Cookie Policy

1.1 Cookies — A cookie is a small text file that a website places on your device — computer, smartphone, or tablet — when you visit it. Cookies are widely used to make websites function efficiently, to remember your preferences, and to provide information to the website operator and, where you have consented, to third-party platforms.

Cookies cannot run programmes or deliver viruses to your device. They are uniquely assigned to you and can only be read by the web server that issued them, or by other servers that the website operator has authorised.

1.2 Similar Technologies — In addition to cookies, Arenas may use other technologies that function in a similar way. These include:

Pixel tags (also called web beacons, tracking pixels, or simply pixels): small, transparent image files or snippets of code embedded in web pages that fire a signal to a third-party platform server when a page is loaded or an action is taken. Advertising platforms such as Meta, TikTok, and Pinterest use pixels to track conversions, build audiences, and enable retargeting. Arenas uses such pixels where you have given your consent to advertising cookies.

Local storage and session storage: browser-based storage mechanisms that allow a website to store data locally on your device. Unlike cookies, this data is not automatically sent to the server with every request.

Session identifiers: unique codes generated server-side and associated with your browsing session to maintain continuity across page loads.

For the purposes of this Cookie Policy, references to ‘cookies’ encompass all of the above technologies unless the context indicates otherwise.

1.3 First-Party and Third-Party Cookies — First-party cookies are set directly by arenasresortwear.eu and can only be read by Arenas. Third-party cookies are set by a domain other than arenasresortwear.eu — typically by a service provider that Arenas has integrated into the website, such as an analytics platform, a payment provider, or an advertising platform.

Third-party cookies, including advertising pixels, are governed by the privacy policies of the respective third parties. Where Arenas uses third-party cookies, this is disclosed in full in Section 4 of this Cookie Policy. Advertising cookies and pixels are placed only where you have expressly consented to their use.

1.4 Session Cookies and Persistent Cookies — Session cookies are temporary and exist only for the duration of your visit. They are deleted automatically when you close your browser. They are used, for example, to maintain the continuity of your browsing session and your shopping basket.

Persistent cookies remain on your device for a defined period after you close your browser, or until you delete them manually. They are used, for example, to remember your language preference, consent choices, or — where you have consented — to enable retargeting by advertising platforms on other websites and apps after your visit.

2.1 Overview — Arenas uses cookies for four distinct purposes: to ensure that arenasresortwear.eu functions correctly and securely; to remember your preferences; to understand how visitors use the website and the AI configuration tool; and — where you have consented — to enable paid social advertising and retargeting via third-party platforms including Meta (Instagram and Facebook), TikTok, and Pinterest.

Each category of cookie is described in detail below. Non-essential cookies — including all advertising and analytical cookies — are placed only with your prior, freely given consent.

2.2 Strictly Necessary Cookies — Strictly necessary cookies are essential for the operation of arenasresortwear.eu. Without them, core functions — such as navigating the website, using the AI configuration tool, maintaining your shopping basket, and completing checkout — would not work. These cookies do not require your consent under the ePrivacy Directive (implemented in Spain under Article 22.2 of Ley 34/2002, de Servicios de la Sociedad de la Información y de Comercio Electrónico, “LSSI”).

Functions enabled by strictly necessary cookies include: Maintaining your shopping basket and saving your configuration choices across pages during a session. Authentication: keeping you securely logged in to your account during your visit. Session management: assigning a session identifier to maintain continuity of your browsing session. Security: detecting and preventing fraudulent activity, cross-site request forgery (CSRF), and other security threats. Load balancing: distributing traffic across servers to ensure stable website performance. Checkout continuity: retaining order details through the payment flow so that your transaction can be completed.

2.3 Functional Cookies — Functional cookies enable the website to remember choices you have made in order to provide a more personalised browsing experience. They are not strictly necessary but enhance usability. These cookies require your consent.

Functions enabled by functional cookies include: Remembering your language and currency preference on return visits. Recalling your previously saved configuration choices if you return to the configuration tool without completing an order. Storing your cookie consent preferences so that you are not asked again on every visit.

