Cookie Policy
Zenwood Solutions, S.L. uses first- and third-party cookies and similar technologies. Necessary technologies provide requested functions, security and storage of the privacy choice. The active market profile determines whether Preferences, Analytics and Marketing are Required, require Consent, or remain Disabled.
1. Your choice
For categories that require consent, you can Accept all, Reject all or manage each category. The interface also identifies Required and Disabled categories. The permanent “Cookie settings” control allows you to change or withdraw available choices. Withdrawal blocks future loads and removes known storage that the browser technically permits Zenwood to remove.
2. Categories
- Necessary: security, consent, chosen language, requested cart/checkout, forms and selected payment.
- Preferences: optional content or interface choices.
- Analytics: audience and site-use measurement.
- Marketing: advertising, attribution, campaigns, pixels, profiles and external content with additional purposes.
Global Privacy Control keeps Marketing disabled. When Do Not Track enforcement is enabled, Analytics and Marketing remain disabled.
3. Technical inventory
The table is generated from Zenwood's technical registry. “Inactive” means that the plugin does not load the service and retains it only for migration or rollback. Services used only during a specific journey, such as payment or video, appear only when the user requests that function.
| Service | Provider | Status | Party | Purpose | Category | Cookies/storage | Domain | Retention | Transfers | Withdrawal/control | Reference | Last reviewed |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Zenwood consent choice | Zenwood Solutions, S.L. | Active | First party | Remember the visitor privacy choice and applicable notice versions | Necessary | zcm_consent: Base64URL JSON containing policy/consent versions, category choices and timestamp. | zenwood.es | 180 days | None | Change or reject choices using the permanent Cookie settings control. | Not applicable | 2026-08-04 |
| Cookiebot (production CMP retained until cutover) | Usercentrics / Cookiebot | Inactive | First and third party | Legacy consent management and rollback control | Necessary | Legacy production CMP storage; export the exact live Cookiebot declaration before cutover. | zenwood.es | Inactive in the candidate; current production configuration must be exported | Per the signed Usercentrics/Cookiebot agreement. | Use the live Cookiebot control until cutover; remove this row after verified migration. | Not applicable | 2026-08-04 |
| Google Tag Manager | Active | Third party technical tag-routing service | Route consent-controlled Analytics and Marketing tags from one reviewed container | Necessary | No independent first-party storage by the container loader; downstream tags follow their disclosed categories and consent checks. | www.googletagmanager.com | Container request and provider logs follow the active Google agreement | Google Ireland and approved subprocessors under the active Google agreement and applicable safeguards. | Withdraw Analytics or Marketing in Cookie settings; GTM receives the denied update and matching downstream tags must not fire. | Provider policy | 2026-08-23 | |
| Google Site Kit (configuration only) | Inactive | Backend/administrative | WordPress connection and reporting support; frontend consent ownership is suppressed | Necessary | No public storage by Zenwood Consent Manager; frontend consent runtime is suppressed. | zenwood.es | WordPress administrator configuration only | Per the connected Google administrator services; not a frontend cookie service in this configuration. | Not applicable to the public consent interface. | Provider policy | 2026-08-04 | |
| Google Analytics 4 | Active | Third party | Audience and website usage measurement | Analytics | _ga and _ga_: distinguish browsers and measure site use. | zenwood.esGooglecollectionendpoints | Up to 2 years | Possible processing outside the EEA under the provider agreement; adequacy decision or Article 46 safeguards must be verified for the active account. | Withdraw the matching category in Cookie settings; the plugin blocks future loads and removes known first-party storage where technically possible. | Provider policy | 2026-08-06 | |
| Google Ads | Active | Third party | Advertising measurement and conversion attribution | Marketing | _gcl_*: advertising click/conversion attribution; Google advertising endpoints may use provider cookies. | zenwood.esgoogleadservices.comdoubleclick.net | _gcl_*: 90 days; other Google advertising cookies vary by provider policy | Possible processing outside the EEA under the provider agreement; adequacy decision or Article 46 safeguards must be verified for the active account. | Withdraw the matching category in Cookie settings; the plugin blocks future loads and removes known first-party storage where technically possible. | Provider policy | 2026-08-04 | |
