Skip to content

Cookie policy

1. What cookies and similar technologies are

Cookies are small files that a website stores in your browser to remember information between visits. Alongside them there are similar technologies, such as the browser's local storage (localStorage) and session storage (sessionStorage), which serve the same purpose and are subject to the same rules. In this policy we refer to all of them as "cookies".

3. Types of cookies

  • Necessary: let you browse, keep your basket, remember your language, pay securely and save your cookie preferences, and they make the things you use in the shop work, such as your favourites or your recent searches. Without them the shop does not work.
  • Preferences: remember options you have chosen (for example, the language). When you choose them yourself they are considered exempt from consent.
  • Analytics: measure in aggregate how the shop is used, to improve it. They require consent. The shop's own audience measurement in the table is exempt: it only produces anonymous statistics about this shop, with no cookies and no third parties.
  • Marketing: allow campaigns to be measured and personalised advertising to be shown on other sites. They require consent.

Depending on who manages them, cookies can be first-party (from extrapy.com) or third-party (from other providers). Depending on their duration, session cookies (deleted when you close the browser) or persistent cookies (kept for a set period).

4. Cookies used on this site

Cookies and storage used on extrapy.com

  • extrapy-consent-v1

    Owner
    First-party (localStorage)
    Type
    Necessary
    Purpose
    Stores your cookie decision so we do not ask again.
    Duration
    12 months

  • extrapy-cart-v1

    Owner
    First-party (localStorage)
    Type
    Necessary
    Purpose
    Keeps the contents of your basket between visits.
    Duration
    Until you empty the basket or clear browser data

  • extrapy-favourites-v1

    Owner
    First-party (localStorage)
    Type
    Necessary (functional)
    Purpose
    Keeps the products you mark as favourites on your device (only their identifiers), with no account needed.
    Duration
    Until you remove them or clear browser data

  • extrapy-recent-v1

    Owner
    First-party (localStorage)
    Type
    Necessary (functional)
    Purpose
    Remembers the last products you viewed (up to 12, only their identifiers) so you can find them again.
    Duration
    Until you clear browser data

  • extrapy-recent-searches-v1

    Owner
    First-party (localStorage)
    Type
    Necessary (functional)
    Purpose
    Remembers your latest searches (up to 6) to offer them in the search box, where you can clear them.
    Duration
    Until you clear them or clear browser data

  • extrapy-discount-v1

    Owner
    First-party (sessionStorage)
    Type
    Necessary
    Purpose
    Keeps the discount code you applied while you finish your purchase.
    Duration
    Session (deleted when you close the tab)

  • extrapy-announce-dismissed-v1

    Owner
    First-party (sessionStorage)
    Type
    Necessary (functional)
    Purpose
    Remembers that you closed the announcement bar so it is not shown again.
    Duration
    Session (deleted when you close the tab)

  • praceiraIntro

    Owner
    First-party (sessionStorage)
    Type
    Necessary (functional)
    Purpose
    Remembers that this tab has already shown the opening so it is not shown again.
    Duration
    Session (deleted when you close the tab)

  • NEXT_LOCALE

    Owner
    First-party (cookie)
    Type
    Preferences (exempt)
    Purpose
    Remembers the language you chose when switching languages.
    Duration
    Session

  • pc

    Owner
    First-party (cookie)
    Type
    Necessary (functional)
    Purpose
    Stores the postcode you type in the basket or at checkout, and the shipping zone it belongs to, to show you when your order arrives. It is only created when you type a postcode and is not shared with anyone.
    Duration
    180 days

  • __Host-extrapy_account

    Owner
    First-party (cookie)
    Type
    Necessary
    Purpose
    Keeps you signed in to your account on this device. It is only created when you sign in to My account and is deleted when you sign out. The __Host- prefix stops any other site from setting or changing it.
    Duration
    60 days from when you last sign in or change something in My account (never more than one year from when you signed in)

  • __Host-extrapy_account_challenge

    Owner
    First-party (cookie)
    Type
    Necessary
    Purpose
    Ties the sign-in code we sent you to this browser while you type it, so nobody else can use it or use up its tries. It is only created when you ask for a code.
    Duration
    15 minutes; deleted when you sign in

  • __Host-extrapy_account_known

    Owner
    First-party (cookie)
    Type
    Necessary
    Purpose
    Remembers that you have signed in to your account from this browser, so nobody can stop you signing in by asking for codes to your address. It holds a keyed fingerprint of your email, not the email. It is only created when you sign in.
    Duration
    1 year

  • Own audience measurement

    Owner
    Own (no cookie)
    Type
    Necessary (audience measurement, exempt)
    Purpose
    Counts visits, products viewed, baskets and checkouts started, on offer pages how long they are looked at and how far down they are read, and how often the cookie notice is shown and what is chosen in it, so we know how the shop is used. It stores nothing on your device: it is not a cookie and writes nothing to your browser; it only reads whether the basket the shop already keeps holds something. The data is ours, is shared with no one and is only seen as totals.
    Duration
    Nothing is stored in your browser

