September 2026
R2 Sistemas Informáticos, S.L. (“R2 Sistemas”) explains in this privacy and cookies policy (the “Policy”) what personal data it processes as controller, for what purposes, for how long, with whom it shares that data and what rights are available to the individuals it relates to. It covers the website https://www.r2docuo.com (the “R2 Docuo Website”), its subdomains, the Web Portal, the other Access Means to the R2 Docuo service (the “Service”) and the communications that R2 Sistemas maintains with those who enquire about the Service or contract it. It replaces the version of February 2020.
This Policy governs the processing of personal data for which R2 Sistemas is the controller: the data of those who visit the R2 Docuo Website, of those who request information about or contract the Service, of the individuals who use the Service with an account, of those who receive communications from R2 Sistemas and of those who contact it through any channel. It fulfils the duty to inform under Articles 13 and 14 of the GDPR and Article 11 of Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (“LOPDGDD”), and the duty under Article 22.2 of Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (“LSSI”) as regards cookies.
This Policy does not govern the following processing, which is governed by its own documents:
– The personal data that the User uploads to or generates in its Repositories, including that of Licensed Users, Collaborators and the recipients of the R2 Docuo Trusted Electronic Services. The User is the controller of that data and R2 Sistemas is the processor, in accordance with Clause 13 of the Conditions. This includes the records of MCP Server invocations and the Repository audit trail, in accordance with Clause 5.1. The third parties that process that data on behalf of R2 Sistemas appear in the list of sub-processors published at https://www.r2docuo.com/en/subprocessors.
– The data processed by the MCP Client and the AI Provider that the User chooses in order to access the Service through the MCP Server, and by the model provider with which the User holds its own account. They are independent third parties whose privacy policies the User itself accepts, in accordance with Clauses 16.2.f) and 21.h) of the Conditions.
– The data processed as independent controllers by the third parties to which this Policy expressly refers, such as the Payment Platform or the social networks on which R2 Sistemas has a presence.
Capitalised terms that are not defined in this Policy have the meaning given to them in Clause 1.4 of the Conditions. In addition, in this Policy:
– “Data Subject”: the natural person to whom the personal data relates, whether a Visitor, a representative or employee of the User, a Licensed User or any other person.
– “Visitor”: the person who accesses the R2 Docuo Website or its subdomains without logging in to the Service.
– “Cookies”: the files that a website places on the Data Subject’s device in order to store and retrieve information, and the equivalent technologies referred to in Clause 12, such as pixels, identifiers in the URL and the browser’s local storage.
– “Cookie Panel”: the consent management tool of the R2 Docuo Website described in Clause 12.5.
This Policy supplements the Conditions, published at https://www.r2docuo.com/en/terms-and-conditions, to which Clause 1.1 of those Conditions refers. In the event of any contradiction concerning the processing of personal data for which R2 Sistemas is the controller, this Policy prevails; as regards the processing agreement, Clause 13 of the Conditions prevails.
R2 Sistemas may amend this Policy in order to adapt it to regulatory, technical or organisational changes. It will publish the version in force on the R2 Docuo Website, with the date of its last update at the beginning of the document and, where the change substantially affects Users, it will notify them at the email address registered for the Account one (1) month in advance. Amendments do not apply retroactively to processing based on consent without obtaining that consent again.
The controller of the processing described in this Policy is R2 Sistemas Informáticos, S.L., a Spanish company with registered office at Paseo de la Castellana 77, 28046 Madrid, registered with the Commercial Registry of Madrid at volume 15,594, folio 35, sheet M-262513, with tax identification number B-82711078.
R2 Sistemas has appointed a Data Protection Officer and has notified that appointment to the Spanish Data Protection Agency (Agencia Española de Protección de Datos), in accordance with Article 37 of the GDPR and Article 34.3 of the LOPDGDD.
The Data Subject may contact the Data Protection Officer on any matter relating to the processing of their personal data and to this Policy, and in order to exercise the rights in Clause 10, at the email address dpd@r2docuo.com. The User may also use a Support Ticket. Postal communications should be addressed to the registered office indicated in Clause 2.1, for the attention of the Data Protection Officer.
