Cookie Policy

Last updated: 20/08/2026

This Privacy Policy explains how [LEGAL COMPANY NAME] (“we,” “us,” “our,” or the “Data Controller”), operator of the website codepeek.dev (the “Website” or “Service”), collects, uses, discloses, stores, and protects personal data of visitors and registered users (“you,” “the user”).

This Policy has been drafted in compliance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (General Data Protection Regulation, "GDPR");
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales, "LOPDGDD"), Spain's implementing legislation for the GDPR;
• Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (Ley 34/2002, de Servicios de la Sociedad de la Información y de Comercio Electrónico, "LSSI-CE"), which governs the use of cookies and similar technologies;
• Any other applicable EU or Spanish data protection or e-privacy legislation currently in force, including guidance issued by the Spanish Data Protection Agency (Agencia Española de Protección de Datos, "AEPD") and the European Data Protection Board ("EDPB").

By accessing or using the Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please refrain from using the Website.

1. Data Controller — Identity and Contact Details

If you have any questions about this Policy or about how we process your personal data, you may contact us using the details above.

2. What Personal Data We Collect

We collect the following categories of personal data:

2.1 Data you provide directly

• Identification data: first name and surname(s).
• Contact data: email address.
• Account data: username, password (stored encrypted/hashed), and any content you upload or publish through the Service.
• Communications: information you provide when you contact us (support requests, feedback forms, etc.).

2.2 Data collected automatically

• IP address (which may constitute personal data under Article 4(1) GDPR and Recital 30, as it can identify a device and, indirectly, a user).
• Browsing/usage data: pages visited, features used, time spent, click patterns, referring/exit pages, session duration, error logs, and other interaction data ("browsing habits").
• Device and technical data: browser type and version, operating system, device type, screen resolution, language settings.
• Approximate geolocation data: derived from your IP address or, where you grant permission, from your device's precise geolocation (e.g., country, region, city-level location).
• Cookies and similar tracking technologies: see Section 6 (Cookies).

2.3 Data collected via third-party analytics tools

We use Google Analytics and other web analytics tools (see Section 6) to collect aggregated and individual usage statistics, which may include IP address (subject to anonymization settings), device identifiers, browsing behavior, approximate location, and interaction events.

We do not intentionally collect special categories of data (Article 9 GDPR: health, religion, political opinions, sexual orientation, etc.), nor data relating to criminal convictions. Please do not submit such data to us through the Website.

3. Purposes and Legal Basis for Processing

In accordance with Article 6(1) GDPR, we process your personal data for the following purposes, each supported by a specific legal basis:

Where processing is based on consent (e.g., non-essential cookies, marketing emails), you may withdraw your consent at any time, free of charge, with the same ease with which it was given, without affecting the lawfulness of processing carried out prior to withdrawal (Art. 7(3) GDPR).

Where processing is necessary to enter into or perform a contract with you, providing the requested data is a contractual requirement; failure to provide it may prevent us from delivering the Service.

4. Recipients of Personal Data

We do not sell your personal data. We may share personal data with the following categories of recipients, always under appropriate contractual and technical safeguards:

• Service providers / data processors (Art. 28 GDPR) that act on our behalf and under our instructions, such as hosting providers, cloud infrastructure providers, email delivery services, customer support tools, and analytics providers (see Section 6). These providers are bound by data processing agreements requiring confidentiality, security, and use of data solely for the agreed purposes.
• Analytics and advertising partners, such as Google LLC (Google Analytics) and other similar tools, to the extent you have consented to their use.
• Professional advisors (lawyers, auditors, accountants) where necessary for legitimate business purposes.
• Competent public authorities, law enforcement agencies, courts, or regulators, when we are legally required to do so, or when disclosure is necessary to:
  • comply with a legal obligation, court order, or valid legal process;
  • protect and defend our rights or property;
  • prevent or investigate possible wrongdoing in connection with the Service;
  • protect the personal safety of users of the Service or the public;
  • protect against legal liability.
  Such disclosures will be limited to what is legally required and will be assessed on a case-by-case basis to ensure compliance with Article 6(1)(c) and (e) GDPR and applicable Spanish procedural law.
• Business transfer recipients: if we are involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction, subject to confidentiality obligations and this Policy (or a materially similar policy).

5. International Data Transfers

Some of our service providers (including Google, for Google Analytics) may process data outside the European Economic Area (EEA), including in the United States.

Where personal data is transferred outside the EEA, we ensure an adequate level of protection through one or more of the following safeguards, in accordance with Chapter V GDPR:

• Transfers to countries covered by an adequacy decision of the European Commission (Art. 45 GDPR);
• Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR), including supplementary measures where required following the Schrems II ruling (CJEU, Case C-311/18);
• Participation of the recipient in a valid EU-U.S. Data Privacy Framework certification, where applicable.

You may request further information about the safeguards applied to a specific transfer by contacting us at the details in Section 1.

6. Cookies and Analytics Tools

6.1 Cookies

The Website uses cookies and similar technologies (local storage, pixels, tags) in accordance with Article 22 LSSI-CE and the GDPR. Cookies are classified as:

• Strictly necessary cookies: required for the Website to function (e.g., session management, security, load balancing). These do not require consent.
• Analytics/performance cookies: used to understand how visitors interact with the Website (e.g., Google Analytics). Require prior consent.
• Functionality cookies: remember preferences (e.g., language). May require consent depending on their nature.
• Advertising/marketing cookies (if used): used to deliver relevant ads and measure campaign performance. Require prior consent.

We display a cookie consent banner on your first visit, allowing you to accept, reject, or configure cookies by category, and to withdraw consent at any time via [cookie settings link/tool].

