 2026
1. What is a cookie?
A cookie is a small text file that a website stores in your browser to recognise you on subsequent visits, keep your session active, remember your preferences or measure use of the service.
2. Data Controller
PROMO-TIENDA, S.L. (hereinafter "PROMOTIENDA" or "the Data Controller"), with address at Avda. Paral·lel, 110, 08015 Barcelona, Tax ID B60840675. Contact: comercial@promotienda.es / +34 93 329 74 64.
3. Scope of this policy
This Cookies Policy applies to:
- The corporate website www.digitalsignagerds.com.
- The SaaS digital signage management application rds.digitalsignagerds.com (hereinafter "the Application").
4. Cookies we use
4.1 Strictly necessary cookies (no consent required)
| Name | Owner | Purpose | Duration |
|---|---|---|---|
PROMOTIENDA | First party (rds.digitalsignagerds.com) | PHP session identifier. Keeps the user authenticated while they use the Application. | Session (deleted when the browser is closed) |
| CSRF token | First party | Anti-CSRF request token, bound to the session, used to protect actions that modify data. | Session |
rds_consent | First party (.digitalsignagerds.com) | Stores your answer to the cookie banner (all = accept, essential = reject). In the Application, the Configure button stores a JSON object under this same cookie holding the per-category choice. | 180 days |
4.2 Functionality cookies
| Name | Owner | Purpose | Duration |
|---|---|---|---|
lang | First party (rds.digitalsignagerds.com) | Remember the user's selected language (es, en, ca, fr, pt). | 12 months |
4.3 Security cookies
| Name | Owner | Purpose | Duration |
|---|---|---|---|
rds_mfa_trust | First party (rds.digitalsignagerds.com) | Mark a device as "trusted" so the second authentication factor is not requested on every login. | 30 days |
4.4 Third-party cookies
This Cookie Policy is the single document governing cookies on both of the domains listed in section 3: the corporate site www.digitalsignagerds.com and the Application rds.digitalsignagerds.com. There is no other cookie policy to refer to.
Neither the corporate site nor the Application uses Google Analytics, Google Tag Manager containers, Hotjar, Meta Pixel or equivalent analytics or profiling tools, with one exception: Microsoft Clarity, which the corporate site loads only if you accept it (see the table). The site's own cookieless measurement is described in section 4.5. The third parties that are involved are listed below, stating in each case which domain they act on and whether they load before or after your consent is obtained.
| Third party | Where | Cookies and data | Purpose, transfer and consent |
|---|---|---|---|
| Google Ads Google Ireland Ltd. / Google LLC ID AW-946666836 | Both domains. Corporate site: every page, via /assets/gtag.js. Application: the public signup page (/register.php), which the site's calls to action point at, and the post-signup page (/tutorial.php), both via includes/analytics.inc.php. Both of those pages show the consent banner. | Google cookies of the _gcl_au, _gcl_aw, _gcl_dc family (up to 90 days) and our own rds_gclid cookie (90 days) holding the ad click identifier. Your IP address as well. The Google tag also keeps the entry _gcl_ls in your browser's local storage, with Google's ad-click data. When you submit a form on a page where the tag is running (for example, the email field of the free QR code menu tool), the tag may detect an email address, phone number or postal address in it and send it to Google as a SHA-256 hash, not as readable text, together with the location of the field on the page; Google can compare that hash with its own account data to attribute conversions (Google's “enhanced conversions” with automatic detection of user-provided data). | Measuring conversions from our advertising campaigns and linking the visit across the two domains, so that a signup that begins on the corporate site and finishes in the Application is attributed correctly. This involves an international transfer to the United States (Google LLC), covered by standard contractual clauses and the EU-US Data Privacy Framework. Consent: on the corporate site the tag does not load until you accept it; in the Application it likewise does not load on those two pages until you accept it in the consent banner that both of them show. |
