Privacy Policy

Last updated: 17 October 2026

This page explains what personal data Catalunya Oculta processes, why, for how long and what you can do about it. If anything is unclear, email us at hola@catalunyaoculta.com.

Who is responsible

• Data controller: Marc Rodríguez Limpangog, author of Catalunya Oculta, who writes under the name “Marc RL”.
• Tax ID (NIF): 39381592A
• Email for any privacy matter: hola@catalunyaoculta.com
• Data protection officer: none. Under Art. 37 GDPR and Art. 34 of Spain’s Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD), a personal blog like this one does not have to appoint one.

What data we process and why

Contact form and email

• Data: name, email address, subject and message. If you tell us a story, also whatever you include in it.
• Why: to reply to you and, if you suggest a legend or something that happened, to look into it. If it becomes a chronicle, we will only give your name if you give us written permission.
• Legal basis: your consent, which you give by sending us the message (Art. 6(1)(a) GDPR). The tick box on the form is there to record that you have read this information.
• Where it is kept: the website does not store messages. They arrive by email in the hola@catalunyaoculta.com inbox, which is hosted by SW Hosting. Before that, the form goes through two spam filters: Cloudflare Turnstile and Akismet (see “Spam protection”).
• How long: 12 months from your last message. If we publish your story with your name, we keep the message in which you give us permission for as long as the chronicle stays published.

If you tell us about other people (a neighbour, a grandmother, the former owner of a farmhouse), only tell us what the story needs. We do not publish data that could identify living people without their permission.

Comments

• Data: name, email address, website (if you give one), the comment, the date, the IP address and the browser you comment from.
• What is published: the name, the website, the comment and the date. The email address and the IP address are never shown.
• Why: to publish and moderate comments.
• Legal basis: your consent when you submit the comment (Art. 6(1)(a) GDPR). The spam filter and the logging of the IP address are based on our legitimate interest in protecting the website from abuse (Art. 6(1)(f) GDPR).
• Anti-spam: every comment goes through Akismet, from Automattic, which receives the comment, name, email address, website, IP address and browser in order to decide whether it is spam.
• Avatar: WordPress creates a code (hash) of your email address and looks it up on Gravatar, also from Automattic, to show your profile picture if you have one. The lookup is made by our server, not by your browser.
• How long: for as long as the comment stays published. You can ask us to delete it at any time. Comments that Akismet marks as spam are deleted automatically after 15 days.

Newsletter

• Data: name, email address, language, sign-up date and the IP address you subscribed from.
• Why: to let you know by email when we publish a new chronicle. Nothing else.
• Legal basis: your consent, which you give by ticking the box on the form (Art. 6(1)(a) GDPR and Art. 21 of Spain’s Law 34/2002 on Information Society Services and E-commerce, LSSI-CE).
• Signing up: you are subscribed as soon as you send the form, with nothing to confirm. If someone has signed you up without your knowledge, unsubscribe using the link in any newsletter or write to us and we will delete the address.
• How it is sent: the list is stored on our own website (using the plugins The Newsletter Plugin and MailPoet). Newsletters go out through MailPoet’s sending service, from Automattic, which receives your name and email address only to deliver each newsletter.
• Tracking: we do not measure whether you open the emails or which links you click. The newsletters contain no tracking pixels and no tracked links.
• Unsubscribing: every email has a link to unsubscribe in one click. You can also ask us by email.
• How long: until you unsubscribe. After that your address stays marked as unsubscribed, so that we do not write to you again by mistake, and we delete it completely if you ask us to. Keeping that flag is our legitimate interest in respecting your unsubscription (Art. 6(1)(f) GDPR).

“Light a candle”

At the end of each chronicle you can light a candle for it. It is an anonymous counter: we do not ask for your name or email address.

• To avoid counting the same candle twice in one day, the server calculates an irreversible code (SHA-256 hash) from your IP address, the chronicle, the date and a secret key. It stores only that code, never the IP address. The code expires after 24 hours and is deleted at the next automatic clean-up. Because the date is part of the calculation, today’s code cannot be linked to tomorrow’s.
• Your browser remembers that you lit it (local storage coc-react:), so that it shows as lit if you come back. That information never leaves your device.
• Legal basis: legitimate interest in keeping the counter reliable (Art. 6(1)(f) GDPR). The processing is minimal and lasts one day.

Narrations, music and player

The audio files are on our server. Listening to them sends no data to third parties. The player stores in your browser the playback speed, the point where you stopped each narration and what was playing, so that you can carry on when you change page. That information never leaves your device. The details are in the Cookie policy.

The Atlas

The Atlas map loads entirely from our own server: the software that draws it, the base map, the terrain and the fonts. Your browser does not connect to any outside map service and the map uses no cookies. It only remembers, on your device, that you have already seen the opening animation.

Browsing and security

• Data: when you visit the website, the server logs your IP address, the page requested, the date and time, and your browser. The website’s security system also logs the IP addresses that try to get into the admin panel without permission.
• Why: to make the website work, and to detect and block attacks.
• Legal basis: legitimate interest in keeping the website secure (Art. 6(1)(f) and Recital 49 GDPR).
• How long: only as long as needed to detect and investigate security problems. Old logs are deleted automatically.

