Cookie Policy
Last updated: October 2026
1. Who is responsible
eu.hurley.com (the “Website”) is the official direct-to-consumer channel of the HURLEY brand in Europe and other markets accessible from the Website. This policy explains which cookies and similar technologies we use, what they are for and how you can decide about them.
The Website is managed by HURLEY 999, S.L., the entity authorised to commercially exploit the HURLEY brand in the relevant territories.
Company name: HURLEY 999, S.L.
Tax ID (NIF): B63209084
Registered address: Paseo de Gracia, 112, 1.º, 08008 Barcelona, Spain
Contact: customer@hurley-emea.com
Privacy: privacy@hurley-emea.com
Velara Brands, S.L. acts as the seller of record and contractual counterparty for purchases made on the Website, and issues the corresponding invoices.
Company name: Velara Brands, S.L.
Tax ID (NIF): B22672596
Registered address: C/ Roger de Lauria 19, 4th floor, 46002 Valencia, Spain
Contact: info@velarabrands.com
As regards cookies, HURLEY 999, S.L. is responsible for the analytics and advertising cookies, and Velara Brands, S.L. for the technical cookies needed for purchases. In this policy, “we”, “us” or “our” refers to HURLEY 999, S.L. and/or Velara Brands, S.L., depending on the activity described in each case.
For any questions about cookies or to exercise your rights, write to us at privacy@hurley-emea.com.
2. What cookies are
A cookie is a small file that the Website stores in your browser to remember information between pages or visits.
We also use technologies that work in a similar way: the browser’s local and session storage (localStorage and sessionStorage), pixels and data sent from our servers. In this policy we call all of them “cookies”, because the law applies the same rules to them.
Depending on who manages them, they can be first-party (we manage them from our own domain) or third-party (another company manages them and processes the data they collect).
3. Categories at a glance
Only technical cookies are set without your permission. All the others wait until you accept them.
| Category | What they are for | Responsible | Consent required? |
|---|---|---|---|
| Technical and personalisation | Making the store work: cart, checkout, account, security, customer service chat, and remembering the country, language and currency you choose | Velara Brands, S.L. | No |
| Analytics | Measuring how the website is used and navigated, in order to improve it | HURLEY 999, S.L. | Yes |
| Advertising and marketing | Measuring campaigns, showing you relevant ads on other websites and social networks, attributing sales to affiliates and personalising emails | HURLEY 999, S.L. | Yes |
4. How to decide and change your mind
On your first visit you will see a banner with three equally weighted options: accept all, reject all or configure by category. If you reject, only technical cookies are set.
You can change your choice at any time from the “Cookie settings” link in the footer or from the banner’s floating icon. Withdrawing consent is as easy as giving it, and it does not affect anything done before you withdrew it.
The banner is managed by the Pandectes GDPR Compliance platform. Your decision is passed on to Google (via Consent Mode v2), Meta, Microsoft and Klaviyo, which do not set cookies or send data for any category you have not accepted. The same applies to data we send from our servers (Meta Conversions API).
We keep your choice for 12 months. After that period, or if we make significant changes to the cookies we use, we will ask you again.
5. Cookie inventory
This is the full list, reviewed in October 2026.