| Calendly Calendly LLC (United States) | Corporate site only: the “30 minutes with an engineer” band on the home page and the /contact/ page. | Cookies set inside the embedded calendar by Calendly and by its providers: __cf_bm (Cloudflare, 30 minutes) and _cfuvid (Cloudflare, session), for bot protection and traffic distribution; OptanonConsent and OptanonAlertBoxClosed (OneTrust, 1 year), which record the decision you take in Calendly's own cookie notice. The frame also loads third-party resources that receive your IP address without setting cookies: js.stripe.com (Stripe, fraud prevention), www.recaptcha.net and www.gstatic.com (Google reCAPTCHA Enterprise, protecting the form against abuse), accounts.google.com (Google Identity Services: Google's identity library, which Calendly uses to offer you signing up for Calendly, or signing in to it, with a Google account; it is not part of reCAPTCHA and it loads whether or not you use that option) and notifier-configs.airbrake.io (Airbrake, Calendly's error logging), together with Calendly's own content servers (assets.calendly.com and its Amazon CloudFront delivery network) and dfp.calendly.com, which serves no content: it receives a device fingerprint generated in your browser and returns an identifier that Calendly attaches to the booking in order to prevent fraud and abuse. Also the data you provide when booking: name, email address, the other booking-form fields, time zone and IP address. | Letting you book the free 30-minute call with an engineer. This involves an international transfer to the United States, covered by standard contractual clauses and the EU-US Data Privacy Framework. Consent: no request is made to Calendly until you accept cookies; if you do not accept, we offer a link that opens the calendar on Calendly's own site, so the decision stays yours. A second decision, inside the calendar: Calendly runs its own cookie notice (OneTrust) inside the frame, covering providers that are its own and not ours. If you accept the optional cookies there, Calendly additionally loads Segment, Google Tag Manager, Google Analytics, Facebook, Braze and Sprig; if you decline or do not answer, none of them loads. We neither read nor alter that decision. |
| Stripe Stripe Payments Europe, Ltd. (Ireland) / Stripe, Inc. (United States) | Application only: profile and billing, screen renewal and, in the screen-management list, only when you start a payment. | __stripe_mid (device identifier, about 1 year) and __stripe_sid (session identifier, about 30 minutes), set by js.stripe.com. Your IP address as well. | Processing subscription payments and preventing fraud. This involves an international transfer to the United States, covered by standard contractual clauses and the EU-US Data Privacy Framework. Consent: the Stripe library loads when profile and billing and screen renewal open, and in the screen-management list only when you start a payment; in none of those cases does it wait for your cookie decision. |
| Google Maps Google Ireland Ltd. / Google LLC | Both domains. Corporate site: the office map on the /contact/ page. Application: screen map, screen detail, workspace list and location editing. | Google's own cookies associated with the embedded map, and your IP address. | Showing the office location and placing screens and workspaces on a map. May involve an international transfer to the United States on the same terms as above. Consent: the map loads when the relevant page opens, without waiting for your cookie decision. |
| YouTube (privacy-enhanced mode) Google Ireland Ltd. / Google LLC | Corporate site only: the presentation video on the home page, the two tutorial videos on the /3d-maps/ page and the videos on the /tutoriales/ tutorials page, in every language. | None before you press play: until then the page shows an image hosted on our own server and makes no request to YouTube or Google. When you press play, the player loads from www.youtube-nocookie.com (YouTube's privacy-enhanced mode). In our measurement it set no cookies, but it did store playback preferences in your browser for that domain: the local storage entries yt-player-bandwidth, yt-player-caption-persistence, yt-icons-last-purged and ytidb::LAST_RESULT_ENTRY_KEY, and the IndexedDB database YtIdbMeta. The player also contacts i.ytimg.com, yt3.ggpht.com and www.gstatic.com (images), fonts.gstatic.com (the player's typeface and icons), *.googlevideo.com (the video stream), and www.google.com and jnn-pa.googleapis.com (a Google anti-abuse check for the player). YouTube receives your IP address, the address of our page and playback statistics. | Showing a short presentation video of RDS and video tutorials on using RDS and its add-ons. Involves an international transfer to the United States (Google LLC), under standard contractual clauses and the EU-US Data Privacy Framework. Consent: nothing loads until you press the play button, which is how you ask for the video; if you do not press it, no request is made to YouTube or Google. |