2.4 Analytical Cookies — Analytical cookies help Arenas understand how visitors use arenasresortwear.eu by collecting information about pages visited, time spent on pages, links clicked, and traffic sources. This data is used exclusively to improve the website experience and the performance of the AI configuration tool. Arenas applies IP anonymisation so that your full IP address is never stored or transmitted to the analytics provider. These cookies require your consent.

Arenas uses [ ] as its analytics provider. Data is processed under a data processing agreement. [Data is stored within the EEA / transferred to [country] under Standard Contractual Clauses — complete as applicable.] Analytical data is not shared with advertising networks or used for any purpose other than improving arenasresortwear.eu.

2.5 Advertising and Retargeting Cookies — Where you have given your consent, Arenas places advertising cookies and pixels from third-party platforms on arenasresortwear.eu. These technologies serve the following purposes:

Conversion tracking: measuring whether a visit to arenasresortwear.eu that originated from a paid advertisement resulted in a specific action, such as a product page view, the start of a configuration session, or a completed purchase. This enables Arenas to assess the effectiveness of its advertising spend.

Retargeting: enabling advertising platforms to show Arenas advertisements to you on other websites, apps, and social media platforms after you have visited arenasresortwear.eu — for example, to remind you of a product you configured but did not order. Retargeting is based on your prior visit and requires your consent.

Custom and lookalike audiences: where you have consented, data about your visit (such as pages viewed or actions taken) may be used by advertising platforms to identify other users with similar characteristics (‘lookalike audiences’), enabling Arenas to reach new potential customers. This processing is carried out by the advertising platform on the basis of your consent and its own terms of service.

Arenas currently uses the following advertising platforms and pixels, each subject to your consent: Meta Pixel (Instagram and Facebook): for conversion tracking, retargeting, and custom/lookalike audience building on Meta's platforms. TikTok Pixel: for conversion tracking and retargeting on TikTok. Pinterest Tag: for conversion tracking and retargeting on Pinterest.

Each of these platforms acts as an independent data controller for the data it collects via its pixel. Arenas acts as data controller for the event data it configures and sends to the platform. The relationship between Arenas and Meta is governed by Meta's Controller-to-Controller terms. Arenas' use of these platforms is subject to each platform's own privacy policy, which is referenced in Section 7.

2.6 Configuration Experience Cookies — Arenas uses a small number of cookies that are specific to the AI configuration tool:

Session continuity (strictly necessary): cookies that maintain the continuity of your configuration session, ensuring that your design choices are not lost as you navigate between steps. These are session cookies that expire when you close your browser.

Beyond-session persistence (functional, consent required): where you are not logged in, a persistent cookie may be used to recall your last configuration on a return visit within [ ] days, solely for your convenience.

Specific to the Arenas AI configuration model: configuration session data is not shared with advertising platforms in individually identifiable form. Where advertising pixels fire on configuration tool pages (e.g. to track that a visitor reached the configuration step), this is a page-level event signal only — the specific design choices you make (silhouette, print, colour) are not transmitted to advertising platforms.

3.1 Strictly Necessary Cookies — No Consent Required — The placement of strictly necessary cookies does not require your consent under Article 22.2 of Ley 34/2002 (LSSI), which implements Article 5(3) of the ePrivacy Directive (2002/58/EC). These cookies are essential for the transmission of a communication over an electronic communications network, or are strictly necessary to provide a service explicitly requested by you.

Arenas places strictly necessary cookies as soon as you visit arenasresortwear.eu, before any consent banner is displayed.

3.2 All Other Cookies — Consent Required — All cookies that are not strictly necessary — including functional, analytical, advertising, and retargeting cookies — are placed only with your prior, freely given, specific, informed, and unambiguous consent, in accordance with Article 6(1)(a) GDPR and Article 22.2 of Ley 34/2002 (LSSI).

Consent is obtained through the cookie consent banner displayed on your first visit to arenasresortwear.eu. The banner presents a clear choice between accepting all cookies, selecting specific categories, or declining all non-essential cookies. Each category — functional, analytical, and advertising — can be accepted or declined independently.

3.3 Consent Standards — Your consent meets the following standards in accordance with the GDPR and the guidelines of the European Data Protection Board (EDPB):

Freely given: accepting non-essential cookies — including advertising cookies — is not a condition of accessing arenasresortwear.eu or using the AI configuration tool. You can browse the website and use the configuration tool with only strictly necessary cookies active.

