Cookie Policy
Website www.vexia.com
Version for publication · 15/06/2026
Loading…
Version for publication after technical validation of the Cookiebot CMP.
| Element | Information |
|---|---|
| Data controller | VEXIA, LDA. (and other companies of the Vexia group, depending on the jurisdiction) |
| Tax ID (NIPC) | 516723286 |
| Registered office | Alameda das Antas, 30, 4350-413 Porto |
| Privacy contact / DPO | dpo@vexia.com |
| Version date | 15/06/2026 |
| Domain covered | https://www.vexia.com/ and subdomains/landing pages controlled by Vexia, where expressly indicated |
Purpose and scope
This Cookie Policy explains how VEXIA, LDA. ("Vexia") uses cookies and similar technologies on the website www.vexia.com, including local storage technologies, pixels, tags, SDKs, online identifiers, measurement tools, analytics, advertising and consent management.
This policy should be read together with the Privacy Policy and the Terms and Conditions of Use of the website. Where cookies or similar technologies involve the processing of personal data, the General Data Protection Regulation (GDPR), Law no. 58/2019 of 8 August, and Law no. 41/2004 of 18 August, as currently in force, also apply.
The policy applies to Vexia's institutional website and, where applicable, to campaign pages, landing pages, forms, restricted areas or dashboards made available under Vexia's control. It does not apply to third-party websites to which the user is redirected through external links, including social networks, advertising platforms, websites of clients, partners, operators or suppliers.
Methodological note and basis of preparation
This version was prepared on the basis of:
- the public scan of the website www.vexia.com, which evidences an activity as a tech & media agency, digital campaigns, GA4, AdTech, DSPs, first-party data, custom data processing, custom modelling, dashboards and iGaming audiences;
- the compliance test carried out in Cookiebot, which assesses trackers by categories such as necessary, preferences, statistics, marketing and unclassified, as well as prior consent requirements and international transfers;
- the applicable legal framework in Portugal and in the European Union, including the GDPR, Law no. 41/2004, CNPD guidance and EDPB guidance on consent.
What are cookies and similar technologies?
Cookies are small text files or identifiers that may be stored on the user's device when visiting a website. These files make it possible to recognise the device, maintain sessions, store preferences, measure usage, improve the browsing experience, carry out analytics, display personalised advertising or measure the effectiveness of campaigns.
For the purposes of this policy, the term "cookies" also includes similar technologies, such as pixels, tags, web beacons, local storage, session storage, advertising identifiers, analytics scripts, conversion tags, conversion APIs, SDKs and other tracking or measurement technologies.
Who is responsible for the cookies?
Vexia is responsible for the cookies and similar technologies that it defines, uses or allows to be used on the website www.vexia.com, even though some are provided by third-party suppliers. The CNPD has emphasised that the organisation that owns the website is responsible for ensuring information to the user and obtaining consent where legally required. The website is the common point of presence of the Vexia group; depending on the jurisdiction and the operation, the group entity responsible for the processing associated with cookies may vary, with the GDPR applying in the European Union, the LGPD in Brazil and the data protection regime of Malta, as the case may be.
Whenever third parties use cookies or similar technologies on Vexia's website, those third parties may process personal data as processors, independent controllers or joint controllers, depending on the purposes and means of the processing. Vexia must validate and document this framework on a case-by-case basis, in particular where analytics tools, advertising platforms, social networks, DSPs, pixels or conversion APIs are involved.
Applicable legal framework
Under article 5 of Law no. 41/2004, the use of electronic communications networks to store information or to access information stored on the user's terminal equipment is only permitted where clear and complete information is provided, in particular about the purposes of the processing, and the user is given the right to refuse such processing, except where the storage or access is strictly necessary to carry out the transmission of a communication or to provide a service expressly requested by the user.
Where cookies and similar technologies involve personal data, the processing must comply with the GDPR, including the principles of lawfulness, fairness, transparency, minimisation, storage limitation, security and accountability. Consent, where applicable, must be freely given, specific, informed, unambiguous and demonstrable.
Vexia must ensure that cookies that are not strictly necessary, including analytics, advertising, retargeting, conversion measurement, social network and profiling cookies, are only activated after the user has given valid consent through the consent management platform.