R2 Sistemas processes the data that the Data Subject provides when completing a form on the R2 Docuo Website, creating an Account, contracting the Service, opening a Support Ticket, using the Website chat, subscribing to the notices of the Service status page or communicating with R2 Sistemas by email or telephone. Depending on the case, that data comprises: name and surname; company and job title; email address and telephone number; the company’s tax identification and billing details; language; access credentials; and the content of the request or conversation itself.
R2 Sistemas does not collect or store payment card details. They are processed directly by the Payment Platform, in accordance with Clause 7.2.
Browsing the R2 Docuo Website or using the Service generates technical data: IP address, browser and operating system type and version, device and session identifiers, pages visited, date and time of access, referring page and parameters of the entry URL, and information collected by means of Cookies in accordance with Clause 12. Use of the Service also generates Account activity records: log-ins, operations carried out and their date, the Access Means used and the consumption of limits and Credits. The metadata of the MCP Server and of the AI Features are described in Clauses 5 and 6.
Where the User creates Licensed Users or Collaborators, R2 Sistemas processes as controller the contact data needed to create and administer those accounts, to send them Service communications and to handle their support. The User warrants that it has informed them of the content of this Policy and that it is entitled to provide their data. Any other third-party data that the User uploads to its Repositories is processed on the User’s behalf in accordance with Clause 1.2.
The data marked as mandatory on each form is necessary in order to attend to the request or to provide the Service; if it is not provided, R2 Sistemas will not be able to attend to the request. The Data Subject is responsible for ensuring that the data it provides is accurate and up to date, and will notify any changes through the Account or through a Support Ticket.
R2 Sistemas does not request or process as controller special categories of data under Article 9 of the GDPR, nor data relating to children under fourteen (14) years of age. The Service is aimed at businesses and professionals, in accordance with Clause 2 of the Conditions. R2 Sistemas does not determine the Data Subject’s geographic location from their IP address for tax or invoicing purposes: the data determining the applicable tax is provided by the User itself, in accordance with Clause 9.6 of the Conditions.
R2 Sistemas processes personal data for the purposes, on the legal bases and for the retention periods set out below. References to articles are to the GDPR.
| Processing and purpose | Data | Legal basis | Retention period |
| Operation and security of the R2 Docuo Website: serving the pages, protecting the site against attacks and automated traffic, and diagnosing errors. | Technical data under Clause 3.2 and server access logs. | Legitimate interest of R2 Sistemas in keeping its website available and secure (Art. 6.1.f). | Twelve (12) months from the access. |
| Handling requests for information, demonstrations, quotations and content downloads: responding, arranging the demonstration and following up the request commercially. | Identification, company and job title, contact details, content of the request, source of the visit. | Pre-contractual steps taken at the Data Subject’s request (Art. 6.1.b) and, for those acting on behalf of a company, the legitimate interest of R2 Sistemas in attending to the request (Art. 6.1.f). | For as long as the commercial relationship lasts and, failing that, twenty-four (24) months from the Data Subject’s last interaction. |
| Website chat: maintaining the conversation and recalling it if the Visitor returns. | Visitor identifier, data provided by the Visitor and content of the conversation. | Consent, given by accepting the functional cookies and by starting the conversation (Art. 6.1.a). | That of information requests, if the conversation gives rise to one; otherwise, six (6) months. |
| Commercial communications: informing about news, content, events and offers from R2 Sistemas relating to the Service, in accordance with Clause 11. | Identification, company, email address, sending history and interaction with those communications. | Consent (Art. 6.1.a), or legitimate interest where there is a prior contractual relationship (Art. 6.1.f and Art. 21.2 of the LSSI). | Until the Data Subject withdraws consent or objects. Thereafter, their contact details are kept blocked on a suppression list in order to respect that decision. |
