Last updated: April 24, 2026
This Privacy Policy describes how NetPsychology (“we”, “us”, “our”) collects, uses, and protects the personal data of visitors to netpsychology.org (the “Website”), in compliance with:
- Regulation (EU) 2016/679 of April 27, 2016 — General Data Protection Regulation (GDPR)
- Spanish Organic Law 3/2018 of December 5 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD)
- Spanish Law 34/2002 of July 11 on Information Society Services and Electronic Commerce (LSSICE)
This Privacy Policy should be read together with our Cookie Policy, Legal Notice, and Terms of Use.
1. Data Controller
Name: Octavio Ortega Esteban
Spanish Tax ID (NIF): ES03892442Z
Postal Address: C/ Concilios de Toledo 2, portal 7, 4B — 45005 Toledo, Spain
Email: octavio@kerchak.com
Website: netpsychology.org
As the publication is operated by an individual, a Data Protection Officer (DPO) has not been formally appointed, as this is not required under Article 37 GDPR for the scope of processing carried out by this Website. For any privacy-related question, you may contact the data controller directly at the email above.
2. What Data We Collect and Why
We process different categories of personal data depending on how you interact with the Website. For each category, we specify the data collected, the purpose of processing, the legal basis under GDPR, and the retention period.
2.1 Navigation Data (Analytics)
Data collected: IP address (anonymized), pages visited, time spent, approximate geographic location (country/region), device type, browser, operating system, traffic source, referrer URL.
Purpose: To understand how visitors use the Website, identify popular content, detect technical issues, and improve user experience.
Legal basis: Consent (Article 6.1.a GDPR), obtained through our cookie consent banner before any analytics cookie is installed.
Retention: Up to 14 months (Google Analytics 4 default for event data), after which data is automatically deleted from Google’s systems.
Recipients: Google LLC (Google Analytics) as data processor.
2.2 Advertising Data
Data collected: Browsing behavior, interests inferred from activity, device identifiers, interaction with advertisements. Data is collected only when advertising cookies are accepted.
Purpose: To display relevant advertisements, measure ad performance, and prevent fraud.
Legal basis: Consent (Article 6.1.a GDPR), obtained through our cookie consent banner.
Retention: Up to 13 months from the last interaction, as set by Google AdSense cookies.
Recipients: Google LLC (Google AdSense) and its advertising partners under the Google Ads network.
Note: If you do not consent to advertising cookies, non-personalized ads may still be displayed based solely on general context and approximate location, without persistent identifiers.
2.3 Contact Data (Email Correspondence)
Data collected: Name, email address, content of your message, and any additional data you voluntarily provide.
Purpose: To respond to your inquiries, handle editorial corrections, process topic suggestions, or manage permission requests.
Legal basis: Consent (Article 6.1.a GDPR) — you voluntarily initiate contact — and legitimate interest (Article 6.1.f GDPR) in responding to communications addressed to us.
Retention: For the duration of the communication exchange, plus up to 2 years afterward for record-keeping and follow-up, unless you request earlier deletion.
Recipients: Email service provider (see Section 5).
2.4 Comment Data (If Comments Are Enabled)
Data collected: Name (or pseudonym), email address (not published), website URL (optional), IP address, comment content, timestamp.
Purpose: To moderate and publish reader comments, prevent spam, and maintain conversation quality.
Legal basis: Consent (Article 6.1.a GDPR) — you voluntarily submit a comment — and legitimate interest (Article 6.1.f GDPR) in maintaining a functional comments section.
Retention: Indefinitely, as long as the associated article remains published, unless you request deletion.
Recipients: Anti-spam service (Akismet, operated by Automattic Inc.) if active on the Website.
2.5 Newsletter Subscription Data (If Offered)
Data collected: Email address and, optionally, name.
Purpose: To send periodic newsletters with new articles, updates, or curated content related to cyberpsychology.
Legal basis: Consent (Article 6.1.a GDPR), obtained through double opt-in confirmation.
Retention: Until you unsubscribe, plus a short period to document the unsubscribe request.
Recipients: Email marketing provider (see Section 5).
Your rights: Every newsletter includes an unsubscribe link. You can also request removal at any time by contacting octavio@kerchak.com.
2.6 Server Logs (Technical)
Data collected: IP address, request timestamp, pages requested, HTTP status codes, user agent string.
Purpose: Security, fraud prevention, error diagnosis, and protection against abuse (e.g., brute-force attacks, bots).
Legal basis: Legitimate interest (Article 6.1.f GDPR) in protecting the Website’s integrity and security.
Retention: Up to 30 days under normal operation; longer only if a specific security incident requires investigation.
Recipients: Hosting provider (see Section 5).
3. Who Can Access Your Data
We do not sell, rent, or trade your personal data. Data is accessed only by:
- The data controller (Octavio Ortega Esteban) for editorial and administrative purposes.
- Data processors acting on our behalf under GDPR-compliant contracts (Article 28 GDPR). See Section 5 for the full list.
- Public authorities, only when legally required (e.g., judicial orders, tax authorities, data protection authorities).
