Privacy Policy
Last revised ·English translation. The Spanish version prevails
This policy was written by hand, not produced by a generator, and it describes what this site really does: every cookie with its name, every provider with theirs and every period with a figure. All of it can be checked by opening DevTools.
1. The short version
| Do I need to give you any data to read? | No. You can browse the whole site without leaving a single piece of identifying data. |
|---|---|
| Is there a newsletter? | No. There is no mailing list, and there won't be one without announcing it here first. |
| Is data sold? | No. Never. Not to third parties, not to anyone. |
| Is there analytics? | Yes, and it only switches on if you accept it. By default it is denied. |
| Who do I write to? | carlos@sanchezdonate.net |
2. Data controller
| Controller | Carlos Manuel Sánchez Donate |
|---|---|
| Tax ID (NIF) | 23312961T |
| Address | Tarazona 16, 30310 Cartagena (Murcia), Spain |
| carlos@sanchezdonate.net | |
| Website | https://sanchezdonate.net/ |
| Data Protection Officer | Not applicable. None of the cases in Article 37 of the GDPR apply. |
This processing is governed by Regulation (EU) 2016/679 (GDPR) and by Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
3. What data is collected and where it comes from
3.1. The data you give me
- Contact form: name, email address, subject and the message you write. The subject field is optional.
- Comments, if enabled on the post: name, email and the text of the comment.
- Direct email: whatever appears in the email you send me, including your signature.
3.2. The data your browser generates on its own
- Server logs: IP address, date and time, resource requested, response code, user-agent and referer. Apache generates them simply by serving you the page, just like on any other site in the world.
- Anonymous browsing data through analytics cookies, only if you accept them: pages viewed, duration, device, browser, language and approximate country inferred from the IP.
- Referring page: if you reach the form from a specific article, that URL travels with the form in a field called
comefrom, so I know which content brought you here.
3.3. What is not done
- No databases are bought or rented.
- No profiles with legal effects are built, and no automated decisions are made about you.
- No special categories of data are processed (health, ideology, religion, membership, biometric data).
- There is no fingerprinting and there are no first-party persistent identifiers beyond those described in the cookie policy.
4. For what, on what legal basis and for how long
| Processing | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Contact form | Answering your enquiry and, where appropriate, continuing the conversation afterwards. | Consent (6.1.a) and steps taken at the request of the data subject prior to entering into a contract (6.1.b). | 12 months from the last communication, unless the conversation leads to a contractual relationship. |
| Comments | Publishing and moderating your contribution. | Consent (6.1.a). | For as long as the post remains published or until you request its deletion. |
| Server logs | Security, error diagnosis, crawl analysis and service integrity. | Legitimate interest (6.1.f) in keeping the site up and running. | 30 days. After that they are rotated and deleted. |
| Form anti-spam | Telling people from bots by means of a honeypot, a timestamp and a blocking cookie. | Legitimate interest (6.1.f). | See the cookie policy. |
| Web analytics | Knowing which content is read and where navigation gets stuck. | Consent (6.1.a) and Art. 22.2 LSSI. | 14 months in Google Analytics; see the periods for each cookie. |
| Advertising measurement | Attributing conversions if campaigns are ever running. | Consent (6.1.a). | See the periods for each cookie. |
| Published diplomas and certificates | Publicly certifying that a course has been passed. | Express consent of the person concerned (6.1.a), which can be withdrawn. | For as long as consent is maintained. |
| Invoicing and tax obligations | Issuing and keeping records of the services contracted. | Legal obligation (6.1.c). | 4 years (Spanish General Tax Law) and 6 years (Spanish Commercial Code). |
5. Who else sees this data
No data is passed on to third parties unless required by law. There are, however, providers that process it on the controller's behalf, under a data processing agreement in accordance with Article 28 of the GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Raiola Networks S.L. | Hosting for the site and email. This is the provider that handles everything that passes through the server. | Spain. No international transfer. |
| Google Ireland Ltd. / Google LLC Google Analytics 4, Google Ads | Usage analytics and campaign measurement. | Ireland, with transfer to the USA. |
| Microsoft Ireland Operations Ltd. / Microsoft Corp. Clarity | Heatmaps and aggregated recording of interaction. | Ireland, with transfer to the USA. |
| Discord Inc. | Community. If you join the Discord, your relationship is directly with Discord and its own terms. | USA. |
| Calendly LLC | Call booking. | USA. |
5.1. International transfers
The site and email are hosted in Spain, so the bulk of the data —what you write in the form, the messages you send me and the server logs— never leaves the European Economic Area.
Google and Microsoft participate in the EU-US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection by its decision of 10 July 2023. For the remaining providers outside the European Economic Area, the Standard Contractual Clauses approved by the Commission apply.
6. Security
The technical and organisational measures that are reasonable for a site of this size are applied: HTTPS enforced across the whole domain, security headers, updates to the CMS and its components, restricted administrative access, backups and validation of form inputs.
No system is invulnerable. In the event of a security breach that poses a high risk to your rights, you will be informed without undue delay, in accordance with Article 34 of the GDPR, and the Spanish Data Protection Agency will be notified within 72 hours.
7. Your rights
With regard to your personal data, you have the right to:
- Access: know what data about you is held and where it came from.
- Rectification: correct anything that is wrong or incomplete.
- Erasure: have it deleted when it is no longer needed.
- Restriction: have it kept but not used while a disagreement is resolved.
- Objection: object to processing based on legitimate interest.
- Portability: receive your data in a structured, commonly used format.
- Withdraw your consent at any time, without affecting the lawfulness of the processing carried out before.
To exercise them, write to carlos@sanchezdonate.net stating which right you are exercising. You will receive a reply within one month, which may be extended to two if the request is complex. Proof of identity will only be requested if there are reasonable doubts about your identity, and in that case a partially redacted document that allows verification will suffice.
If you believe the processing does not comply with the regulations, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, Spain. You also have the right to an effective judicial remedy.
8. Minors
This site is not aimed at children under 14 and does not knowingly collect data from people of that age. Under Article 7 of the LOPDGDD, processing the data of children under 14 requires the consent of the person holding parental authority or guardianship. If you find that a minor has provided data, write in and it will be deleted.
9. Accuracy of data
The data you provide must be correct and up to date. As a User, you are responsible for the truthfulness of what you send; if you write from an email address that isn't yours, the reply will go to that address.
10. Changes to this policy
This policy may be modified to adapt it to changes in legislation, case law or the tools used. The version and the effective date are shown at the beginning of the document. If a change substantially affects processing based on your consent, you will be asked for it again.
11. Related documents
- Legal notice — who I am and on what terms you can use the site.
- Cookie policy — the detail of what is stored in your browser.
Last revised: . The section on tracking the path of visitors arriving from ChatGPT has been removed: it is no longer recorded. This document fully replaces any previous version. This is an English translation provided for convenience; in the event of any discrepancy, the Spanish version prevails.