Specific: you may accept or decline each category of cookies independently. Accepting advertising cookies does not imply acceptance of analytical cookies, and vice versa.

Informed: this Cookie Policy, together with the consent banner, provides you with the information necessary to make an informed choice about each category, including the identity of the third-party advertising platforms involved.

Unambiguous: consent is indicated by a clear affirmative action (clicking ‘Accept’ or selecting specific categories and confirming). Pre-ticked boxes are not used. Scrolling or continuing to browse does not constitute consent.

Withdrawable: you may withdraw your consent at any time with the same ease with which it was given. See Section 5 for details.

3.4 Advertising Cookies and the Controller Relationship — Where advertising pixels are active on arenasresortwear.eu, Arenas and the relevant advertising platform (Meta, TikTok, Pinterest) are joint controllers or independent controllers for different parts of the data processing, depending on the platform and the processing activity. Arenas configures which events are tracked and which data is shared; the platform determines how that data is used within its own systems for audience building and ad serving.

Each advertising platform's use of the data it receives via its pixel is governed by its own privacy policy and terms of service, to which you are also subject as a user of that platform. Arenas encourages you to review those policies, referenced in Section 7.

3.5 Consent Records — Arenas records your consent choice — the date, time, version of the Cookie Policy at the time of consent, and the categories accepted or declined — in order to demonstrate compliance with GDPR. This record is stored as a first-party cookie or linked to your account where you are logged in. Consent records are retained for three (3) years.

4.1 How to Read This Register — The cookie register below lists all cookies and pixels currently active on arenasresortwear.eu, grouped by category. Arenas reviews and updates this register at least every six (6) months, or promptly when a new cookie or pixel is introduced or removed. The version date of this Cookie Policy reflects the most recent review.

4.2 Strictly Necessary Cookies

_session_id — Provider: Arenas (first-party) · Purpose: Maintains your browsing session; retains shopping basket and configuration choices across pages · Duration: Session · Consent required: No

_csrf_token — Provider: Arenas (first-party) · Purpose: Protects against cross-site request forgery during form submissions and checkout · Duration: Session · Consent required: No

_secure_session — Provider: Arenas (first-party) · Purpose: Authenticates your logged-in account session securely · Duration: Session / [ ] days if ‘remember me’ is selected · Consent required: No

[platform session cookie — e.g. _shopify_s] — Provider: [ ] (e-commerce platform) · Purpose: Session management for the e-commerce platform · Duration: Session · Consent required: No

[payment provider cookie — e.g. __stripe_mid] — Provider: [ ] (payment provider) · Purpose: Fraud prevention and secure payment session management · Duration: 1 year · Consent required: No

cookie_consent — Provider: Arenas (first-party) · Purpose: Records your cookie consent choice, the categories accepted, and the version of the Cookie Policy at the time of consent · Duration: 12 months · Consent required: No — required to store your preference

4.3 Functional Cookies

_arenas_lang — Provider: Arenas (first-party) · Purpose: Remembers your preferred language on return visits · Duration: 12 months · Consent required: Yes

_arenas_currency — Provider: Arenas (first-party) · Purpose: Remembers your preferred currency on return visits · Duration: 12 months · Consent required: Yes

_arenas_config_draft — Provider: Arenas (first-party) · Purpose: Recalls your last unsaved configuration on a return visit within [ ] days (non-logged-in visitors only) · Duration: [ ] days · Consent required: Yes

4.4 Analytical Cookies

[e.g. _ga] — Provider: [ ] (analytics provider) · Purpose: Distinguishes unique visitors; generates aggregated statistics on website usage. IP anonymisation applied. · Duration: 2 years · Consent required: Yes

[e.g. _ga_XXXXXXXX] — Provider: [ ] (analytics provider) · Purpose: Persists session state for the analytics platform · Duration: 2 years · Consent required: Yes

[e.g. _gid] — Provider: [ ] (analytics provider) · Purpose: Distinguishes users across sessions for daily visit statistics · Duration: 24 hours · Consent required: Yes

4.5 Advertising and Retargeting Cookies and Pixels

The following advertising pixels and associated cookies are placed only where you have given your consent to advertising cookies. Each pixel fires an event signal to the relevant platform when you take a specific action on arenasresortwear.eu (e.g. visiting a product page, starting a configuration, or completing a purchase). The platforms use this data for conversion tracking, retargeting, and audience building as described in Section 2.5.