| Google for WooCommerce events | Google / WooCommerce | Active | Third party | Product and commerce measurement events preserved behind Marketing consent | Marketing | No independent browser storage in the reviewed plugin path; commerce events are held inert until Marketing consent. | googleads.g.doubleclick.net | Event delivery only after consent | Possible processing outside the EEA under the provider agreement; adequacy decision or Article 46 safeguards must be verified for the active account. | Withdraw the matching category in Cookie settings; the plugin blocks future loads and removes known first-party storage where technically possible. | Provider policy | 2026-08-04 |
| Meta Pixel | Meta | Active | Third party | Advertising measurement and conversion attribution | Marketing | _fbp: identifies a browser for advertising measurement. | zenwood.esconnect.facebook.netfacebook.com | 90 days | Possible processing outside the EEA under the provider agreement; adequacy decision or Article 46 safeguards must be verified for the active account. | Withdraw the matching category in Cookie settings; the plugin blocks future loads and removes known first-party storage where technically possible. | Provider policy | 2026-08-04 |
| Clientify Analytics | Clientify | Active | First-party cookies with data sent to Clientify | Lead and marketing attribution | Marketing | vk and uid: visitor/user identifiers (up to 2 years); sk and spvc: session identifier/page count (30 minutes); optional debug cookie (1 day); page/time/referrer and device data. | analytics.clientify.net | Identifiers up to 2 years; session values 30 minutes | Clientify, S.L. (Spain) acts under its Article 28 processing terms; subprocessors and any non-EEA transfer must be verified in the active account DPA. | Withdraw Marketing consent; the plugin blocks the tracker and removes known Clientify cookies. | Provider policy | 2026-08-04 |
| YouTube embeds | Active | Third party | Embedded video playback | Marketing | Provider cookies/local storage may be set only after the visitor enables Marketing and loads the video. | youtube.comyoutube-nocookie.comgoogle.com | Session to provider-defined periods; exact active-player capture required | Possible processing outside the EEA under the provider agreement; adequacy decision or Article 46 safeguards must be verified for the active account. | Withdraw the matching category in Cookie settings; the plugin blocks future loads and removes known first-party storage where technically possible. | Provider policy | 2026-08-04 | |
| Google reCAPTCHA | Active | Third party, interaction-scoped | Form abuse prevention | Necessary | _GRECAPTCHA when the security challenge is executed; device, IP and risk signals. | www.google.com | Provider-controlled security period; exact clean-profile measurement required | Google Ireland/Google subprocessors under the applicable Google terms; account safeguard verification required. | Necessary security processing is limited to protected forms; contact Zenwood for an accessible alternative if the challenge cannot be used. | Provider policy | 2026-08-04 | |
| Trustindex reviews | Trustindex | Active | Third party | Display externally hosted Google review content only after Marketing consent until storage-free behavior is proven | Marketing | External loader, Google review content and profile-image requests; no storage-free guarantee has been accepted. | cdn.trustindex.io | No persistent Zenwood storage identified; third-party request logs follow provider terms | Possible processing outside the EEA under the provider agreement; adequacy decision or Article 46 safeguards must be verified for the active account. | Withdraw the matching category in Cookie settings; the plugin blocks future loads and removes known first-party storage where technically possible. | Not applicable | 2026-08-23 |
| WP Consent API | WordPress community plugin | Active | First party | Share the visitor consent state with compatible WordPress integrations | Necessary | wp_consent_functional, wp_consent_preferences, wp_consent_statistics-anonymous, wp_consent_statistics and wp_consent_marketing; allow/deny category values. | 180 days | None | Updated immediately from the Zenwood Cookie settings control. | Not applicable | 2026-08-04 | |
| WooCommerce storefront and cart | Automattic | Active | First party | Provide products, cart and checkout requested by the visitor | Necessary | woocommerce_cart_hash and woocommerce_items_in_cart (session); wp_woocommerce_session_* (unique cart lookup); optionally woocommerce_recently_viewed and store_notice_* (session). | Session; wp_woocommerce_session_*: 2 days | None from the cart cookies alone | Clear the cart/browser storage; requested cart functionality may be lost. | Not applicable | 2026-08-04 | |
