Cookie Policy
Last updated: 11 August 2026
1. Controller and Scope
SAIVA MANAGEMENT, S.L. ("SAIVA"), tax ID B88091640, with registered office at Calle Bruselas, 3, 28232 Las Rozas de Madrid, Madrid, Spain, is the entity operating the official Carlos Sainz website and is responsible for the configuration of cookies and similar technologies used under its control on the platform.
This Policy applies to the corporate website, online store and the pages or functions integrated into it. Third-party websites, platforms or services to which users are redirected are governed by their own policies where the third party independently determines the technologies and purposes used.
General contact: admin@saivamanagement.com. Customer service and privacy matters: support@carlossainz.es.
2. What Cookies and Similar Technologies Are
Cookies are small files or identifiers that a website may store on or retrieve from a user's terminal device. For the purposes of this Policy, "cookies" also includes, where applicable, technologies with an equivalent or similar function, such as pixels, tags, identifiers, local storage, SDKs, web beacons or other techniques that store or retrieve information from a device or recognise interactions with the website.
These technologies may be necessary to provide functions requested by the user or may be used, with the relevant consent, to remember preferences, measure website use, analyse interaction with content, attribute advertising campaigns or perform tracking and commercial segmentation.
3. Legal Basis and Consent
Under Article 22.2 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), storage and access technologies that are not strictly necessary may only be used after users have received clear and complete information and given their consent.
Where cookies or similar technologies involve the processing of personal data and require consent, the processing will also rely on the user's consent under Regulation (EU) 2016/679 (GDPR). Refusing non-essential cookies will not prevent access to the website's essential functions.
Cookies that are strictly necessary to transmit a communication or provide an information-society service expressly requested by the user may be used without prior consent, without prejudice to the transparency and data-protection obligations that may apply.
4. Cookie Categories
The platform will use Cookiebot as its consent management platform (CMP). Technical classification will follow the Cookiebot categories and the actual purpose of each technology:
- Necessary: enable essential functions such as security, session management, cart, checkout, load balancing, fraud prevention, retention of cookie choices and delivery of services expressly requested by the user. They cannot be disabled through the panel where they are strictly necessary.
- Preferences: remember choices made by the user, such as language, currency or certain accessibility preferences. Where a preference is directly selected by the user and used solely to provide that function, it may be treated as technical; any additional use requires the appropriate legal basis.
- Statistics: measure and understand how the website is used, produce statistics, heatmaps or interaction analysis and improve site performance. They will only be activated after consent to this category.
- Marketing: measure campaigns, attribute conversions, create or enrich audiences, track behaviour or personalise commercial communications and advertising. They will only be activated after consent to this category.
5. Technologies Expected at Launch
Based on the architecture communicated for launch, the following technologies are expected to be used or integrated. The final classification of each specific cookie, pixel, identifier or technology will be confirmed through the final production-domain scan and review of the actual configuration:
Technology / provider Expected website use Expected category Activation Cookiebot Banner management, recording and retaining the user's choice and reopening the preference panel. Necessary From the first visit in order to manage consent. Shopify Cart, checkout, security, store operation and other e-commerce functions. Any optional analytics or marketing function must follow its relevant category. Necessary; others depending on configuration Necessary functions from the first visit; optional functions only after the relevant consent. Cloudflare Security, protection against malicious traffic, technical delivery and website availability, depending on the configuration used. Necessary From the first visit where strictly necessary. Vercel Hosting and technical delivery of the web application. Any additional technology detected will be classified according to its actual function. Necessary / technically to be confirmed Only strictly necessary technologies without consent. Google Analytics Audience measurement, navigation statistics, interaction and performance. Statistics Only after Statistics consent. Hotjar Behaviour analytics, heatmaps and, where enabled, session recordings, subject to the configured exclusions and masking. Statistics Only after Statistics consent. Meta Pixel Advertising measurement and attribution, conversions, audiences and campaign tracking. Marketing Only after Marketing consent. Klaviyo onsite tracking Website event and behaviour tracking for CRM, segmentation and commercial automations, where enabled. Marketing Only after Marketing consent. Vimeo Embedded video playback. If the player uses non-essential technologies, loading will be conditional on the relevant consent. To be confirmed based on configuration According to the final scan and configuration. EqualWeb Accessibility functions and preferences. Classification depends on whether it is limited to a technical preference chosen by the user or includes additional purposes. Necessary / Preferences, depending on configuration According to the actual purpose and scan results. SportMonks Race-data feed through an API. It is not expected, by itself, to place browser cookies where the integration is server-to-server. Not expected / to be confirmed To be verified through the final scan. Prismic Content management (CMS). It is not expected, by itself, to place tracking technologies on visitors. Not expected / to be confirmed To be verified through the final scan.