META PIXEL (Instagram / Facebook)

_fbp — Provider: Meta Platforms Ireland Ltd. (third-party) · Purpose: Identifies browsers for conversion tracking and retargeting across Meta's platforms (Instagram, Facebook) · Duration: 90 days · Consent required: Yes

_fbc — Provider: Meta Platforms Ireland Ltd. (third-party) · Purpose: Stores the last click attribution for Meta ads; used for conversion attribution · Duration: 90 days · Consent required: Yes

fr — Provider: Meta Platforms Ireland Ltd. (third-party) · Purpose: Used by Meta to deliver, measure, and improve the relevance of ads on and off Meta's platforms · Duration: 90 days · Consent required: Yes

TIKTOK PIXEL

_ttp — Provider: TikTok Technology Limited (third-party) · Purpose: Identifies browsers for TikTok conversion tracking and retargeting; enables measurement of ad performance on TikTok · Duration: 13 months · Consent required: Yes

tt_pixel_session_index — Provider: TikTok Technology Limited (third-party) · Purpose: Session-level event tracking for the TikTok Pixel · Duration: Session · Consent required: Yes

PINTEREST TAG

_pinterest_ct_ua — Provider: Pinterest Europe Ltd. (third-party) · Purpose: Identifies browsers for Pinterest conversion tracking, retargeting, and audience building · Duration: 1 year · Consent required: Yes

_pin_unauth — Provider: Pinterest Europe Ltd. (third-party) · Purpose: Tracks non-logged-in Pinterest users for conversion measurement · Duration: 12 months · Consent required: Yes

The advertising platforms listed above act as independent or joint data controllers for the data they receive via their pixels. Their use of that data is governed by their own privacy policies and terms of service. Arenas configures pixel events to share only the minimum data necessary for conversion tracking and audience building (typically: anonymised or hashed identifiers, page URL, event type, and — with your consent — hashed contact data for custom audience matching). The specific design choices you make in the AI configuration tool (silhouette, print, colour) are not shared with advertising platforms.

4.6 Configuration Experience Cookies

_arenas_config_session — Provider: Arenas (first-party) · Purpose: Maintains continuity of your AI configuration session across steps within a single visit · Duration: Session · Consent required: No — strictly necessary for tool function

_arenas_config_return — Provider: Arenas (first-party) · Purpose: Recalls your last incomplete configuration on return within [ ] days (non-logged-in only) · Duration: [ ] days · Consent required: Yes — functional

5.1 Via the Arenas Cookie Preference Centre — You may change your cookie preferences at any time by clicking the ‘Cookie settings’ link in the footer of arenasresortwear.eu. The cookie preference centre allows you to:

View all cookie categories and the individual cookies and pixels within each category.

Accept or decline each category of non-essential cookies independently.

Withdraw consent previously given for any or all categories, including advertising cookies.

Withdrawing consent does not affect the lawfulness of processing based on consent before the withdrawal. Upon withdrawal, non-essential cookies for which consent has been withdrawn will be deleted from your device, advertising pixels will cease to fire, and no new cookies in those categories will be placed during your current and future sessions on arenasresortwear.eu.

Please note that withdrawing your consent to advertising cookies on arenasresortwear.eu does not automatically remove you from retargeting audiences that have already been built on the advertising platforms. To opt out of audience-based retargeting, you must also use the opt-out tools provided by each platform, as described in Section 5.3.

5.2 Via Your Browser Settings — All major browsers allow you to control cookies through the browser settings. You can typically: block all cookies; block only third-party cookies; delete existing cookies; or manage cookies on a site-by-site basis.

Note that blocking strictly necessary cookies will impair the functioning of arenasresortwear.eu, including the AI configuration tool, shopping basket, and checkout. Arenas cannot be held responsible for reduced functionality resulting from the blocking of strictly necessary cookies.