| WooPayments / Stripe payment interface | Automattic / Stripe | Active | Third party on checkout | Provide payment and fraud-prevention functionality on product, cart and checkout journeys | Necessary | __stripe_mid, __stripe_sid and m for fraud prevention; pay_sid, link.auth_session_client_secret and related checkout storage when applicable. | js.stripe.com | Provider/configuration dependent on the selected checkout journey | Automattic/Stripe processing under the merchant agreement; non-EEA safeguards must be verified. | Loaded only on the selected payment journey; choose another offered payment method or leave checkout. | Provider policy | 2026-08-04 |
| PayPal payment interface | PayPal | Active | Third party on checkout | Provide PayPal checkout options requested by the visitor | Necessary | PayPal checkout, security and fraud-prevention cookies on the selected PayPal journey. | www.paypal.com | Provider/configuration dependent | PayPal processing under its merchant/privacy terms; non-EEA safeguards must be verified. | Loaded only when PayPal checkout is requested; choose another offered method or leave checkout. | Provider policy | 2026-08-04 |
| WhatsApp contact / Joinchat interface | WhatsApp / Creame | Active | First party before click; independent third party after click | Display a local contact control; WhatsApp is contacted only after the visitor activates the link | Necessary | Local Joinchat interface and zenwood.es click endpoint; the WhatsApp destination is contacted only after activation. | wa.me | Local interface/session behavior; WhatsApp data follows its policy after click | No WhatsApp transfer before click; after click Meta/WhatsApp terms apply. | Do not activate the link; close the local interface. | Not applicable | 2026-08-23 |
| TranslatePress language preference | Cozmoslabs | Active | First party | Provide the visitor-requested language version and remember language navigation where configured | Necessary | Language selection storage only when needed to remember the language chosen by the visitor. | Provider/configuration dependent; exact clean-profile capture required | None identified for the language choice | Choose another language or clear first-party browser storage. | Not applicable | 2026-08-04 | |
| Hostinger CDN and security delivery | Hostinger | Active | Processor/backend | Deliver and protect the website | Necessary | No optional browser cookie identified; server/CDN security and access logs. | zenwood.es | Per the active Hostinger DPA and account log settings; account value must be recorded before cutover | Hostinger DPA and listed subprocessors; SCCs apply where processing leaves the EEA. | Necessary website delivery; exercise privacy rights through Zenwood. | Provider policy | 2026-08-04 |
| Zenwood enquiry and quotation processing | Zenwood / Elementor / Google Workspace | Active | First party and contracted processors | Receive and answer a visitor-requested enquiry, sample request or quotation independently of optional marketing | Necessary | Elementor/WordPress submission record and email delivery; Clientify CRM only under the disclosed processor route. | zenwood.es | Up to 24 months without a contract; contractual/legal records follow the Privacy Policy | Google Workspace/Clientify/Hostinger safeguards must match the active agreements. | Core processing is necessary to answer the request; object to non-required follow-up at hola@zenwood.es. | Not applicable | 2026-08-04 |
| WhatsApp campaign conversion attribution | Zenwood / Google Ads | Active | Third party | Measure a WhatsApp contact click after Marketing consent | Marketing | Google Ads conversion event after a WhatsApp click; may use _gcl_* attribution storage. | zenwood.es | _gcl_*: 90 days | Possible processing outside the EEA under the provider agreement; adequacy decision or Article 46 safeguards must be verified for the active account. | Withdraw the matching category in Cookie settings; the plugin blocks future loads and removes known first-party storage where technically possible. | Provider policy | 2026-08-04 |
| Clientify webform - Presupuesto | Clientify | Active | Third-party processor plus optional Marketing tracker | Mirror the submitted Elementor form into Clientify CRM with campaign context after Marketing cookie consent; the core Elementor submission remains independent | Marketing | Submitted form fields plus Clientify visitor identifiers/localStorage when Marketing cookies are allowed. | api.clientify.net | CRM lead retention follows the Zenwood Privacy Policy; tracker identifiers up to 2 years | Clientify, S.L. (Spain); subprocessors must match the active DPA. | Core Elementor submission remains available; withdrawing Marketing blocks the Clientify mirror/tracker. | Provider policy | 2026-08-04 |
| Clientify webform - Contacto | Clientify | Active | Third-party processor plus optional Marketing tracker | Mirror the submitted Elementor form into Clientify CRM with campaign context after Marketing cookie consent; the core Elementor submission remains independent | Marketing | Submitted form fields plus Clientify visitor identifiers/localStorage when Marketing cookies are allowed. | api.clientify.net | CRM lead retention follows the Zenwood Privacy Policy; tracker identifiers up to 2 years | Clientify, S.L. (Spain); subprocessors must match the active DPA. | Core Elementor submission remains available; withdrawing Marketing blocks the Clientify mirror/tracker. | Provider policy | 2026-08-04 |
