--- title: "Privacy Policy" description: "How eduardklein.com collects, uses, and protects your data — written in plain language, compliant with the EU General Data Protection Regulation (GDPR)." author: "Eduard Klein" date: 2026-02-18 updated: 2026-04-22 lang: en type: pages url: "https://eduardklein.com/privacy/" site: "Eduard Klein" --- # Privacy Policy _Last updated: 22 April 2026_ This policy explains how **eduardklein.com** (the "Site") collects, uses, and protects your personal data. We process personal data only to the extent necessary to run a functional, user-friendly website and to provide the services it offers. The legal framework is the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD). Structure of this policy: 1. Who is responsible (the "controller") 2. Your rights 3. What data we process — and why 4. International data transfers 5. How long we keep data 6. Children 7. Changes to this policy 8. How to contact us ## 1. Who is responsible The data controller in the sense of Art. 4(7) GDPR is: ![Controller — Eduard Klein, Viladomat 107, 08015 Barcelona](https://eduardklein.com/images/address-eduard-klein-800.webp) Email: [contact@eduardklein.com](mailto:contact@eduardklein.com) We have not appointed a Data Protection Officer, as our processing activities do not trigger the requirements of Art. 37 GDPR. You can raise any data-protection matter directly with the address above. ## 2. Your rights Under the GDPR you have the following rights at any time, free of charge: - **Access** — confirmation of whether we process data about you, a copy of that data, and information about the processing (Art. 15 GDPR). - **Rectification** — correction of inaccurate or incomplete data (Art. 16 GDPR). - **Erasure** — deletion of your data where legally permitted (Art. 17 GDPR). - **Restriction of processing** — in the situations listed in Art. 18 GDPR. - **Data portability** — receipt of your data in a machine-readable format, and transmission to another controller where technically feasible (Art. 20 GDPR). - **Objection** — objection to processing based on our legitimate interests or to processing for direct marketing (Art. 21 GDPR). - **Withdraw consent** — at any time, with future effect, where processing is based on your consent (Art. 7(3) GDPR). - **Complaint to a supervisory authority** — in particular the Spanish Data Protection Agency (_Agencia Española de Protección de Datos_, [aepd.es](https://www.aepd.es)) or the authority of your habitual residence or place of the alleged infringement (Art. 77 GDPR). To exercise any of these rights, write to [contact@eduardklein.com](mailto:contact@eduardklein.com). We respond within one month; for complex requests we may extend this by two further months and will inform you of the extension. ## 3. What data we process — and why ### 3.1 Server logs When you visit the Site, your browser automatically transmits technical data to our hosting provider so the page can be delivered. These server logs include: IP address, date and time of the request, browser type and version, operating system, referring URL, and the page(s) requested. - **Purpose:** delivering the site, maintaining stability and security, preventing abuse. - **Legal basis:** Art. 6(1)(f) GDPR — our legitimate interest in a functional, secure website. - **Retention:** log entries are deleted automatically after at most 7 days, unless needed longer to investigate a security incident. ### 3.2 Cookies and consent A cookie is a small piece of data stored in your browser. We distinguish between two categories: - **Strictly necessary cookies** — required for core site functionality (e.g. remembering your cookie preference). They are set on the legal basis of Art. 6(1)(f) GDPR and our legitimate interest in providing the website. - **Optional cookies (analytics, etc.)** — set only with your explicit consent via our cookie banner, on the legal basis of Art. 6(1)(a) GDPR. You can withdraw consent at any time by clearing this site's site data in your browser or by using the banner again; the change takes effect from that moment forward. Until you interact with the banner, optional services are loaded in "consent denied" mode using Google Consent Mode v2: no personal identifiers are stored or transmitted. ### 3.3 Web analytics (Google Analytics 4) Subject to your consent, we use Google Analytics 4 (GA4) operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. - **What is collected:** pseudonymous usage data (pages viewed, session duration, device category, approximate geography, referrer). - **IP handling:** GA4 processes IP addresses only to derive approximate location and then discards them. We do not enable any advertising features, audience export, or cross-device tracking. - **Purpose:** understanding how visitors use the Site so we can improve content and navigation. - **Legal basis:** Art. 6(1)(a) GDPR (your consent). You can withdraw consent at any time using the cookie banner. - **Retention:** GA4 data is kept for 14 months and then deleted. - **Processor agreement:** a Data Processing Addendum under Art. 28 GDPR is in place with Google. ### 3.4 Newsletter If you subscribe to our newsletter, we ask for your email address and — optionally — your first name. We use a double opt-in confirmation: you will receive an email asking you to confirm the subscription before any newsletter is sent. - **What is collected:** email address, optional first name, IP address and timestamp of subscription and confirmation (for proof-of-consent). - **Purpose:** sending the weekly newsletter and related editorial updates. - **Legal basis:** Art. 6(1)(a) GDPR and Art. 7 GDPR (your consent). - **Retention:** until you unsubscribe. Every newsletter contains a one-click unsubscribe link; you can also write to [contact@eduardklein.com](mailto:contact@eduardklein.com). ### 3.5 Contact by email or form If you write to us, we process the information you provide (at minimum your email address and the content of your message) in order to answer you. - **Legal basis:** Art. 6(1)(b) GDPR (pre-contractual or contractual request) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). - **Retention:** for as long as your inquiry is open, and thereafter only if we are required by law to retain business correspondence. ### 3.6 Hosting and content delivery The Site is served via Cloudflare Inc. and a static hosting provider. These processors receive connection metadata (IP, request headers) to deliver pages and protect against abuse. - **Legal basis:** Art. 6(1)(f) GDPR. - Both are bound by standard data processing agreements under Art. 28 GDPR. ## 4. International data transfers Some of our processors (notably Google, Cloudflare) may process data on servers in countries outside the European Economic Area, including the United States. In that case, the transfer is safeguarded by: - an **adequacy decision** under Art. 45 GDPR — for transfers to U.S. entities that are self-certified under the **EU-U.S. Data Privacy Framework (EU-U.S. DPF)**; or - the **EU Standard Contractual Clauses** (Art. 46(2)(c) GDPR) together with supplementary measures where required. You can request a copy of the safeguards for a specific transfer at any time. ## 5. How long we keep data Unless a longer retention period is required by law (e.g. tax-related retention under Spanish law) or stated elsewhere in this policy, we delete personal data as soon as the purpose for its collection no longer applies. ## 6. Children The Site is not directed to children under 14. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it promptly. ## 7. Changes to this policy We may update this policy to reflect changes in the Site, our services, or the law. The "Last updated" date at the top of this page shows when the current version took effect. Material changes are communicated on the Site and, where relevant, by email. ## 8. How to contact us For any question about this policy or about how we process your data, write to: [contact@eduardklein.com](mailto:contact@eduardklein.com) We take your privacy seriously and will reply within one month under Art. 12(3) GDPR.