| Microsoft Clarity Microsoft Corporation (United States) Project yy9j52giyv | Corporate site only, every page, through /assets/clarity.js, which is only downloaded after you accept. Never in the Application. | Clarity first-party cookies on .digitalsignagerds.com: _clck (Clarity pseudonymous identifier and preferences, 1 year) and _clsk (links the page views of one session, 1 day). It also keeps the entry _cltk in the browser's session storage (cleared when the tab is closed). On its own domains (clarity.ms, bing.com) Microsoft may also use CLID, MUID, MR, SM and ANONCHK; we tell Clarity that advertising storage is denied. Data: how you interact with the pages (mouse movements, clicks, scrolling and the page content as you see it), the page address, device type, browser, operating system, screen size and your IP address, from which Microsoft derives the country. Whatever you type into forms and fields is hidden in your browser before anything is sent. | Seeing, in aggregate and in recordings of individual visits, how the site is used (where people click, how far they read, what does not work) in order to improve it. Involves an international transfer to the United States (Microsoft Corporation), covered by the EU-US Data Privacy Framework and standard contractual clauses. Consent: no Clarity file is downloaded and no request is made to clarity.ms until you accept in the banner, which names Clarity explicitly; if you had accepted before we added it, the banner is shown to you again and Clarity does not load until you answer. If you reject or withdraw consent (by deleting the rds_consent cookie), Clarity stops loading and we delete its _clck and _clsk cookies from our domain. Microsoft's information: Clarity cookies and privacy statement. |
Consent summary. The Google Ads cookies — on both domains — and Calendly's are loaded exclusively after you accept them: until then, no request is made to those providers, neither from www.digitalsignagerds.com nor from the Application's /register.php and /tutorial.php pages. The other cases in the table — Stripe and Google Maps in the Application, and the map on the /contact/ page — load when the relevant page opens, or when you start a payment in the case of the screen-management list, without waiting for your decision. If you do not want them to load, block third-party cookies in your browser before visiting those pages. The YouTube videos on the home page, the /3d-maps/ page and the /tutoriales/ page load nothing from YouTube or Google until you press play.
Both domains also load typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). That service sets no cookies, but it does disclose your IP address to Google.
Date of measurement. The cookie names, retention periods and third-party resources listed in this section 4.4 are the ones measured on 10 September 2026. For Calendly the measurement was taken inside the calendar embedded in our pages, which is the context this section describes: opening that same calendar directly on Calendly's site — for instance through the link we offer you if you do not accept cookies — is a context of Calendly's own, in which more of its cookies are set. The result also depends on how your browser treats third-party cookies. We repeat this measurement each time we revise the document. The YouTube row reflects a measurement taken on 13 October 2026.
4.5 Our own visit statistics, without cookies
To understand how the corporate site is used (for example, what a visitor does after arriving from an ad), every page loads a small script of our own, /assets/rds-stats.js. It sets no cookies and stores nothing in your browser (no local or session storage), uses no persistent identifiers or fingerprinting, and involves no third party: the data is sent only to our own server, rds.digitalsignagerds.com. It works the same whatever you answer in the cookie banner.
For each page view it sends: the page path (without parameters), the language, where the visit came from as a category (ad, search engine, social network, email, another website, of which only the domain name is sent, direct visit or internal navigation) and, if present, the campaign name; a rough screen class (phone, tablet or computer); how long the tab was visible; how far down the page you scrolled, as a percentage; which sections you reached; and which main buttons and links you clicked. Each page view carries a random number created when the page opens and discarded when it closes, and its time is recorded only to the hour (no minutes or seconds). The statistics contain no identifier linking the pages of a visit and are not combined with the server logs. Of an ad click identifier (gclid) only the fact that it is present is used, never its value. The statistics do not store your IP address or your browser details (user agent); the latter are checked only to filter out bots and then discarded. To limit abuse, the server keeps a short-lived count of the events from each IP address in the current minute, under a keyed hash rather than the address; this counter is kept only in memory and is never stored. The web server does record those details in its access log, as described below.