| Creation and administration of the Account and provision of the Service: registering the Account, authenticating the Data Subject, managing the Licence and its Parameters, providing the Service through the Access Means and sending the communications necessary for that purpose. | Identification, contact details, credentials, language, Licence data, Account activity records and consumption of limits and Credits. | Performance of the contract (Art. 6.1.b). | The term of the Account and of the Licences. Thereafter, blocked for the limitation periods applicable to actions arising from the contract, up to five (5) years (Art. 1964 of the Spanish Civil Code). |
| Contracting, invoicing and collection: issuing invoices, collecting the Fee and the Credits through the Payment Platform, managing non-payment and validating intra-Community operator status. | Identification and tax details of the User, billing details, payment history and invoices. Card details are processed by the Payment Platform. | Performance of the contract (Art. 6.1.b) and compliance with the commercial, accounting and tax obligations of R2 Sistemas, including those arising from the Verifactu system (Art. 6.1.c). | Six (6) years from the last accounting entry (Art. 30 of the Spanish Commercial Code), without prejudice to the tax limitation period (Art. 66 of the Spanish General Tax Act). |
| Support: handling Support Tickets and incidents, and maintaining the history of each Account. | Identification, contact details, content of the ticket and of any attachments provided by the Data Subject, technical logs. | Performance of the contract (Art. 6.1.b). | The term of the Account and three (3) years after its cancellation. |
| Use of the MCP Server: applying the included usage limits and settling the Credits consumed, in accordance with Clause 5.2. The record of each invocation is not processing for which R2 Sistemas is the controller: it forms part of the Repository, in accordance with Clause 5.1. | Aggregate consumption of usage limits and of Credits attributable to each Licence. | Performance of the contract (Art. 6.1.b). | That provided for in this same table for contracting, invoicing and collection. |
| Management of the use of the AI Features: described in Clause 6. | Usage metadata under Clause 6.3. | Performance of the contract (Art. 6.1.b). | That provided for in this same table for contracting, invoicing and collection. |
| Service status page (https://status.r2docuo.com): notifying subscribers by email of incidents and maintenance. | Email address. | Consent (Art. 6.1.a). | Until the subscription is cancelled. |
| Measurement and improvement of the Website and advertising: analysing use of the Website, measuring the effectiveness of campaigns and displaying advertisements relating to the Service on third-party platforms. | Data collected by means of the analytics and advertising Cookies under Clause 12. | Consent, given through the Cookie Panel (Art. 6.1.a and Art. 22.2 of the LSSI). | That of each Cookie, in accordance with Clause 12.4. |
| Compliance with legal obligations and handling of requests from authorities: responding to the authorities and exercising or defending rights in claims. | The data necessary in each case. | Compliance with a legal obligation (Art. 6.1.c) and legitimate interest in the defence of R2 Sistemas (Art. 6.1.f). | The statutory limitation periods applicable to each obligation. |
Where R2 Sistemas relies on its legitimate interest, it has assessed beforehand that this interest does not override the Data Subject’s rights, that the processing is what the Data Subject may reasonably expect in that context and that the Data Subject may object to it at any time in accordance with Clause 10. The Data Subject may request information about that assessment through the contact in Clause 2.2.
On the expiry of each period, R2 Sistemas deletes or anonymises the data. During the limitation periods the data remains blocked in accordance with Article 32 of the LOPDGDD: it is available only to the authorities and for the formulation, exercise or defence of claims. Backups are overwritten in accordance with the retention cycles of R2 Sistemas, selective deletion not being technically possible; until then they remain subject to the security measures in Clause 9.
Where a Licensed User authorises an MCP Client to access a Repository through the MCP Server, each invocation of a Tool is recorded. That record is stored in the User’s own database and forms part of its Repository. It may contain personal data, because the parameters of an invocation may reproduce information from the Repository, such as the name of a person used in a search.
Consequently it is not processing for which R2 Sistemas is the controller and it is not governed by this Policy. R2 Sistemas processes it as the User’s processor, for the purpose of providing support on the use of the MCP Server and of applying usage limits and Credits. What the record captures, what it does not capture, how long it is kept, on what terms R2 Sistemas personnel access it and with what safeguards are described in Clauses 13 and 16.2.g) of the Conditions. The User must take it into account in its own record of processing activities when it enables the MCP Server.
