Cookie policy

The controller of the technologies used for Don Barrio's own purposes is F&P Digital Consulting SL, with the details and contact given in the privacy policy. This policy includes cookies, local storage and equivalent mechanisms that store or access information on the device. Where a store incorporates technologies decided by its merchant, that controller must be identified and its information provided.

Technologies that are strictly necessary to transmit a communication or to provide a function expressly requested may be exempt from consent. A technology is not considered exempt merely because it is our own, or is for measurement, security or a payment provider: its specific function and necessity are examined.

Non-exempt technologies, if used, will be activated only after valid consent, by purpose and without pre-ticked boxes. In that case the option to accept, reject or configure the choice will be offered, with rejection as easy to access as acceptance. Continuing to browse or closing a notice does not mean acceptance. Consent is not presumed between different stores or domains without sufficient information and legal basis.

This is the list of what Don Barrio stores on or reads from your device: cookies, local storage and session storage. For each technology we state who sets it, what it is for, what it contains, how long it lasts and what legal basis covers it.

Chosen language (donbarrio_locale). A first-party cookie of the Don Barrio website. It is stored only when you choose in the selector a language different from the current one; it is not stored when the page loads. It contains the code of the language you chose and is used to show you the pages in that language. It lasts 365 days. No third party is involved. Basis: a preference chosen by you, limited to that function.

Merchant session (authjs.session-token, authjs.csrf-token and authjs.callback-url). First-party cookies that are created when you log in to the merchant dashboard, not when you browse the informational pages. The first identifies your session and lasts at most 30 days or until you log out; the second protects forms against cross-site request forgery and the third remembers which page to return to after logging in: both last as long as the browser visit. On secure connections their names carry a security prefix. No third party is involved. Basis: necessary to provide the service you requested when logging in.

Dashboard preferences (donbarrio_merchant_locale, db_active_store and db_credits_seen). First-party cookies of the merchant dashboard. They remember the dashboard language, the store you have active and whether the credits presentation has already been shown. They last 365 days. No third party is involved. Basis: settings of the service you use, limited to that function.

Buyer account (tlp_customer_account and associated cookies). First-party cookies that are created when a buyer logs in to their account with a store (email verification, access link, activation). The session cookie identifies the account and lasts at most 30 days or until the buyer logs out; the associated ones store a warning message (2 minutes), the destination to return to (30 minutes) and the order that is linked when the account is created (30 minutes). Another one, tlp_fiscal_doc, gives temporary access to the documents of an order for 30 minutes. No third party is involved. Basis: necessary to provide the function that has been requested.

Access by link (tlp_kiosk_session, db_demo_…, db_demoback_… and donbarrio.claim). First-party cookies that are created only when an access link is opened: a store's kiosk (12 hours), a store demonstration (24 hours at most, and 30 minutes after leaving it) or the claim of a prepared store (until the link expires). They store an access identifier. No third party is involved. Basis: necessary to provide the access you requested.

Store basket (donbarrio.cart.v1…, local storage). Local storage of your browser, not a cookie. It remembers the products you have added to the basket (product identifiers, quantities, options chosen, channel and collection) while you shop at a store; it does not store your name, email, telephone number or address. It expires after 24 hours. No third party is involved. Basis: necessary for the function you requested.

Dashboard settings in the browser (local and session storage). Browser storage used only by the merchant dashboard, to remember settings (counter mode, browser notification preference) and the state of the screen (coordination between tabs, screens already seen). It is not used for any other purpose. No third party is involved. Basis: settings of the function you use, limited to it.

Collapsed campaign notice (db.campana.replegada). Local storage of your browser, not a cookie. It is written only if a campaign notice is shown on the informational pages and you collapse it: it remembers that you have collapsed it so that it is not expanded again. It contains only the campaign identifier and is replaced when the campaign changes. No third party is involved. Basis: a preference chosen by you, limited to that function.

Card payment (Stripe). On the payment screen of an order, the Stripe component (js.stripe.com), a payment service provider, is loaded. When it loads, Stripe stores in your browser the cookies __stripe_mid (365 days) and __stripe_sid (30 minutes), under Don Barrio's domain, and the cookie m, under the domain m.stripe.com (up to 400 days, the maximum the browser allows), and communicates with Stripe's servers (m.stripe.com and r.stripe.com). According to Stripe, they serve to detect and prevent fraud in the payment; Don Barrio neither reads them nor uses them for any other purpose. The durations were measured in a real browser on 22 October 2026, are set by Stripe and may change. The merchant panel's payment activation screens load Stripe components in which no storage of their own was observed on loading. Basis: these cookies are set by Stripe and are loaded only on the payment screen you asked to open. Stripe presents them as essential cookies to detect and prevent fraud in the payment, and Don Barrio keeps them enabled to protect that payment against fraudulent use of cards. We do not claim a general exemption: the AEPD's cookie guide accepts as technical those cookies that are limited to managing the payment and controlling fraud linked to the security of the service, with a limited duration and no other purpose, and other European authorities examine them case by case; that is why we describe exactly what is stored and for how long.

Error logging (Sentry). Don Barrio uses the Sentry error logging service (server in the European region, ingest.de.sentry.io). Sentry stores nothing in your browser (no cookies, no local or session storage) and Don Barrio does not record your browsing or the screens you see. On the informational pages, the public shops, the payment screen and the buyer account, your browser does not communicate with Sentry when the page loads: only if an error occurs on the page is a technical report of that error sent (what failed and on which page, without the contents of forms and without personal data by default; the service is configured not to infer your IP address). In the merchant panel and Don Barrio's internal consoles, in addition, the browser sends Sentry a technical signal that the application has started, with no identifier stored on your device, to measure the stability of each version. Basis: F&P's legitimate interest in detecting and fixing faults and in protecting the security of the service, with minimal information.

On the informational pages, fonts, images and videos are served from Don Barrio's own domain: they are not requested from third-party servers, except for the error logging described above.

At the date of this policy, Don Barrio does not enable any technology that it has classified as subject to consent. When we use one, you will be able to change or withdraw your choice with the same ease as was used to give it, through a permanent control that we will offer before enabling it. Withdrawal does not affect earlier lawfulness and stops later uses subject to consent. You can also manage storage from the browser, although blocking strictly necessary technologies may prevent the function you request. Browser settings do not replace the withdrawal mechanism that we must provide.

Changes of purposes or third parties that require new consent will not be activated before it is obtained. Rights, contacts and means of complaint are set out in the privacy policy.