6.2 Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and/or Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Google Analytics uses cookies and similar technologies to collect data such as your IP address (which we configure to be anonymized/truncated where technically possible), device and browser information, pages visited, time spent, and approximate location. This information is transmitted to and processed by Google, acting as an independent controller and/or processor depending on the configuration, in accordance with Google's Privacy Policy: https://policies.google.com/privacy

You can prevent Google Analytics from collecting your data by installing the Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

6.3 Other analytics/tracking tools

We may use additional analytics, error-monitoring, or performance-measurement tools (e.g., server log analysis, heatmaps, session-recording tools, or similar services). Each such tool is used only for purposes compatible with those described in this Policy, and where required, only after obtaining your consent through our cookie/consent management mechanism. A current list of specific third-party tools in use is available upon request or, where applicable, within our cookie settings panel.

For further details, please refer to our separate Cookie Policy, if published, which forms part of this Privacy Policy.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, in accordance with the principle of storage limitation (Art. 5(1)(e) GDPR). In particular:

• Account and contract-related data: retained for the duration of your relationship with us and, thereafter, for the periods established by applicable Spanish law for potential contractual, tax, or civil liabilities — generally up to 6 years (Article 30 of the Spanish Commercial Code, for commercial/accounting documentation) and up to 5 years for civil liability claims (Article 1964 of the Spanish Civil Code), or longer where a longer statutory limitation period applies.
• Tax-relevant data: retained for the period required by Spanish tax legislation, generally 4 years (General Tax Law 58/2003), which may be extended in specific circumstances.
• Data processed on the basis of consent (e.g., analytics, marketing): retained until you withdraw your consent, plus a reasonable period to give effect to that withdrawal, after which the data will be deleted or anonymized.
• IP addresses and technical/security logs: typically retained for a limited period (e.g., up to 12 months, unless a longer period is required to investigate a security incident or comply with a legal obligation), in line with AEPD guidance on log retention.
• Data subject to a legal hold, ongoing dispute, or investigation, or requested by a competent authority: retained for as long as necessary to comply with that specific legal obligation or proceeding.

Once the applicable retention period expires, personal data will be securely deleted, destroyed, or anonymized, such that it can no longer be attributed to an identified or identifiable individual.

8. Your Rights Under the GDPR and LOPDGDD

As a data subject, you have the following rights, which you may exercise free of charge, at any time, by contacting us at the details in Section 1:

• Right of access (Art. 15 GDPR): obtain confirmation of whether we process your data and access to that data.
• Right to rectification (Art. 16 GDPR): request correction of inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17 GDPR): request deletion of your data, subject to legal exceptions (e.g., data we must retain to comply with a legal obligation).
• Right to restriction of processing (Art. 18 GDPR): request that we limit the processing of your data in certain circumstances.
• Right to data portability (Art. 20 GDPR): receive your data in a structured, commonly used, machine-readable format, and/or request its transfer to another controller, where technically feasible.
• Right to object (Art. 21 GDPR): object to processing based on legitimate interest or carried out for direct marketing purposes, including profiling related to such marketing.
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing.
• Right not to be subject to automated individual decision-making, including profiling, that produces legal or similarly significant effects on you (Art. 22 GDPR) — we do not currently carry out such processing.
• Right to lodge a complaint with a supervisory authority. In Spain, the competent authority is:

  Agencia Española de Protección de Datos (AEPD)
  C/ Jorge Juan, 6, 28001 Madrid, Spain
  https://www.aepd.es

  You may also lodge a complaint with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement, in accordance with Art. 77 GDPR.

How to exercise your rights: Send a written request to [privacy@codepeek.dev], identifying yourself and clearly specifying the right you wish to exercise. We may request additional information to verify your identity, in accordance with Art. 12(6) GDPR. We will respond within one (1) month of receipt, extendable by two further months where necessary, taking into account the complexity and number of requests, as permitted under Art. 12(3) GDPR.

9. Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, including, as applicable:

• Encryption of data in transit (e.g., HTTPS/TLS) and, where appropriate, at rest;
• Access controls and role-based permissions restricting access to personal data to authorized personnel only;
• Regular security testing, monitoring, and vulnerability assessment;
• Secure password storage using industry-standard hashing algorithms;
• Backup and disaster recovery procedures;
• Confidentiality agreements with employees and processors who handle personal data.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the AEPD without undue delay and, where required, within 72 hours of becoming aware of it (Art. 33 GDPR), and will inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR).

10. Minors

The Service is not directed at children under the age of 14 (the minimum age of consent for information society services under Spanish law, per Art. 7 LOPDGDD; note this may be 16 in other EU jurisdictions absent Member State derogation). We do not knowingly collect personal data from minors below this age without verified parental or guardian consent. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly. If you believe a minor has provided us with personal data without appropriate consent, please contact us using the details in Section 1.

11. Automated Decision-Making and Profiling

We do not currently use your personal data to make decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you. Should this change, we will update this Policy and, where required, obtain your explicit consent in accordance with Art. 22 GDPR.

12. Third-Party Links

The Website may contain links to third-party websites or services not operated by us. This Privacy Policy does not apply to such third-party websites. We encourage you to review the privacy policies of any third-party site you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated version will be indicated by an updated "Last updated" date at the top of this page. We encourage you to review this Policy periodically. Where changes are material, we will provide additional notice (e.g., via email or a prominent notice on the Website) as appropriate and, where required by law, seek renewed consent.

14. Contact

For any questions, requests, or complaints regarding this Privacy Policy or our data processing practices, please contact:

Email: [privacy [@] codepeek.dev]