Of the activity of the MCP Server, R2 Sistemas processes as controller only the aggregate consumption of usage limits and of Credits attributable to each Licence, for the purpose of applying those limits and of invoicing, and the security logs of the infrastructure on which the Service is provided, on the legal basis and for the period provided for in Clause 4.1 for contracting and invoicing.
The content that the MCP Server returns in response to an invocation leaves the Service and comes to be processed in the infrastructure of the MCP Client and of the AI Provider that the User freely chooses and contracts. R2 Sistemas does not control that processing, does not choose those third parties and is neither controller nor processor in respect of it: it is governed by the terms and the privacy policy that the User has accepted with them, in accordance with Clauses 13.6 and 16.2.f) of the Conditions.
Where a Licensed User uses the R2AI Assistant or the Repository executes an AI Instruction, R2 Sistemas transmits to the provider of the language model that executes the operation the content and metadata of the document or documents needed to attend to it, the query or the configured instruction and the context essential to interpret it, to the extent the User has configured in accordance with Clause 21.i) of the Conditions.
The content of the Repositories is processed by R2 Sistemas as the User’s processor, and the model providers act as sub-processors of R2 Sistemas where the operation is executed using the R2 Sistemas account, in accordance with Clauses 13.6 and 21.h) of the Conditions. It is for the User, as controller, to determine the legal basis for that processing in respect of the Data Subjects whose data appears in its documents, and to decide in which Repositories and document categories it enables the AI Features. The providers that R2 Sistemas engages, their contracting entities and the country in which they process the data appear in the list of sub-processors published at https://www.r2docuo.com/en/subprocessors.
Each operation generates a record with the date and time, the Licensed User and the Repository, the AI Feature and the model used, the number of tokens processed and the Credits consumed, and the outcome of the operation. Of that record, R2 Sistemas processes as controller the aggregate consumption attributable to each Licence, in order to apply the usage limits and to invoice the artificial intelligence operation packages under Clause 8.7 of the Conditions, on the legal basis and for the period provided for in Clause 4.1 for contracting and invoicing. It does not retain outside the Repository either the transmitted content or the model’s response: the response is stored in the Repository field that the User has configured and is governed by Clause 13 of the Conditions.
The terms that R2 Sistemas has contracted with each model provider, including the prohibition on using the transmitted content to train or fine-tune their models and the periods for which they may retain it, appear in the list of sub-processors. Nor does R2 Sistemas use that content to train its own models, in accordance with Clause 13.3 of the Conditions.
R2 Sistemas does not take, in respect of any Data Subject, decisions based solely on automated processing which produce legal effects or similarly significantly affect them, within the meaning of Article 22 of the GDPR. The AI Features and the MCP Server produce results that the User must review with human intervention before using them, in accordance with Clauses 16.2.d) and 21.f) of the Conditions. If the User configures the Service in order to take decisions of that nature about natural persons, it does so as controller and assumes the obligations under Article 22 of the GDPR and, where applicable, under the AI Act.
Where the User configures an AI Feature to use the account that it itself holds with a model provider, the content is transmitted directly to that provider under the terms agreed between them. R2 Sistemas is not a party to that relationship and processes only the usage metadata under Clause 6.3.
