Cookies and portal access log
For the customer, supplier and carrier portal (clientes.riosa.com), this page completes the privacy policy and the cookie policy of riosa.com, which remain the governing ones. The data controller is RIOSA - Refinación Industrial Oleícola S.A., Tax ID A23008238, Barriada del Puente s/n, 23450 Ibros (Jaén, Spain).
Cookies
The portal uses a single, first-party, technical cookie. It uses no analytics, advertising or third-party cookies, and loads no content from other servers: fonts and images are served from the portal itself.
| Cookie | Purpose | Duration |
|---|---|---|
riosa_portal | Keep your session open after you sign in and protect forms against submissions from other websites. It is signed so it cannot be tampered with, is not accessible from page scripts and is only sent over a secure connection (HTTPS). | Until you sign out; at most 12 hours. |
As it is strictly necessary to provide the service you request (accessing your private area), it is exempt from consent under Article 22.2 of the Spanish LSSI-CE, which is why the portal shows no cookie banner. If you block it in your browser you will not be able to access the portal.
Access logging
To protect each company's information, the portal records:
- Sign-ins and sign-in attempts, successful or failed, sign-outs, and password changes and change requests.
- Access to each section and document downloads (invoices, analysis reports, consignment notes).
For each event it stores the date and time, the account's email address and company, the IP address it was made from, and what was viewed or downloaded.
- Purpose: ensure the security of the portal, detect and block unauthorised access (for example, locking an account after several failed attempts) and be able to verify, if needed, who accessed which document.
- Legal basis: the legitimate interest of RIOSA and its customers in the security of their information (Article 6.1.f GDPR) and the duty to apply appropriate security measures (Article 32 GDPR).
- Retention: 12 months; after that they are deleted automatically. If a record were needed to clarify a security incident or to meet a legal obligation, it will be kept blocked only for as long as necessary.
- Recipients: not disclosed to third parties, except by legal obligation. Only RIOSA staff in charge of the systems have access.
To resolve issues and check that data is correct, the RIOSA staff in charge of the portal may open it as your company sees it, in read-only mode (they cannot change anything in your account). Each such access is recorded in this same log, together with the person who made it.
The access-account data (email, company and password, which is stored irreversibly encrypted and cannot be read by anyone) is kept while the account is active, as stated in the riosa.com privacy policy.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to riosa@riosa.com with the subject "Protección de Datos", and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Last updated: 30 September 2026.