What types of cookies do we use?
| Category | Purpose | Legal basis | Management |
|---|---|---|---|
| Necessary or technical | Enable the operation of the website, security, session management, load balancing, fraud prevention, consent management and access to requested features. | Legitimate interest and/or technical necessity; consent not required when strictly necessary. | Cannot be disabled through the banner, but may be blocked in the browser, which may affect the operation of the site. |
| Preferences | Store user choices, such as language, region, display settings or other preferences. | Consent, except where strictly necessary for a requested feature. | May be accepted, rejected or withdrawn. |
| Statistics / analytics | Enable measurement of audience, traffic source, pages visited, performance, interactions, events and improvement of the website. | Consent. | Must be blocked before consent. |
| Marketing / advertising | Enable the display, measurement or optimisation of advertising, the creation of audiences, the measurement of conversions, frequency capping, retargeting or integration with platforms such as Google Ads, Search Ads 360, Meta, YouTube, X, LinkedIn, TikTok, Reddit, DSPs (in particular Adform and Astrad), ad servers (in particular Campaign Manager 360 and EPOM) or conversion APIs. | Consent. | Must be blocked before consent and subject to easy opt-out. |
| Unclassified | Cookies or technologies detected but not yet classified as to purpose, supplier or duration. | Must not be activated until classification and validation. | Must be blocked until classification, especially if not technically essential. |
Cookies and technologies expected in Vexia's context
Given Vexia's public activity, technologies associated with the following may exist or come to exist:
- technical management of the website, hosting, security, CDN, bot prevention and performance;
- scheduling of meetings and forms, in particular through HubSpot or an equivalent tool, as well as email marketing and CRM management, in particular Brevo and Salesforce;
- analytics, audience measurement and ad serving, including Google Analytics 4 (GA4), Campaign Manager 360 (CM360), EPOM or similar tools;
- advertising and conversion measurement platforms, such as Google Ads, Search Ads 360, Meta, YouTube, X, LinkedIn, TikTok, Reddit, DSPs (in particular Adform and Astrad) or conversion APIs;
- digital campaigns, iGaming audiences, first-party data, custom audiences, lookalike audiences, modelling, dashboards and reporting;
- workflow and message automation, in particular Zapier and ManyChat (WhatsApp, Instagram and Messenger), and provision of sports data, in particular StatScore;
- integration with publishers and third-party campaign environments, in particular websites and apps of partner publishers, in the context of campaigns run on behalf of clients;
- integrations with social networks, external links, videos, widgets, sharing buttons or embedded content.
The actual activation of these technologies must depend on the technical configuration of the website and on the user's consent, where applicable. Vexia must maintain an up-to-date inventory of the technologies used and their respective suppliers.
Although most of these platforms record the user's IP address, that information is, as a rule, not provided to Vexia. Identifiers such as GCLID, DCLID, Click ID or FBCLID are tokens generated randomly to distinguish individual users on the platforms; when integrated into Vexia's systems for measurement and segmentation purposes, they function as pseudonymised identifiers, with browsing remaining not directly identifiable until the user consents to the sharing of personal data through forms or direct contacts.
Cookie declaration - updated technical list
The technical list of cookies, pixels, tags and similar technologies used on the website must be presented in an updated, clear and granular manner, indicating at least the name, supplier, category, purpose, data processed, duration and countries of transfer.
It is recommended that this section be fed automatically by the Cookiebot CMP declaration, after full configuration and scanning of the www.vexia.com domain.
| Field | Information to be presented |
|---|---|
| Cookie / technology name | Supplier | Category | Purpose | Duration | Country / transfer |
| [to be filled in automatically by Cookiebot] | [*] | [necessary / preferences / statistics / marketing / unclassified] | [*] | [*] | [*] |
The cookie declaration list is filled in automatically by Cookiebot.