R2 Sistemas engages providers that process personal data on its behalf and under a contract in accordance with Article 28 of the GDPR, without their being able to use it for their own purposes. They are the following:
| Provider | Service | Location of processing and safeguard |
| StackScale, S.L. | Hosting of the Service infrastructure, including the records under Clause 5 and Account data. | Spain. No international transfer. |
| Altair Networks, S.L. | Hosting of a second backup copy of the Repositories and of the Account data, in a different physical location. It is stored encrypted and R2 Sistemas does not provide it with the encryption key. | Spain. No international transfer. |
| WPEngine, Inc. | Hosting of the R2 Docuo Website. | United Kingdom, a country covered by an adequacy decision of the European Commission. For access from the United States, standard contractual clauses approved by the European Commission together with their UK Addendum. |
| Cloudflare, Inc. | Content delivery network, security and protection against automated traffic for the R2 Docuo Website. | European Union and United States; certified under the EU-US Data Privacy Framework and standard contractual clauses. |
| HubSpot, Inc. and HubSpot Ireland Ltd. | Management of contact requests, Website chat, commercial communications and customer relationship management (CRM). | European Union and United States; certified under the EU-US Data Privacy Framework and standard contractual clauses. |
| Google Ireland Ltd. | Google Tag Manager, Google Analytics, Google Ads, reCAPTCHA and embedding of YouTube videos on the R2 Docuo Website. | European Union and United States; Google LLC is certified under the EU-US Data Privacy Framework and applies standard contractual clauses. |
| CookieYes Ltd. | Cookie Panel and record of the consents given. | United Kingdom, a country covered by an adequacy decision of the European Commission. |
| Better Stack, Inc. | Service status page and sending of notices to its subscribers. | United States, with the standard contractual clauses approved by the European Commission in accordance with Clause 8. |
| Model providers for the AI Features | Execution of the AI Features, as sub-processors in accordance with Clause 6.2. | Those appearing from time to time in the list of sub-processors published at https://www.r2docuo.com/en/subprocessors. |
R2 Sistemas also uses email, office and internal communication tools from providers established in the European Union or certified under the EU-US Data Privacy Framework, which process the personal data appearing in those communications as processors of R2 Sistemas.
R2 Sistemas discloses personal data to the following third parties, which process it under their own responsibility and their own privacy policies:
– Stripe, which operates the Payment Platform in accordance with Clause 9.2 of the Conditions: it receives the User’s identification and billing details and the payment card details, which R2 Sistemas never sees. Stripe Payments Europe, Ltd. (Ireland) provides the service in the European Union; Stripe, Inc. is certified under the EU-US Data Privacy Framework.
– Advertising platforms and social networks: Google Ads, LinkedIn and OpenAI receive, where the Data Subject accepts the advertising Cookies, the information described in Clause 12.4 in order to measure conversions and display R2 Docuo advertisements. Google Ads additionally receives, on the same condition, the email address and telephone number provided in the demonstration request form, in the form of an irreversible cryptographic hash, for conversion measurement. These platforms act as independent controllers or as joint controllers in respect of that processing.
– The Spanish Tax Agency (Agencia Estatal de Administración Tributaria): it receives the invoicing records required by the Verifactu system in respect of the invoices issued by R2 Sistemas, and the tax information that the applicable rules require to be reported.
– Financial institutions, for the management of collections and refunds.
– Public authorities and the courts, where there is a legal obligation or a valid request.
– External advisers (legal, tax, accounting and auditors), subject to a duty of confidentiality, to the extent necessary for their function.
R2 Sistemas does not sell or rent personal data, does not disclose it to third parties for their own commercial purposes outside the cases in Clause 7.2, and does not profile Data Subjects other than by segmenting commercial communications according to the interest shown in the Service.
R2 Sistemas processes the personal data for which it is the controller within the European Economic Area. The servers on which the Service is provided are located in Spain. Some of the providers referred to in Clauses 7.1 and 7.2 are established in the United States or may process data from outside the European Economic Area. In those cases R2 Sistemas relies on one of the instruments in Chapter V of the GDPR: an adequacy decision of the European Commission, including the EU-US Data Privacy Framework in respect of the entities certified under it, or the standard contractual clauses approved by the European Commission, supplemented by any additional measures resulting from the assessment of each transfer. The Data Subject may request a copy of the applicable safeguards through the contact in Clause 2.2. Transfers involving the MCP Client and the AI Provider chosen by the User are for the User to assess, in accordance with Clause 13.7 of the Conditions.
R2 Sistemas applies the technical and organisational measures required by Article 32 of the GDPR, having regard to the state of the art, the nature of the data and the risks of the processing. The security certifications it holds are set out in Clause 13.4 of the Conditions.
If a breach of the security of the personal data for which R2 Sistemas is the controller occurs and entails a risk to the rights of Data Subjects, R2 Sistemas will notify it to the Spanish Data Protection Agency within the period provided for in Article 33 of the GDPR and, where the risk is high, will communicate it to the affected Data Subjects in accordance with Article 34 of the GDPR. Breaches affecting data processed on the User’s behalf are notified to the User in accordance with Clause 13.8 of the Conditions.