4. International Data Transfers
Some of our data processors are based outside the European Economic Area (EEA), particularly in the United States. These transfers are protected under:
- EU–US Data Privacy Framework (DPF), approved by the European Commission on July 10, 2023 (Adequacy Decision C(2023) 4745). Google LLC, Automattic Inc., and other US-based processors we use are certified under the DPF.
- Standard Contractual Clauses (SCCs) approved by the European Commission, where DPF certification does not apply.
You can verify DPF certification at dataprivacyframework.gov.
5. Data Processors
We engage the following third-party service providers who may process personal data on our behalf:
| Processor | Service | Legal Framework |
|---|---|---|
| Google LLC | Google Analytics, Google AdSense, Google Site Kit | EU–US Data Privacy Framework |
| Cloudi NextGen S.L. | Website hosting and server infrastructure | GDPR-compliant DPA |
Each processor is bound by a Data Processing Agreement (DPA) that restricts them to processing data solely for the purposes we define.
6. Your Rights Under GDPR
You have the following rights regarding your personal data:
6.1 Right of Access (Article 15 GDPR)
You can request a copy of the personal data we hold about you.
6.2 Right to Rectification (Article 16 GDPR)
You can request correction of inaccurate or incomplete data.
6.3 Right to Erasure / “Right to Be Forgotten” (Article 17 GDPR)
You can request deletion of your data when it is no longer necessary, when you withdraw consent, or when the data has been processed unlawfully.
6.4 Right to Restriction of Processing (Article 18 GDPR)
You can request that we limit the use of your data under certain circumstances (e.g., while we verify its accuracy).
6.5 Right to Data Portability (Article 20 GDPR)
You can request your data in a structured, commonly used, machine-readable format for transfer to another controller.
6.6 Right to Object (Article 21 GDPR)
You can object to processing based on legitimate interest, including profiling for advertising purposes.
6.7 Right to Withdraw Consent (Article 7.3 GDPR)
Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6.8 Right Not to Be Subject to Automated Decisions (Article 22 GDPR)
We do not make automated decisions with legal or similarly significant effects based solely on automated processing.
6.9 Right to Lodge a Complaint
You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Website: www.aepd.es
- Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
- Phone: +34 901 100 099 / +34 912 663 517
We encourage you to contact us first at octavio@kerchak.com so we can attempt to resolve any concern directly.
6.10 How to Exercise Your Rights
To exercise any of these rights, send a request to octavio@kerchak.com with:
- Your full name
- The right you wish to exercise
- A clear description of your request
- A copy of identification (DNI, passport) to verify your identity, if necessary
We will respond within one month of receiving your request, as required by Article 12.3 GDPR. This period may be extended by two additional months for complex requests, in which case we will inform you of the reason.
Exercising these rights is free of charge, unless the request is manifestly unfounded or excessive.
7. Data Security
We implement technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure, including:
- HTTPS encryption for all Website traffic (TLS 1.2 or higher)
- Access controls limiting data access to authorized personnel only
- Regular security updates of the WordPress installation, plugins, and underlying infrastructure
- Strong authentication for administrative access
- Backup and recovery procedures to prevent data loss
- Selection of GDPR-compliant processors with demonstrable security standards
No system is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the AEPD within 72 hours (Article 33 GDPR) and inform affected users without undue delay (Article 34 GDPR).
8. Children’s Privacy
The Website is not directed at children under 16 years of age.
In accordance with Article 7 of Spanish Organic Law 3/2018 (LOPDGDD), the processing of personal data of minors under 16 requires verifiable consent from parents or legal guardians.
We do not knowingly collect personal data from children under 16. If we become aware that we have collected such data without proper parental consent, we will delete it without undue delay. Parents or guardians who believe their child has provided us with personal data can contact octavio@kerchak.com for immediate deletion.
9. Automated Decisions and Profiling
We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.
Advertising personalization, when enabled through consent, involves a limited form of profiling by Google AdSense for ad targeting. This profiling does not have legal effects and can be disabled at any time via our cookie consent banner or directly through Google Ads Settings.
10. Links to Third-Party Websites
The Website contains links to third-party sites (academic sources, news outlets, reference materials). This Privacy Policy applies only to netpsychology.org.
We are not responsible for the privacy practices of third-party sites. We recommend reviewing the privacy policies of any external site you visit.
11. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices, applicable law, or the services we use. The “Last updated” date at the top of this page indicates when this policy was last revised.
Significant changes will be announced through the Website. For changes that materially affect your rights, we may request renewed consent where required by law.
We encourage you to review this Privacy Policy periodically.
12. Contact
For any question, request, or complaint related to this Privacy Policy or the processing of your personal data:
Octavio Ortega Esteban
Email: octavio@kerchak.com
Postal Address: C/ Concilios de Toledo 2, portal 7, 4B — 45005 Toledo, Spain
For complaints you may also contact the Spanish Data Protection Agency (AEPD).
This Privacy Policy was last reviewed and updated on April 24, 2026.