Instructions for managing cookies in the most commonly used browsers: Google Chrome: chrome://settings/cookies. Mozilla Firefox: about:preferences#privacy. Apple Safari: Preferences → Privacy → Manage Website Data. Microsoft Edge: edge://settings/privacy. Opera: opera://settings/privacy.

5.3 Platform-Level Opt-Out Tools for Advertising — Withdrawing consent on arenasresortwear.eu stops advertising pixels from firing on our website. However, if you have already been added to a retargeting or custom audience on an advertising platform, you may continue to see Arenas advertisements until you opt out at the platform level. The following opt-out tools are available:

Meta (Facebook and Instagram): you can manage your ad preferences and opt out of interest-based advertising in your Facebook and Instagram account settings under ‘Ads’, or via the AdChoices opt-out at youronlinechoices.eu.

TikTok: you can manage your ad personalisation settings in the TikTok app under Settings → Privacy → Ads Personalisation, or opt out via the TikTok privacy policy at tiktok.com/legal/privacy-policy.

Pinterest: you can manage your personalised ad settings in your Pinterest account under Settings → Privacy and Data, or opt out at help.pinterest.com/en/article/personalization-and-data.

Industry-wide opt-out tools are also available at youronlinechoices.eu (EU) and optout.networkadvertising.org (US), which allow you to opt out of interest-based advertising from multiple participating networks simultaneously.

5.4 Opt-Out for Analytical Cookies — Where Arenas uses a third-party analytics provider, you may additionally opt out of analytics tracking using the provider's own opt-out mechanism: Google Analytics opt-out browser add-on (if applicable): tools.google.com/dlpage/gaoptout. [ ] opt-out page: [insert URL if applicable].

5.5 Do Not Track (DNT) — Some browsers include a ‘Do Not Track’ (DNT) signal. There is currently no legally binding standard for how websites must respond to DNT signals in the EU context. Arenas' cookie consent mechanism, described in this Policy, provides an equivalent and legally compliant means of managing your preferences and supersedes the DNT signal for visitors to arenasresortwear.eu.

6.1 Why the Configuration Tool Uses Cookies — The AI configuration tool requires certain strictly necessary cookies to function. These maintain the continuity of your design session — ensuring that the silhouette, print, colour, and other characteristics you have selected are not lost as you progress through the configuration steps or navigate away briefly.

6.2 Advertising Pixels and the Configuration Tool — Where you have consented to advertising cookies, advertising pixels (Meta, TikTok, Pinterest) may fire page-level event signals on configuration tool pages. Specifically:

A ‘ViewContent’ or equivalent event may fire when you visit a product or silhouette page, signalling to the advertising platform that you viewed a product.

An ‘InitiateCheckout’ or equivalent event may fire when you proceed from the configuration tool to checkout.

A ‘Purchase’ or equivalent event may fire when your order is confirmed.

These are standard e-commerce conversion events. Importantly, the specific design choices you make within the configuration tool — the silhouette, fabric print, colour scheme, and uniqueness code — are not transmitted to advertising platforms. Only standard event type signals and, where applicable, anonymised or hashed identifiers are shared.

Specific to the Arenas AI configuration model: Arenas has configured its advertising pixels to apply data minimisation. Custom event parameters that would reveal individual configuration choices are excluded from pixel payloads. This is consistent with Arenas' commitment to handling customer data with discretion, and with the premium, privacy-conscious profile of its target audience.

6.3 Configuration Data vs. Cookie Data — Cookie data used in the configuration tool consists of temporary session identifiers held in your browser. These do not contain your personal details or your design choices in readable form, and are deleted when you close your browser.

Configuration data — the substantive design choices linked to your order — is stored in Arenas' order management system and subject to the data retention rules in the Privacy Policy. It is not held in a cookie and is not accessible to advertising platforms.

6.4 Incomplete Configuration Sessions — Where you begin a configuration session but do not complete an order, Arenas may retain a pseudonymised record (session identifier only, no name or email) for [ ] days to improve the configuration experience. Where advertising pixels are active, a retargeting audience signal may be generated by the platform based on your visit — this is a standard website visit signal, not a record of your specific design choices.

7.1 Overview — The third-party service providers whose cookies and pixels are active on arenasresortwear.eu process data either as data processors on behalf of Arenas (under a data processing agreement) or as independent/joint data controllers (in the case of advertising platforms). Arenas selects providers that comply with GDPR and, where relevant, with the EU-U.S. Data Privacy Framework or applicable Standard Contractual Clauses.