Retention periods for cookies and consent records
| Category / record | Retention period |
|---|---|
| Cookie consent preferences | 6 months, unless there is a material change to the policy, the cookie configuration or the list of suppliers, in which case new consent must be requested. |
| Proof of consent or refusal | 24 months after the last recorded choice, for the purpose of demonstrating compliance. |
| Necessary session cookies | Only for the duration of the session or for the period strictly necessary for technical operation. |
| Persistent necessary cookies | Recommended maximum of 12 months, unless there is a justified and documented technical need. |
| Preference cookies | 6 months, unless a shorter period is configured by the supplier. |
| Statistics / analytics cookies | Recommended maximum of 14 months for analytical data associated with identifiers; aggregated or anonymised data may be retained for a longer period where it does not allow re-identification. |
| Marketing cookies, pixels and identifiers | 6 months, unless a shorter period is set by the supplier or consent is withdrawn earlier. |
| Conversion, attribution and campaign data | 12 months after the end of the campaign, unless aggregated/anonymised or where there is a documented need to defend rights. |
| Aggregated/pseudonymised reporting data | 24 months after the end of the campaign, where necessary for performance history and commercial auditing. |
| Unclassified cookies or technologies | Must be blocked until classification. Classification must be completed within a maximum internal period of 30 days after detection. |
| Backups with consent records or technical logs | Replacement or deletion within a maximum period of 90 days, except for documented exceptional retention. |
How do we collect and manage consent?
When the user accesses the website, a banner or consent management platform must be presented that allows cookies to be accepted, refused or configured by category, before the activation of cookies that are not strictly necessary.
The consent mechanism must meet the following requirements:
- present clear, simple and complete information about the cookie categories and purposes;
- provide an accept button and a refuse button with an equivalent level of visibility;
- allow granular configuration by category;
- not use pre-ticked boxes, consent by silence, inactivity, scrolling or mere continuation of browsing;
- block non-essential cookies before consent;
- store proof of consent, including date, time, banner version, policy version, accepted/refused categories and technical consent identifier;
- allow withdrawal of consent at any time through a permanent link in the footer, such as "Cookie settings" or "Manage cookies".
Recommended text for the cookie banner
First-layer text
We use cookies and similar technologies to ensure the operation of the website, measure audience, improve the browsing experience and, with your consent, carry out analytics, advertising, campaign measurement and integrations with third-party platforms. You can accept all cookies, refuse non-necessary cookies or configure your preferences. For more information, see our Cookie Policy and Privacy Policy.
Recommended buttons, with equivalent prominence:
- Accept all
- Reject non-necessary
- Configure preferences
On the second layer, each category must have its own explanation, an activation/deactivation button and access to the list of suppliers and cookies.
Third-party cookies and social networks
The website may contain links to social networks or third-party websites, including platforms such as LinkedIn, Instagram, Facebook, X, YouTube, TikTok, Reddit or others. When the user accesses these links, they begin browsing external environments, subject to the privacy policies, cookie policies and terms of use of those third parties.
If the website integrates social plugins, widgets, embedded videos, sharing buttons, pixels, conversion tags or social login, those technologies must be included in the list of cookies and may only be activated before consent where they are strictly necessary to provide a service expressly requested by the user. Otherwise, they must depend on prior consent.
Cookies, digital advertising and iGaming
Vexia operates in a context of media, performance marketing, AdTech and iGaming. In this context, cookies, pixels, conversion APIs and online identifiers may be used for campaign measurement, performance analysis, attribution, frequency capping, audience creation, retargeting, custom audiences, lookalike audiences, modelling, campaign optimisation and reporting.
These technologies may involve increased risk to data subjects, in particular because they allow behavioural tracking, profiling, segmentation and personalised advertising. For this reason, reinforced measures of transparency, minimisation, consent, prior blocking, supplier review, assessment of international transfers and exclusion of minors and vulnerable audiences must be applied.
Vexia must not use cookies, pixels or similar technologies to direct advertising for gambling, betting, casino, poker or iGaming to minors. Whenever iGaming campaigns depend on segmentation, audiences, conversion measurement or third-party tags, there must be prior compliance validation, including requirements regarding age, jurisdiction, responsible gambling, responsible advertising and the legality of the operator or brand advertised.
International data transfers
Some suppliers of cookies, analytics, advertising, social networks, cloud, CRM or measurement platforms may process data outside the European Economic Area. In these cases, Vexia must ensure that there is a valid transfer mechanism under the GDPR, such as an adequacy decision, participation in the EU-US Data Privacy Framework where applicable, standard contractual clauses and supplementary measures where necessary.
The list of suppliers in the cookie declaration must indicate, wherever possible, the countries to which data may be transferred and the applicable safeguards.
