IN VITRO S.L. — invitro.es
Last updated: 16 August 2026
The entity responsible for the processing of your personal data is:
IN VITRO S.L.
NIF: B58238940
Calle Riera de la Salud, Polígono 13, Parcela 20
08980 Sant Feliu de Llobregat, Barcelona, Spain
Privacy contact: [email protected]
We collect and process the following categories of personal data:
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Contact form details (name, email, phone, country, land size, objective, target date) | Responding to enquiries and preparing availability quotations | Art. 6(1)(b) — pre-contractual steps / Art. 6(1)(f) — legitimate interest |
| Website behaviour & analytics (pages visited, form interactions, device/browser, approximate location) | Measuring and improving site performance | Art. 6(1)(a) — consent |
| Advertising & conversion data (ad source, ad-click IDs, conversion events) | Measuring and optimising Google advertising campaigns | Art. 6(1)(a) — consent |
| Security & fraud-prevention data (integrity identifier, bot signals, IP address, user agent) | Bot / invalid-traffic detection and site protection (Cloudflare, OctoView) | Art. 6(1)(f) — legitimate interest (strictly necessary) |
| Consent record (categories accepted or rejected) | Recording and honouring your cookie preferences | Art. 6(1)(c) — legal obligation / strictly necessary |
We do not sell your personal data to third parties.
Our website uses cookies and similar tracking technologies. A cookie is a small text file placed on your device. The tables below list every cookie in use, grouped by purpose.
These cookies are essential for the site to function securely. They cannot be disabled and do not require your consent.
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| cmplz_* | Complianz | Records your cookie consent choices | 1 year |
| cf_clearance | Cloudflare | Security token protecting against bot attacks | Session / ~1 day |
| o360_integrity | OctoView / Octo360 | First-party integrity identifier to detect invalid traffic | ~7 days |
These cookies are set only after you give consent and help us understand how visitors use our site.
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| ph_* | PostHog (EU Cloud) | Visitor behaviour and session analytics | ~1 year |
| o360_vid | OctoView / Octo360 | First-party visitor identifier and attribution | ~13 months |
| o360_sid | OctoView / Octo360 | Session identifier | Session |
These cookies are set only after you give consent and are used to measure and optimise advertising.
| Cookie name | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Conversion linker — links ad clicks to conversions | ~90 days | |
| _ga | Google Analytics visitor identifier (if active) | ~13 months | |
| _gcl_aw / gclid | Stores the Google click identifier from ad clicks | ~90 days |
Nothing non-essential loads until you accept the relevant cookie category. The strictly necessary security/integrity identifier (o360_integrity) is exempt from consent because it is required to keep the site secure and operational.
On invitro.es (main site), a cookie consent banner powered by Complianz is shown on your first visit. On paulownia.invitro.es (landing pages), consent is managed through OctoView’s built-in consent gate.
Accept and decline options are equally prominent. You may withdraw or change your consent at any time by clicking the “Cookie Settings” link in the website footer. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.
Strictly necessary cookies — including Cloudflare’s security features and the OctoView integrity identifier — are not subject to consent because they are essential for secure and functional operation of the site.
Role: CDN, edge security, bot protection (Turnstile), and hosting of landing pages.
Data processed: IP address, request headers, user agent, timestamps, bot-detection signals.
Where: Global edge network; US-headquartered with EU data centres.
Transfer basis: Cloudflare DPA + EU Standard Contractual Clauses; Cloudflare self-certifies under the EU–US Data Privacy Framework.
Role: Cookie consent management platform on the main site.
Data processed: Consent record stored first-party in the visitor’s browser and optionally in the WordPress database.
Where: Data remains first-party on our WordPress host; no data is sent to a Complianz cloud. Complianz is an EU entity (Netherlands).
Transfer basis: Minimal — data remains first-party within the EU.
Role: Product and behaviour analytics.
Data processed: Behaviour events, device/browser details, approximate location (from IP), PostHog visitor identifier.
Where: EU/EEA — Frankfurt, Germany (PostHog EU Cloud). The US parent company may have onward access covered by PostHog DPA + SCCs.
Transfer basis: PostHog DPA + EU Standard Contractual Clauses.
Role: First-party analytics, attribution, and traffic-integrity / fraud detection.
Data processed: Visitor and session identifiers (o360_* cookies), page/behaviour events, ad-click identifiers, integrity/fraud signals, IP address, user agent.
Where: Google Cloud EMEA infrastructure.
Transfer basis: Data Processing Agreement between IN VITRO S.L. (controller) and Octo360 (processor).
Role: Advertising conversion measurement and remarketing via the Google tag (gtag).
Data processed: Online identifiers, ad-click IDs (gclid), Google cookies, device/browser data, approximate location, conversion events.
Where: Google Ireland is the EU point of contact; data may also be processed by Google LLC in the US.
Transfer basis: Google Ads Data Processing Terms + EU Standard Contractual Clauses; Google self-certifies under the EU–US Data Privacy Framework.
Under the GDPR and applicable Spanish data-protection law, you have the right to:
To exercise any of the above rights, please contact us at [email protected]. We will respond within one month.
We do not carry out automated decision-making that produces legal or similarly significant effects on individuals. Ad-targeting and traffic-integrity scoring are used solely for operational and advertising optimisation purposes.
This website is a business-to-business (B2B) platform aimed at agricultural professionals and landowners. It is not directed at children under 16 years of age, and we do not knowingly collect data from minors.
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including Cloudflare’s edge security and HTTPS encryption across the site.
We may update this policy from time to time to reflect changes in our practices or applicable law. The “last updated” date at the top of this page indicates when it was last revised. Continued use of the site after changes are published constitutes acceptance of the updated policy.
For any privacy-related queries or to exercise your data-subject rights:
IN VITRO S.L.
Calle Riera de la Salud, Polígono 13, Parcela 20
08980 Sant Feliu de Llobregat, Barcelona, Spain
Email: [email protected]