7.2 Provider Reference Table

E-commerce platform: [ ] — privacy policy: [ ]

Payment provider: [ ] — privacy policy: [ ]

Analytics provider: [ ] — privacy policy: [ ]

Email service provider: [ ] — privacy policy: [ ]

Shipping carrier: [ ] — privacy policy: [ ]

Meta (Instagram / Facebook): Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland — privacy policy: facebook.com/privacy/policy

TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland — privacy policy: tiktok.com/legal/privacy-policy

Pinterest: Pinterest Europe Ltd., 2nd Floor, Palmerston House, Fenian St, Dublin 2, Ireland — privacy policy: policy.pinterest.com/privacy-policy

7.3 International Transfers via Advertising Platforms — Meta, TikTok, and Pinterest are global platforms. Data collected via their pixels on arenasresortwear.eu may be transferred to and processed on servers outside the European Economic Area, including in the United States. These transfers are governed by Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. For details of the transfer mechanisms applied by each platform, please refer to their respective privacy policies.

Arenas has no control over the onward transfers of data by advertising platforms once that data has been received by the platform. By consenting to advertising cookies, you acknowledge that your data may be processed by these platforms in accordance with their own privacy policies, including outside the EEA.

7.4 Hashed Data and Custom Audiences — Where Arenas uses custom audience features on advertising platforms (for example, to upload a hashed customer email list for matching purposes), this processing is carried out on the basis of your consent and in compliance with applicable data protection law.

8.1 Transfers Outside the EEA — Some third-party providers process cookie data on servers outside the European Economic Area. Where this is the case, Arenas ensures that appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or reliance on an applicable adequacy decision. A summary of transfer mechanisms is provided in the provider reference table in Section 7.2.

8.2 Data Minimisation in Cross-Border Transfers — Arenas applies the principle of data minimisation in its use of third-party services. Where a provider offers EU-only data residency or anonymisation before transmission, Arenas applies that configuration where technically feasible. In the case of advertising pixels, Arenas limits the event parameters transmitted to the minimum necessary for the intended purpose (conversion tracking, retargeting, audience building).

You may request further information about the applicable transfer safeguards by contacting us at hello@arenasresortwear.eu.

9.1 Review and Update Cycle — Arenas reviews this Cookie Policy at least every six (6) months to ensure that it accurately reflects the cookies and pixels currently active on arenasresortwear.eu. The cookie register in Section 4 is updated in line with any changes. The version number and effective date are updated with each revision.

9.2 Notification of Material Changes — Where a material change is made to this Cookie Policy — in particular, the introduction of a new advertising platform, a new category of cookies, or a significant change in how existing cookies are used — Arenas will:

Update the version number and effective date of this Cookie Policy.

Display a renewed cookie consent banner so that you can make a fresh, informed choice before any new non-essential cookies are placed.

Send a notification by email to registered account holders where the change is material.

9.3 Version History — Version 1.0 — Effective date: [ ] — Initial version, including Meta Pixel, TikTok Pixel, and Pinterest Tag.

10.1 Questions and Requests — If you have any questions about this Cookie Policy, the cookies or pixels active on arenasresortwear.eu, or the way in which Arenas or its advertising partners process your data in connection with cookies, please contact us at:

Email: hello@arenasresortwear.eu

Post: Arenas · [ ], Valencia, Spain

Cookie settings: arenasresortwear.eu — footer link ‘Cookie settings’

Cookie Policy URL: arenasresortwear.eu/cookies

Privacy Policy URL: arenasresortwear.eu/privacy

10.2 Supervisory Authority — If you believe that Arenas has placed cookies or otherwise processed your personal data in breach of the GDPR or the LSSI, you have the right to lodge a complaint with the competent supervisory authority:

Agencia Española de Protección de Datos (AEPD — Spanish Data Protection Agency)

Website: aepd.es

Postal address: Calle Jorge Juan 6, 28001 Madrid, Spain

If you are resident in another EU Member State, you may also contact the supervisory authority of your country of habitual residence. We invite you to contact Arenas directly first so that we may attempt to resolve your concern.