The Data Subject has the right to:
– access their personal data and obtain a copy of it;
– rectify inaccurate or incomplete data;
– erase their data where, among other grounds, it is no longer necessary for the purposes for which it was collected;
– object to processing based on legitimate interest, in which case R2 Sistemas will cease to process it unless there are compelling legitimate grounds or it is needed for the exercise or defence of claims, and to object in all cases to commercial communications;
– restrict processing in the cases provided for in Article 18 of the GDPR, in which case R2 Sistemas will keep the data only for the exercise or defence of claims;
– receive their data in a structured, commonly used and machine-readable format, and transmit it to another controller, where the processing is based on consent or on the contract and is carried out by automated means;
– withdraw consent at any time, without this affecting the lawfulness of the previous processing; and
– not be subject to decisions based solely on automated processing, on the terms of Clause 6.5.
The Data Subject may exercise their rights through any of the channels in Clause 2.2, stating their name and surname, the right being exercised and, where necessary to verify their identity, the information or documentation enabling this to be done. If the request does not allow the Data Subject to be identified or the request to be specified, R2 Sistemas will ask them to complete it. Licensed Users may also consult and amend their Account data directly from the Service. A Data Subject whose data appears in a User’s Repository must address the User, which is its controller; if they address R2 Sistemas, it will forward the request to the User and inform them accordingly, in accordance with Clause 13.9 of the Conditions.
R2 Sistemas will respond within one (1) month of receipt of the request, extendable by a further two (2) months where the complexity of the request or the number of requests justifies it, informing the Data Subject of the extension and of the reasons for it. The exercise of these rights is free of charge, save for manifestly unfounded or excessive requests.
If the Data Subject considers that the processing of their data infringes the applicable rules, they may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), with address at calle Jorge Juan 6, 28001 Madrid, through its electronic office at https://www.aepd.es. Beforehand, they may contact the Data Protection Officer, in accordance with Article 38.4 of the GDPR, in order to try to resolve the matter directly.
R2 Sistemas sends commercial communications about the Service and about its own similar products and services to those who have consented to them and, in accordance with Article 21.2 of the LSSI, to Users with which it has or has had a contractual relationship. Each communication identifies R2 Sistemas as the sender and contains a simple and free means of unsubscribing.
The Data Subject may unsubscribe at any time by following the link at the foot of each email or through the contact in Clause 2.2. Unsubscribing does not affect the communications necessary for the provision of the Service, such as maintenance, security, invoicing or Conditions amendment notices, which R2 Sistemas will continue to send to Users for as long as the relationship lasts.
Cookies are files that the R2 Docuo Website or a third party places in the Data Subject’s browser in order to store and retrieve information about their browsing. This Clause applies equally to equivalent technologies: pixels and beacons, identifiers embedded in URLs, the browser’s local storage and third-party development kits, even where they do not place a cookie file.
This Clause describes the Cookies of the R2 Docuo Website (https://www.r2docuo.com) and of its Help Centre (https://help.r2docuo.com) and Service status (https://status.r2docuo.com) subdomains, according to the latest Cookie Panel scan, carried out on 1 September 2026 across 871 pages. The Web Portal (https://portal.r2docuo.com and https://app.r2docuo.com) and the other Service applications use technical session and authentication cookies, essential in order to maintain the Licensed User’s session, which do not require consent. Cookies set for the r2docuo.com domain, including the analytics and advertising Cookies in this Clause, are also sent on those subdomains where the Data Subject has consented to them on the R2 Docuo Website.
R2 Sistemas classifies Cookies into the categories shown by the Cookie Panel:
– Necessary: essential for the site to work, to be secure and to remember the consent given. They do not require consent (Art. 22.2 of the LSSI).
– Functional: they enable functions that the Data Subject requests, such as the chat. They require consent.
– Analytics: they measure use of the site and the source of visits in order to improve it. They require consent.