  • xp_consent

    Owner
    First-party (cookie)
    Type
    Necessary
    Purpose
    A copy of your cookie decision (just "yes" or "no" for analytics and for marketing, and the date you made it), so the server respects it when it processes your order and we do not ask again if your browser clears its local storage.
    Duration
    12 months

  • xp_src

    Owner
    First-party (cookie)
    Type
    Necessary (own campaign measurement, exempt)
    Purpose
    Keeps the campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content) of the link you arrived from, so we know which campaigns bring orders; they are stored with your order. Only if you accept "Marketing" does it also keep the ad click identifier (fbclid, ttclid, gclid). Nothing is shared with anyone from this cookie.
    Duration
    Session (deleted when you close the browser)

  • xp-staff-v1

    Owner
    First-party (localStorage)
    Type
    Necessary (functional)
    Purpose
    Only on the shop team's own devices: marks that someone has signed in to the admin panel, so their visits do not count as a customer's. Never created for customers.
    Duration
    30 days

  • Analytics cookies

    Owner
    —
    Type
    Analytics
    Purpose
    Not currently active. If we enable an analytics tool it will be listed here and only set with your consent.
    Duration
    —

  • _fbp, _fbc

    Owner
    Meta Platforms Ireland Ltd. (cookie on this site)
    Type
    Marketing
    Purpose
    Set by the Meta pixel only if you accept "Marketing". They tell your browser apart (_fbp) and remember the Facebook or Instagram ad click you arrived from (_fbc), to measure which campaigns bring visits and purchases. The shop sends it pages viewed, products viewed, what you add to the basket, the start of checkout and the purchase (amount, products and quantities). With your permission, when you place an order it also sends the purchase from its server, with your email and phone hashed (SHA-256), your IP address and your browser.
    Duration
    90 days

  • t_pt_gid, trc_cookie_storage; in the browser's storage, taboola global:…, eng_mt and <ID>:session-data

    Owner
    Taboola.com Ltd., Israel (cookie on this site)
    Type
    Marketing
    Purpose
    Set by the Taboola pixel only if you accept "Marketing". They keep an identifier for your browser and, if you arrived from a Taboola ad, the identifier of that click, to measure which Taboola campaigns bring visits and purchases. The shop sends it pages viewed (without the part of the address after the "?", except campaign tags), products viewed, what you add to the basket, the start of checkout and the purchase (amount, quantities and order number). Taboola also keeps its own cookies on taboola.com (such as t_gid), governed by its cookie policy. If you withdraw your permission, the shop deletes what Taboola kept on this site.
    Duration
    1 year (t_pt_gid, trc_cookie_storage); the browser's storage, until you withdraw your permission or clear it

All the first-party storage in the table is necessary or functional: it is created by a feature you use (the basket, favourites, search, a discount code, the announcement bar, the postcode for the delivery date) and stays in your browser. We do not use it for analytics or advertising.

How we measure visits without cookies. When you open a page, the shop sends our own server a notice of a few bytes with the page (without the part of the address after the "?"), the website you came from (its domain only, not the page) and the campaign if the link names one ("utm_source" and "utm_campaign" only), and one yes or no it reads from the basket your browser already keeps for the shop (whether it holds something); the notice stores nothing on your device. On offer pages, while you have the page in view, it also sends notices just as small with the page and a single number from a closed list: the seconds it has been in view (at 5, 10, 15, 20, 30, 45, 60, 90, 120, 180 and 300), how far down the page you have got (past the opening, the prices, the order form) or that you tapped one of its formats; none carries an identifier or stores anything on your device. While the cookie notice is shown, each page you open also sends a notice just as small with the page and a single number: that the notice was in view and, if you choose, what you chose in it (accept, reject or save your settings); it carries no identifier either, stores nothing on your device and does not change what you chose. From your IP address and browser type, which travel with any request, the server forms a key, a digest made with a secret that changes every day and exists only in its memory (it is not encryption: it cannot be reversed); the key is deleted within the hour after midnight and cannot recognise you on another day. The shop's backup copies keep it until they are renewed, under 12 months. Neither the measurement nor our server's log stores your IP address or your browser for these notices. Visits are kept by the hour, never to the second, and in the live view and today's view a page, a product or a source is only shown when visitors from at least two different addresses share it. This is our own audience measurement, for statistics only and never combined with other data, which the Spanish data protection authority (AEPD) treats as exempt from consent (guide on cookies for audience measurement tools, January 2024). If your browser sends the "Global Privacy Control" or "Do Not Track" signal, you are not counted.

5. How to change your consent

You can accept, reject or configure cookies from the banner shown on your first visit, and change your decision at any time with the button below (also available in the footer). Your choice is kept for 12 months; after that we will ask you again.

If you withdraw your permission for a category, the shop deletes the cookies its tools had set on this site and reloads the page so they stop running. What those platforms keep on their own sites is governed by their policies: Meta, TikTok, Google.

7. Updates

We will update this policy when we add new cookies or existing ones change. Check the last-updated date at the top of this page.

Other legal documents