Privacy policy

1. Who the data controller is

The data you provide through this website is processed by:

Legal name:

Asociación PsicoDiversa

Tax number (NIF):

G22559793

Registered address:

Calle Mendoza 6 derecha, 29002, Málaga, Spain

Contact email:

laura@psicodiversa.es

Domain:

https://psicodiversa.es

The full identification of the service provider required by Spanish e-commerce law (LSSI) is in the legal notice.

2. What data we collect and where it comes from

Everything we know about you, you give us yourself, almost always by filling in the form on the contact page or on one of our service pages: name, phone number, email if you give one, the channel you would prefer us to reply through, and whatever message you want to write. The message is a free-text field, so you can tell us as much or as little as you like, and it may include information about your health (we cover that separately in point 5).

We also collect some technical data automatically as you browse the site: IP address, device and browser type, pages visited and where you came from. That data arrives through the analytics described in point 8, not through the form.

We do not collect data from external sources, and we do not buy or cross-reference third-party databases. Everything comes from what you give us yourself or from your browsing on this site.

3. What we use your data for

We use your data to:

• Reply to you and handle your request for an appointment or for information.
• Contact you through the channel you chose: WhatsApp, phone or email.
• Meet the legal obligations that apply to us as a center and as an association.
• Understand how the site is used and improve it, with aggregated data that does not identify you individually.
• Detect and filter automated submissions (spam) in the form.

We do not use your data for any other purpose. We also do not send you marketing messages you have not asked for: if one day we start a newsletter or something similar, we will ask you for separate, specific consent for that; the consent given in this form would not cover it.

4. Legal basis for processing your data

When you fill in the form and tick the corresponding box, you give us your express consent to process your data for the purpose of replying to you. That is the legal basis for this processing: your consent, which you can withdraw whenever you like by writing to the email address in point 1, without that affecting anything we processed before you withdrew it.

If you later engage one of our services, performance of the contract between you and us is added as a basis, along with the tax obligations that follow from it.

We filter automated submissions (spam) in the form on the basis of our legitimate interest in the security of the form, without this involving any profiling or affecting your rights.

5. If your message includes health data

The message field in the form is free text and, because we are a psychology center, it is common for people to write there about their mental health: anxiety, a dependency process, an addiction. The GDPR treats this as a special category of data and requires reinforced protection: the general consent of the form is not enough, you need to consent expressly to this specific type of data.

That is why the same consent box in the form (the one in point 4, the only one there is) includes this specific sentence within its own text: “I understand that my message may include health data and I expressly consent to it being processed for that sole purpose”. It is not a separate box or an extra step: it is a single consent that covers both the general processing of your data and, expressly and distinctly in its wording, any health data you may include. If you do not tick that box, we cannot process your request, whether or not it contains such data.

If you would rather not write anything about your health in the form, you can leave the message field blank and tell us directly when we speak.

This data, where there is any, is used only to assess your request and to prepare for that first conversation with you. It is not shared with anyone outside the center and is not used for advertising of any kind.

6. How we protect your data

The message you write in the form is encrypted before it is stored (AES-256-GCM), so even if someone reached the storage they could not read it without the key, which only the center’s psychologists hold. The connection to the site always goes over HTTPS.

To stop automated spam we use invisible technical checks: we are not going to ask you to solve a captcha or tick an “I am not a robot” box. If the system flags a submission as suspicious but cannot rule out a real person behind it, we show you a page with our phone number and WhatsApp so that you can reach us another way regardless.

We apply the technical and organizational measures that are reasonable for this activity, in line with what the GDPR requires. At present only Laura and María Zuleica have access to the messages.

7. Who we share your data with

We do not sell or transfer your data to third parties. Besides us, the only parties who may access it are the technical providers that make the site work (server hosting, sending the notification email when a new message arrives), and they always do so as data processors: bound by contract to use it solely to provide us with that service, with the same security and confidentiality guarantees we apply ourselves.

We may also disclose your data to public authorities where the law requires it, for example to the Spanish tax agency or to a court. Never on our own initiative.

8. Analytics, cookies and advertising

We use Google Analytics 4 to know, in aggregate, how many people visit the site and which pages they find useful. We do not use Google Tag Manager: the measurement tags are placed directly in the site’s code, without that intermediary.

By default, when you arrive at the site, analytics and non-essential cookies are switched off (Consent Mode v2): they are only switched on if you accept the cookie banner, and you can change your mind at any time from that same banner.

We also use a Google Ads conversion measurement cookie, to know whether a visit that arrived from an ad ended up sending the contact form, without cross-referencing it with your name, your email or your phone number. We do not use remarketing tools or Google Ads enhanced conversions. As a health center, we prefer not to feed advertising profiles with your visit to this site.

For the European Economic Area, Google Analytics has Google Ireland Limited (Ireland) as controller; this may mean that some technical and anonymous data is transferred to servers outside the EEA (usually Google LLC, in the United States), with the safeguards (standard contractual clauses) that European rules require.

The full detail of cookies, purposes and how to withdraw consent is in the cookie policy.

9. How long we keep your data

We keep your data for as long as the conversation or the process you started with us lasts, and afterwards for as long as the legal obligations that apply to us require (for example, tax obligations, if you become a client and there is an invoice involved). After that period we delete it or anonymize it.

If you ask us to delete your data before then (point 10) and there is no legal obligation preventing us from doing so, we delete it without further formalities.

10. Your rights

You have the right to:

• Know what data of yours we process (access).
• Ask us to correct inaccurate data (rectification).
• Ask us to delete it (erasure).
• Ask us to restrict its use while a complaint is resolved (restriction).
• Object to us continuing to process it (objection).
• Ask for a copy of your data in a format you can take elsewhere (portability).
• Withdraw at any time the consent you gave us, without that affecting what was processed before (withdrawal; see point 4).

To exercise any of these rights, write to laura@psicodiversa.es explaining what you would like to request.

If you believe we have not handled your data properly, you can also complain to the Spanish Data Protection Agency — Agencia Española de Protección de Datos, the supervisory authority in Spain (aepd.es).

11. Under-18s

This form is not intended for anyone under 18. If you are under 18, you need the express consent of your parent or legal guardian before giving us any data. More detail in the legal notice.

12. Changes to this policy

We may update this policy if the law changes or if the way we handle your data changes. When that happens, we will update the date shown at the top of this page; if the change is significant, we will give visible notice before it takes effect.

This is a courtesy translation. In the event of any discrepancy, the Spanish version of this document prevails.