Links to the Application's sign-up page and to other pages of the site add two non-identifying markers to the address: src (the source category) and lp (the page where you entered the site). This lets us count how many visits from each source reach sign-up and create an account; when an account is created, that category and page are stored with it, never a click or visit identifier. Page-view data is kept for 90 days; after that only aggregated daily counts remain.
Web server access and error logs. Separately from these statistics, and like any web server, the servers of both domains (www.digitalsignagerds.com and rds.digitalsignagerds.com) write every request they receive to a standard access log: your IP address, the date and time, the requested address with all its parameters (including, if present, an ad click identifier such as gclid and campaign tags such as utm_campaign), the address of the page you came from (referrer) and your browser details (user agent). This also covers the requests through which the statistics script sends its data. The servers' error logs also record the IP address, requested address and referring page of requests that fail. These logs are kept for at most 15 days and are used only for security (detecting attacks and abuse) and for running the service (diagnosing errors). They are not combined with the statistics and are not used to build visitor profiles.
5. Legal basis
- Strictly necessary cookies: legitimate interest of the Data Controller (art. 6.1.f GDPR) and the exception in art. 22.2 LSSI-CE.
- Functionality and security cookies: user consent (art. 6.1.a GDPR; art. 22.2 LSSI-CE).
- Third-party cookies listed in section 4.4: user consent (art. 6(1)(a) GDPR; art. 22.2 LSSI-CE). Section 4.4 states, for each third party, whether that consent is obtained before it loads.
- Our own cookieless statistics described in section 4.5: the Controller's legitimate interest in understanding how the site is used and how well its campaigns work (art. 6(1)(f) GDPR). They neither place nor read cookies or any other information stored on your device.
- Web server access and error logs described in section 4.5: the Controller's legitimate interest in the security and proper operation of its services (art. 6(1)(f) GDPR).
6. Managing and withdrawing consent
On first access the Application shows a consent banner with Accept, Reject and Configure options, in line with the AEPD's Guidance on the use of cookies (July 2023). Consent can be reviewed or withdrawn at any time via the Configure cookies link in the footer.
On the corporate site www.digitalsignagerds.com the banner offers Accept and Reject with equal visual weight, and your answer is stored in the rds_consent cookie for 180 days. To change it, delete that cookie in your browser using the instructions below; the banner will appear again on your next visit.
The user may at any time:
- Withdraw consent from the "Cookie settings" link in the footer of the Application. On the corporate site, delete the
rds_consentcookie as described above. - Block or delete cookies via the browser settings. Instructions: Chrome: https://support.google.com/chrome/answer/95647 — Firefox: https://support.mozilla.org/kb/clear-cookies-website-data — Safari: https://support.apple.com/HT201265 — Edge: https://support.microsoft.com/microsoft-edge
Please note that blocking the strictly necessary cookies will prevent access to the Application.
7. Retention
Cookies are retained for the period stated in the tables above. Data derived from their use (login logs, etc.) is retained as described in the Privacy Policy. Data kept on the servers, including the statistics and logs in section 4.5, can also remain in backups, used only to restore the service, for up to about 6 weeks after it is deleted or its period ends, and is then deleted automatically (details in section 3 of the Privacy Policy).
8. User rights
As a data subject, you may exercise the rights of access, rectification, erasure, objection, restriction and portability. The procedure is described in the Privacy Policy.
9. Amendments
This policy may be updated to reflect changes in the legislation or in the cookies used. The date of the last update appears at the top of the document.