Other providers in the ecosystem, such as Gmail/Google for email management, Bigblue for logistics or shipping carriers, may take part in personal-data processing described in the Privacy Policy, but this does not automatically make them website cookie providers. They will only be included in the Cookie Declaration if the technical implementation or scan shows that they store or retrieve information from a visitor's terminal device.
6. Consent Management with Cookiebot
On the first visit, a Cookiebot banner will allow users to accept, reject or configure non-essential cookies. Accept and reject options must be presented with equivalent prominence and ease, without pre-ticked boxes or mechanisms that treat inactivity or continued browsing as consent.
Non-essential categories will remain disabled until the user accepts them. Users may later change or withdraw consent through the permanent "Cookie settings" control available on the website. Withdrawal will be as easy as giving consent and will not affect the lawfulness of processing carried out beforehand.
Where purposes, categories, providers or technologies change materially, or where consent needs to be refreshed, SAIVA may ask users to make a new choice.
7. Third-Party Cookies and International Transfers
Some non-essential technologies are provided by third parties such as Google, Meta, Hotjar or Klaviyo. Where users accept them, those providers may receive technical identifiers, device information, IP address, browsing events, pages viewed or other data associated with the consented purpose, depending on the configuration actually implemented.
The use of providers belonging to international groups may involve access to or processing of information from countries outside the European Economic Area. Where an international transfer of personal data takes place, SAIVA will apply or verify the appropriate transfer mechanism under Chapter V GDPR. Further information on providers and international transfers is available in the Privacy Policy.
8. Cookie Duration and Consent Records
The duration of each cookie or technology depends on its purpose and configuration. Session cookies may be deleted when the browsing session ends, while persistent cookies remain for a defined period. The specific duration will be shown in the Cookiebot declaration generated from the latest scan.
SAIVA will retain evidence of consent choices for as long as reasonably necessary to demonstrate compliance, without prejudice to the technical lifetime of individual cookies and the user's ability to change or withdraw their choice at any time.
9. Browser Settings and Other Options
In addition to the Cookiebot panel, users may configure their browser to allow, block or delete cookies. Disabling strictly necessary cookies through browser settings may affect the operation of the cart, checkout, security, preferences or other essential functions. The available options depend on the browser and device used.
Browser settings do not replace the website consent mechanism where consent is legally required.
10. Up-to-Date Cookie Declaration
The individual list of cookies and technologies used must always reflect the website's actual technical configuration. SAIVA will therefore use the dynamic Cookiebot declaration, populated by periodic scans of the domain, as the up-to-date technical inventory.
11. Updates to this Policy
SAIVA may update this Policy when technologies, providers, purposes, CMP configuration, regulatory guidance or applicable law change. The current version will be the one published on the website with its last-update date.
Where a change introduces new purposes not covered by the consent previously given, new consent will be requested before the affected technologies are activated.
12. Contact
General enquiries: admin@saivamanagement.com
Privacy and customer service: support@carlossainz.es
Postal address: SAIVA MANAGEMENT, S.L., Calle Bruselas, 3, 28232 Las Rozas de Madrid, Madrid, Spain.