5.1 Technical and personalisation (no consent required)
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _shopify_essential | Shopify | Session, cart, checkout and security | 1 year | First-party |
| cart, cart_currency | Shopify | Cart contents and currency | 2 weeks | First-party |
| localization | Shopify | Country and language you choose | 1 year | First-party |
| mdApp_countryCodeDomain, mdApp_showRecommendationLang | Geolocation app | Remembering your country and whether we have already suggested a language | 2 months | First-party |
| orbeSession (session storage) | Orbe | Country selector and detection | Session | First-party |
| _pandectes_gdpr | Pandectes | Storing your choice in the banner | 1 year | First-party |
| _shop_app_essential and signInWithShop:* (local storage) | Shopify (Shop Pay) | Fast payment and sign-in with Shop Pay | 1 year | Third-party |
| wishlist (local storage) | Wishlist app | Saving the products you mark as favourites | Until you delete it | First-party |
| gorgias.* (local and session storage) | Gorgias | Customer service chat: conversation, language and chat status | Until you delete it | Third-party |
| __klarna_sdk_version (local storage) | Klarna | Showing instalment payment options | Until you delete it | Third-party |
| Size widget | Reveni | Size recommendation | Variable | Third-party |
5.2 Analytics (consent required)
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _shopify_analytics, shopify_client_id | Shopify | Statistics on visits and purchases in the store | 1 year | First-party |
| _ga | Google Analytics 4 | Distinguishing users anonymously | 13 months | Third-party |
| _ga_4RR7E4HM45 | Google Analytics 4 | Maintaining session state | 13 months | Third-party |
| _clck, _clsk | Microsoft Clarity | Identifying visits and grouping pages into a session for heatmaps and anonymous recordings | 1 year / 1 day | Third-party |
| MUID | Microsoft (clarity.ms) | Microsoft browser identifier | 1 year | Third-party |
| _dd_s | Datadog | Measuring website errors and performance | 1 year | Third-party |
5.3 Advertising and marketing (consent required)
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _shopify_marketing | Shopify | Attributing visits and sales to campaigns | 1 year | First-party |
| _gcl_au, _gcl_aw, _gcl_gs, _gcl_ls (local storage) | Google Ads | Attributing conversions to ads | 90 days | Third-party |
| GCL_AW_P | Google Ads (google.com, doubleclick.net, googleadservices.com) | Attributing ad clicks to purchases | 90 days | Third-party |
| IDE | Google (doubleclick.net) | Personalised ads and remarketing on websites and YouTube | 13 months | Third-party |
| NID | Google (google.com) | Google ad preferences and personalisation | 6 months | Third-party |
| _fbp, _fbc | Meta | Measuring and attributing ads on Facebook and Instagram (_fbc only if you arrive from an ad) | 90 days | Third-party |
| __kla_id | Klaviyo | Linking your browsing to your profile to personalise emails and alerts | 1 year | First-party |
| __kla_viewed, klaviyoOnsite, kl-post-identification-sync (local storage) | Klaviyo | Viewed products, sign-up forms and back-in-stock alerts | Until you delete it | Third-party |
| TRADEDOUBLER, TDUIS | Tradedoubler | Attributing sales to affiliate websites, only if you arrive from one of them | 1 year | Third-party |
6. Third parties involved
These companies set or read cookies on the Website. You can see how they process data in their policies.
| Provider | Role on the website | Their policy |
|---|---|---|
| Shopify | Store platform and Shop Pay | Privacy policy |
| Cloudflare | Security and performance | Privacy policy |
| Pandectes | Consent banner | Privacy policy |
| Gorgias | Customer service chat | Privacy policy |
| Google (Analytics and Ads) | Analytics and advertising | How Google uses cookies |
| Microsoft (Clarity) | Session analytics | Privacy statement |
| Meta | Advertising on Facebook and Instagram | Cookie policy |
| Klaviyo | Email marketing and forms | Privacy policy |
| Tradedoubler | Affiliate marketing | Privacy policy |
| Klarna | Instalment payments | Cookie policy |
| Reveni | Size recommendation | Cookie policy |
7. Transfers outside the European Economic Area
Some of these providers process data in the United States (Google, Microsoft, Meta, Klaviyo, Gorgias, Cloudflare, Pandectes) or in Canada (Shopify).
These transfers are based on the EU-US Data Privacy Framework where the provider is certified, on the adequacy decision for Canada in the case of Shopify and, in all other cases, on the European Commission’s Standard Contractual Clauses. You can find the details in our Privacy Policy.
8. Managing cookies in your browser and changes to this policy
In addition to the banner, you can view, delete or block cookies from your browser: Chrome, Firefox, Safari, Edge and Opera. If you block technical cookies, the cart and checkout may stop working.
We will update this policy when the cookies we use or the law change. The date at the top shows the latest revision.