How can you change or withdraw consent?
The user may change or withdraw their consent at any time through the "Cookie settings" or "Manage cookies" option, which must be permanently available in the footer of the website.
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent previously given. After withdrawal, Vexia must cease the use of non-essential cookies and similar technologies corresponding to the withdrawn categories, without prejudice to necessary cookies and minimum records of proof of consent/refusal.
Cookie management in the browser
The user may also configure their browser to block, delete or limit cookies. The configuration varies depending on the browser used. Blocking necessary cookies may affect the operation of the website or prevent access to certain features.
Management through the browser does not replace the need for Vexia to obtain prior consent for non-essential cookies, nor does it dispense with the existence of an appropriate consent management platform on the website.
Updates to the Cookie Policy
Vexia may update this Cookie Policy whenever it changes the cookies, technologies, suppliers, purposes, retention periods, consent settings or applicable legal requirements.
Where the changes are material, Vexia must request new consent from the user for the affected categories.
Contacts
For questions related to this Cookie Policy, consent management or the processing of personal data, you may contact:
- VEXIA, LDA.
- Privacy / DPO email: dpo@vexia.com
- Address: Alameda das Antas, 30, 4350-413 Porto
Technical checklist before publication
- Configure the Cookiebot CMP on the www.vexia.com domain and subdomains/landing pages under Vexia's control.
- Enable prior blocking of non-essential cookies.
- Ensure "Accept", "Reject" and "Configure" buttons with equivalent prominence.
- Enable a permanent "Manage cookies" link in the footer.
- Run a new Cookiebot scan after publication of the CMP.
- Classify all unclassified cookies within a maximum period of 30 days.
- Confirm suppliers: HubSpot, Brevo, Salesforce, GA4, Campaign Manager 360, EPOM, Google Ads, Search Ads 360, Meta, YouTube, X, LinkedIn, TikTok, Reddit, DSPs (Adform, Astrad), Zapier, ManyChat, StatScore, Cloudflare, Vercel or others actually active.
- Confirm periods configured in Cookiebot, GA4, CRM and email (HubSpot, Brevo, Salesforce), advertising platforms and backups.
- Validate international transfers and supplier safeguards.
- Keep evidence of the cookie test before and after implementation.
Legal references and guidance considered
- Regulation (EU) 2016/679 of 27 April 2016 - General Data Protection Regulation.
- Law no. 41/2004 of 18 August, as currently in force - privacy in electronic communications, in particular article 5.
- Law no. 58/2019 of 8 August - national implementation of the GDPR.
- CNPD information note on the use of cookies, of 25 June 2021.
- EDPB Guidelines 05/2020 on consent under the GDPR.
- Cookiebot compliance report/test indicated by Vexia for the www.vexia.com domain.
Short wording for the footer
Recommended footer
Cookies: we use necessary cookies for the operation of the website and, with your consent, preference, statistics and marketing cookies. You can manage your preferences at any time in "Manage cookies". See the Cookie Policy and the Privacy Policy.
Clause for forms that use tracking
Form / Book a Meeting
By submitting the form, Vexia will process the data provided to manage the request and respond to the contact. The use of cookies, analytics, pixels or other non-essential technologies associated with the form depends on your consent through the cookie management tool. See the Privacy Policy and the Cookie Policy.
English texts for the website (EN)
Since the website www.vexia.com is in English, the EN versions of the texts visible to the user are presented below. This Policy should ideally also be made available in an English version.
Cookie banner - first layer (EN)
We use cookies and similar technologies to operate the website, measure audience and, with your consent, carry out analytics, advertising, campaign measurement and integrations with third-party platforms. You can accept all cookies, reject non-necessary cookies or configure your preferences. Learn more in our Cookie Policy and Privacy Policy.
Buttons (equal visual prominence): Accept all / Reject non-necessary / Manage preferences.
Footer (EN)
We use necessary cookies to run the website and, with your consent, preference, statistics and marketing cookies. Manage your choices anytime via Manage cookies. See our Cookie Policy and Privacy Policy.
Cookie categories (EN)
Necessary (always active); Preferences (off by default); Statistics / analytics (off by default); Marketing / advertising (off by default). Non-necessary cookies are blocked until valid consent is given.