Information on devices for storing and retrieving data — art. 20 of Law 20/2014 and Law 29/2021 (LQPD)

 

DRAFT v2.0 — FOR LEGAL REVIEW (SCOPE) This document was prepared on 24 August 2026 in accordance with the legal audit of the same date. References marked [● …] identify data or decisions still pending resolution by the company or by legal counsel, and must be resolved before publication. The cookie table in clause 6 is a forecast of the technology stack and must be replaced with the inventory resulting from the technical audit of the final site before publication.

 

1. Controller

The controller responsible for the use of cookies and the processing of personal data obtained through them on the website lunnecircle.com (the “Website“) is INVESTNOA WELLNESS, SLU (trademark LÜNNE), with registered office at Passatge Arnaldeta de Caboet, no. 11, 2nd floor, 1st door, Edifici La Torre, AD700 Escaldes-Engordany, Principality of Andorra, registered with the Commercial Companies Register under no. 26704, tax ID (NRT) L-721791-H, and email rgpd@lunnecircle.com, Phone: +376 646 111.

 

2. Regulatory framework

This Policy is issued in compliance with article 20 of Law 20/2014, of 16 October, regulating electronic contracting and operators carrying out economic activity in a digital space, which governs devices for storing and retrieving data on terminal equipment, and Law 29/2021, of 28 October, qualified law on personal data protection (“LQPD”), insofar as cookies allow the processing of personal data — such as IP addresses or online identifiers. The criteria published by the Andorran Data Protection Agency (APDA) have also been taken into account, in particular its guidance on the use of cookies, the privacy policy and the legal notice.

 

3. What are cookies and similar technologies?

Cookies are small files that websites install on the user’s browser or device to store and retrieve information: for example, to remember a logged-in session, save preferences, measure browsing activity or personalise advertising. For the purposes of this Policy, the term “cookies” also includes similar technologies, such as tracking pixels, tags, web beacons, device identifiers and browser local storage (localStorage and sessionStorage).

Cookies may be first-party (installed from the lunnecircle.com domain and managed by the Company) or third-party (installed or read by providers other than the Company); session cookies (deleted when the browser is closed) or persistent cookies (remain for the defined period for each one); and, depending on their purpose, technical or necessary, preference, analytical or marketing cookies.

 

4. Consent: how it works on this Website

In accordance with article 20 of Law 20/2014:

1. a)  On the first visit, the Website displays a consent management platform (settings banner) that clearly and fully informs users of the purposes of the cookies used.
2. b)  No cookie requiring consent is installed before the user has expressed their choice through a conscious, positive action. Mere browsing, inaction or closing the banner does not amount to consent.
3. c)  The user may accept all, reject all, or configure by category, with the same ease and the same number of steps to accept as to reject.
4. d)  Cookies with an exclusively technical or security purpose, or those strictly necessary to provide the service requested, are exempt from consent (art. 20.4) and are the only ones installed by default.
5. e)  Consent may be revoked or modified at any time, easily, simply and free of charge (art. 20.5), via the permanent “Cookie Settings” link available in the Website’s footer. Revocation takes immediate effect regarding new installations and readings.
6. f)  The user’s choice is retained for a maximum of [● to be defined: 12 months recommended], after which it will be requested again.

 

5. Categories of cookies used

1. a)  Technical or strictly necessary (exempt from consent): enable browsing, load balancing, security, management of consent itself and, where applicable, the booking and payment process. Without them, the Website cannot function.
2. b)  Preferences: remember choices made by the user, such as language. Require consent when not strictly necessary.
3. c)  Analytics (require consent): measure audience and use of the Website in aggregate form, detect issues and improve the user experience.
4. d)  Marketing and advertising (require consent): measure the effectiveness of campaigns and display content or advertisements relevant to the user’s interests on third-party platforms.

The Website does not use categories other than those declared in this Policy. Should new cookies or purposes be added in the future, the Policy will be updated and, where applicable, consent will be requested again.

 

6. Cookies used on this Website

[● Provisional table based on the anticipated technology stack (GA4, Meta Pixel, booking engine and payment gateway). Replace with the actual inventory resulting from the technical audit of the final site, with exact names, owners and periods, before publication.]

 

Cookie	Owner / type	Purpose	Duration	Category
Consent cookie (CMP)	First-party — technical	Record the user’s cookie choices	12 months	Necessary
Session / booking cookies	First-party — technical	Maintain the session and the booking and payment process	Session	Necessary
_ga, _ga_*	Google Analytics 4 (Google LLC) — third party	Distinguish users and sessions and produce aggregated usage statistics	Up to 13 months [● confirm configuration]	Analytics
_fbp and Meta pixel	Meta Platforms — third party	Measure conversions and provide advertising audiences on Meta platforms	3 months [● confirm]	Marketing
[● Booking engine cookies]	[● Provider] — third party	Availability and booking management	[● —]	Necessary / per audit
[● Payment gateway cookies]	[● Provider] — third party	Secure payment processing and fraud prevention	[● —]	Necessary

 

 

7. Third-party cookies and international transfers

Analytical and marketing cookies are served by third parties that may process the data obtained — including IP addresses and online identifiers — on servers located outside the Principality of Andorra, in particular in the United States (Google LLC; Meta Platforms, Inc.). Such transfers are covered by the safeguards provided for in articles 44 and 45 of the LQPD (adequacy decisions or appropriate contractual safeguards, as applicable). Users may consult these providers’ privacy policies for further information about their processing:

• Google: policies.google.com/privacy and, specifically regarding cookies, policies.google.com/technologies/cookies
• Meta: facebook.com/privacy/policy and facebook.com/policies/cookies

 

8. Personal data and rights

Insofar as cookies allow personal data to be processed, such processing is governed by the Website’s Privacy Policy, which sets out the controller, purposes, legal bases, retention periods, recipients and how to exercise the rights of access, rectification, erasure, restriction, portability and objection (rgpd@lunnecircle.com), as well as the right to lodge a complaint with the Andorran Data Protection Agency (APDA).

 

9. Managing cookies from the browser

In addition to the “Cookie Settings” panel on the Website — which is the preferred means — users may allow, block or delete installed cookies through their browser settings:

• Google Chrome: Settings → Privacy and security → Third-party cookies / Site data.
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Safari (macOS/iOS): Settings → Safari → Privacy / Preferences → Privacy.
• Microsoft Edge: Settings → Cookies and site permissions.

Blocking technical cookies may affect the operation of certain Website functionalities, including the booking process.

 

10. Updates to this Policy

The Company may amend this Cookie Policy in response to legislative or regulatory requirements, APDA criteria, or changes in the cookies actually used. Where significant changes occur — in particular, the addition of new purposes subject to consent — users will be informed via the Website and consent will be requested again where applicable. The current version, with its update date, will at all times be the one published at lunnecircle.com.

Cookie Policy · Version 2.0 · Last updated: 24 August 2026 (draft subject to legal review)