– Advertising: they make it possible to measure the conversions of R2 Docuo campaigns and to display R2 Docuo advertisements on third-party platforms. They require consent.
| Cookie | Category | Owner | Purpose | Duration |
| cookieyes-consent | Necessary | CookieYes (first party) | To store the Data Subject’s consent preferences so as not to ask for them again. | 1 year |
| r2lang | Necessary | R2 Sistemas | To remember the language chosen by the Data Subject. | 2 months |
| __cf_bm | Necessary | Cloudflare | To tell human traffic from automated traffic and protect the site against abuse. | 1 hour |
| rc::a, rc::c | Necessary | Google (reCAPTCHA) | To tell legitimate form submissions from automated ones. | Persistent / session |
| wp-wpml_current_language, wpEmojiSettingsSupports | Necessary | R2 Sistemas (help.r2docuo.com) | To remember the Help Centre language and the browser’s emoji support. | Session |
| bs_dmn_chk_*, _session | Necessary | Better Stack (status.r2docuo.com) | To check that the Service status page is responding and to maintain the visit while it is being browsed. | Less than a minute / 2 months |
| messagesUtk | Functional | HubSpot | To recognise the Data Subject using the site chat in order to maintain the thread of the conversation. | 6 months |
| _ga, _ga_* | Analytics | Google Analytics | To distinguish visitors and count visits and page views. | 13 months |
| __hstc, hubspotutk | Analytics | HubSpot | To identify the visitor between sessions and attribute the source of their contact requests. | 6 months |
| __hssc, __hssrc | Analytics | HubSpot | To delimit the visitor’s browsing sessions. | 1 hour / session |
| src | Analytics | R2 Sistemas | To remember the link source through which the site was reached, in order to attribute contact requests sent afterwards. | 2 months |
| _bs | Analytics | Better Stack (status.r2docuo.com) | To recognise returning visitors to the Service status page and measure its use. | 13 months |
| _gcl_au | Advertising | Google Ads | To link visits coming from Google advertisements with any conversions occurring on the site. | 3 months |
| bcookie, lidc, li_gc | Advertising | To identify the browser, select the data centre and store LinkedIn consent, in order to measure R2 Docuo campaigns on LinkedIn. | 1 year / 1 day / 6 months | |
| test_cookie | Advertising | Google (DoubleClick) | To check whether the browser accepts advertising cookies. | 15 minutes |
| OpenAI pixel (local storage and identifier in the URL, no cookie of its own) | Advertising | OpenAI | To measure the conversions of R2 Docuo campaigns on ChatGPT. | Persistent in the browser’s local storage until the Data Subject deletes it |
This list is updated in the Cookie Panel each time the site is scanned; in the event of any discrepancy between this table and the Cookie Panel, the latter prevails and may be consulted at any time from the cookie icon on the R2 Docuo Website.
On the first visit, the R2 Docuo Website displays the Cookie Panel, which allows all Cookies to be accepted or the settings to be opened. In the settings, the Data Subject may accept or reject each category separately and save their preferences. Until the Data Subject decides, only necessary Cookies are installed; Google tags operate in consent mode and, while there is no consent, they do not install cookies or send identifiers of the Data Subject. Consent is stored for one (1) year in the “cookieyes-consent” cookie and in the consent log of the Cookie Panel provider, as evidence that it was given.
The Data Subject may change or withdraw their consent at any time from the cookie icon that appears in the bottom corner of the R2 Docuo Website, without this affecting the lawfulness of the previous processing. Withdrawing consent prevents new Cookies of that category from being installed; those already installed may be deleted from the browser in accordance with Clause 12.6.
The Data Subject may also block or delete Cookies from their browser settings. The developers’ instructions change with each version; those in force when this Policy is published are:
– Google Chrome: https://support.google.com/chrome/answer/95647?hl=en
– Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
– Apple Safari (macOS): https://support.apple.com/guide/safari/sfri11471/mac
– Apple Safari (iOS): https://support.apple.com/en-us/HT201265
– Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
– Opera: https://help.opera.com/en/latest/web-preferences/#cookies
Blocking necessary Cookies may prevent parts of the R2 Docuo Website or of the Web Portal from working.