| Clientify webform - Fachadas 1 | Clientify | Active | Third-party processor plus optional Marketing tracker | Mirror the submitted Elementor form into Clientify CRM with campaign context after Marketing cookie consent; the core Elementor submission remains independent | Marketing | Submitted form fields plus Clientify visitor identifiers/localStorage when Marketing cookies are allowed. | api.clientify.net | CRM lead retention follows the Zenwood Privacy Policy; tracker identifiers up to 2 years | Clientify, S.L. (Spain); subprocessors must match the active DPA. | Core Elementor submission remains available; withdrawing Marketing blocks the Clientify mirror/tracker. | Provider policy | 2026-08-04 |
| Clientify webform - Fachadas 2 | Clientify | Active | Third-party processor plus optional Marketing tracker | Mirror the submitted Elementor form into Clientify CRM with campaign context after Marketing cookie consent; the core Elementor submission remains independent | Marketing | Submitted form fields plus Clientify visitor identifiers/localStorage when Marketing cookies are allowed. | api.clientify.net | CRM lead retention follows the Zenwood Privacy Policy; tracker identifiers up to 2 years | Clientify, S.L. (Spain); subprocessors must match the active DPA. | Core Elementor submission remains available; withdrawing Marketing blocks the Clientify mirror/tracker. | Provider policy | 2026-08-04 |
| Clientify webform - Yakisugi vs Thermo-D 1 | Clientify | Active | Third-party processor plus optional Marketing tracker | Mirror the submitted Elementor form into Clientify CRM with campaign context after Marketing cookie consent; the core Elementor submission remains independent | Marketing | Submitted form fields plus Clientify visitor identifiers/localStorage when Marketing cookies are allowed. | api.clientify.net | CRM lead retention follows the Zenwood Privacy Policy; tracker identifiers up to 2 years | Clientify, S.L. (Spain); subprocessors must match the active DPA. | Core Elementor submission remains available; withdrawing Marketing blocks the Clientify mirror/tracker. | Provider policy | 2026-08-04 |
| Clientify webform - Yakisugi vs Thermo-D 2 | Clientify | Active | Third-party processor plus optional Marketing tracker | Mirror the submitted Elementor form into Clientify CRM with campaign context after Marketing cookie consent; the core Elementor submission remains independent | Marketing | Submitted form fields plus Clientify visitor identifiers/localStorage when Marketing cookies are allowed. | api.clientify.net | CRM lead retention follows the Zenwood Privacy Policy; tracker identifiers up to 2 years | Clientify, S.L. (Spain); subprocessors must match the active DPA. | Core Elementor submission remains available; withdrawing Marketing blocks the Clientify mirror/tracker. | Provider policy | 2026-08-04 |
| Clientify webform - Yakisugi vs Thermo-D 3 | Clientify | Active | Third-party processor plus optional Marketing tracker | Mirror the submitted Elementor form into Clientify CRM with campaign context after Marketing cookie consent; the core Elementor submission remains independent | Marketing | Submitted form fields plus Clientify visitor identifiers/localStorage when Marketing cookies are allowed. | api.clientify.net | CRM lead retention follows the Zenwood Privacy Policy; tracker identifiers up to 2 years | Clientify, S.L. (Spain); subprocessors must match the active DPA. | Core Elementor submission remains available; withdrawing Marketing blocks the Clientify mirror/tracker. | Provider policy | 2026-08-04 |
| Clientify webform - Yakisugi vs Thermo-D 4 | Clientify | Active | Third-party processor plus optional Marketing tracker | Mirror the submitted Elementor form into Clientify CRM with campaign context after Marketing cookie consent; the core Elementor submission remains independent | Marketing | Submitted form fields plus Clientify visitor identifiers/localStorage when Marketing cookies are allowed. | api.clientify.net | CRM lead retention follows the Zenwood Privacy Policy; tracker identifiers up to 2 years | Clientify, S.L. (Spain); subprocessors must match the active DPA. | Core Elementor submission remains available; withdrawing Marketing blocks the Clientify mirror/tracker. | Provider policy | 2026-08-04 |
4. Third parties, transfers and browser controls
Third parties may use subprocessors. Processing outside the EEA requires an applicable adequacy decision or Article 46 GDPR safeguards. You can also block or delete cookies in your browser, although the cart, language or privacy choice may be lost. See the Privacy Policy for recipients and legal bases.
5. Contact and changes
Write to hola@zenwood.es. A material change of provider, purpose or storage requires the policy to be updated and a new choice to be requested where appropriate.