Spam protection

The contact form uses Cloudflare Turnstile, which checks that a person is writing without making you solve puzzles. To do this, Cloudflare receives technical signals from your browser: the IP address, the browser type, connection data and the website where it is being used. Cloudflare states that it does not use them to identify you or to build profiles; it processes them on our behalf and, for its own purposes, to improve bot detection. More information in the Turnstile privacy addendum (opens in a new window). Turnstile only loads on the contact page.

Messages sent through the form and comments also go through Akismet, as explained above.

Legal basis: legitimate interest in preventing spam and attacks (Art. 6(1)(f) GDPR).

Visitor statistics (Google Analytics), only if you accept them

• Data: the pages you visit and for how long, the website you came from, device type and browser, language, approximate city or country, and a random identifier stored in a cookie.
• Why: to know which chronicles are read, as overall figures. We do not know who you are.
• Legal basis: your consent in the cookie banner (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). If you do not accept, Google Analytics does not load.
• IP address: for visitors from the European Union, Google Analytics uses the IP address only to work out the approximate location, on European servers, and then discards it without storing it.
• What we do not do: we do not turn on Google signals or ad personalisation, and we block Google’s advertising cookies. The website has no ads.
• How long: Google keeps the data from each visit for a maximum of 14 months. The cookies last up to 2 years, or until you withdraw your consent.
• Changing your mind: you can withdraw your consent at any time with the cookie button in the corner of the screen or from the Cookie policy.

Your cookie choice

Your choice about statistics cookies is stored only in your browser (local storage coc-consent), with the date you made it. It is not sent to our server or to anyone else. After 24 months, or if we start using something new that needs your permission, we ask you again.

Social networks and share buttons

The buttons for sharing a chronicle (WhatsApp, X, Facebook, email or copy link) are ordinary links: the social network receives nothing until you tap or click one. If you follow us or write to us on Bluesky, Bluesky’s privacy policy also applies.

Artificial intelligence

The narrations of the chronicles are generated from the published text with synthetic voices, using artificial intelligence. We do this ourselves when we prepare each audio file, and none of your data is involved. We do not use your messages, comments or browsing data to train or feed artificial intelligence systems, we do not make automated decisions about you and we do not build profiles. How we use AI in our content is explained in the Legal notice.

Who else processes your data

These providers process data on our behalf, under a contract that obliges them to use it only to provide their service to us (Art. 28 GDPR):

• SW Hosting & Communications Technologies, S.L. (Girona): hosting for the website, the database and email, on servers in Spain.
• Google Ireland Limited (Dublin): visitor statistics, only if you accept them.
• Cloudflare, Inc. (San Francisco, USA): Turnstile, spam protection for the contact form. To improve Turnstile, Cloudflare also processes some of that data on its own account, as a controller.
• Aut O’Mattic A8C Ireland Ltd. (Automattic, Dublin): Akismet, the spam filter for comments and forms; Gravatar, avatars for comments; and MailPoet’s sending service, for the newsletter.

We do not sell data or give it to anyone else, unless the law requires us to (for example, a court order).

Data outside the European Union

• Google: Google LLC may process Google Analytics data in the United States. It is certified under the EU-U.S. Data Privacy Framework (its listing (opens in a new window)), which the European Commission found adequate in Implementing Decision (EU) 2023/1795 (Art. 45 GDPR). Where the Framework does not apply, Google’s contract includes standard contractual clauses (Art. 46(2)(c) GDPR).
• Cloudflare: Cloudflare, Inc. is certified under the same Data Privacy Framework, and its data processing agreement includes standard contractual clauses.
• Automattic: Akismet, Gravatar and MailPoet’s sending service may process data in the United States, at Automattic Inc. That transfer relies on standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR); Automattic’s Data Privacy Framework certification does not cover these services.

Children

To comment, write to us or subscribe to the newsletter, you must be at least 14 years old (Art. 7 LOPDGDD). If you are younger, ask your mother, father or guardian to do it for you. If we find data from someone under 14 that was sent without that permission, we will delete it.

Your rights

• Access: find out what data we hold about you.
• Rectification: correct any data that is wrong.
• Erasure: have your data deleted.
• Objection: have us stop using your data when the legal basis is our legitimate interest.
• Restriction: have us keep your data without using it while a complaint is being resolved.
• Portability: receive the data you gave us in a commonly used format.
• Withdraw your consent at any time, as easily as you gave it (Art. 7(3) GDPR). Anything done up to that point remains valid.

Email hola@catalunyaoculta.com with the subject “Data protection” and tell us what you are asking for. We will only ask you for information to confirm your identity if there are reasonable doubts. We will reply within one month; in complex cases the law allows us to extend this by two further months, telling you beforehand (Art. 12(3) GDPR).

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es (opens in a new window) (Art. 77 GDPR). It would help us if you told us first, in case we can put it right.

Security

The website only works over an encrypted connection (HTTPS), the admin panel has measures against unauthorised access and the software is updated regularly. No system is foolproof: if there were a breach that put your data at risk, we would notify the AEPD within 72 hours and, if the risk were high, we would also tell you (Arts. 33 and 34 GDPR).

Changes to this policy

If we change anything important, you will see it on this page with the new update date. If it affects the newsletter, we will also mention it in the next newsletter.