Privacy Policy.

Last updated: 27 April 2026

This policy explains how neurodynamictraining.com (the "Site") collects, uses, and protects your personal data. The Site is a non-commercial, open-access project. There is no advertising. We use Google Analytics 4 with consent — to know roughly how many people visit — and Google Search Console to see how the Site appears in Google search. Nothing else. The legal framework is the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).

Structure of this policy:

1. 1. Who is responsible (the "controller")
2. 2. Your rights
3. 3. What data we process — and why
4. 4. What we do not do
5. 5. International data transfers
6. 6. How long we keep data
7. 7. Children
8. 8. Changes to this policy
9. 9. How to contact us

The data controller in the sense of Art. 4(7) GDPR is:

Email: eduard@neurodynamictraining.com

No Data Protection Officer has been appointed; the processing activities of the Site do not trigger the requirements of Art. 37 GDPR. You can raise any data-protection matter directly with the address above.

Under the GDPR you have the following rights at any time, free of charge:

• — Access — confirmation of whether we process data about you, a copy of that data, and information about the processing (Art. 15 GDPR).
• — Rectification — correction of inaccurate or incomplete data (Art. 16 GDPR).
• — Erasure — deletion of your data where legally permitted (Art. 17 GDPR).
• — Restriction of processing — in the situations listed in Art. 18 GDPR.
• — Data portability — receipt of your data in a machine-readable format (Art. 20 GDPR).
• — Objection — to processing based on our legitimate interests (Art. 21 GDPR).
• — Complaint — to a supervisory authority, in particular the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) (Art. 77 GDPR).

To exercise any of these rights, write to eduard@neurodynamictraining.com. We respond within one month.

The Site is a static, content-only website with two browser-based training tools that run entirely on your device. No data you generate while using the tools (sessions, settings, audio, visuals) leaves your browser. Nothing is recorded, transmitted, or stored on our servers.

The only data flow that exists is the technical minimum required to serve a web page:

3.1 Server logs (hosting provider)

When you load the Site, your browser transmits technical data to our hosting provider so the page can be delivered. These server logs may include: IP address, date and time of the request, browser type and version, operating system, referring URL, and the path requested.

• — Purpose: delivering the Site, maintaining stability and security, preventing abuse.
• — Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a functional, secure website.
• — Retention: log entries are kept by the hosting provider for a short period (typically 7 days or less) and then deleted automatically.
• — Processor: a static hosting provider (e.g. Netlify or Cloudflare Pages), bound by a standard data processing agreement under Art. 28 GDPR.

3.2 Contact by email

If you write to us at eduard@neurodynamictraining.com, we process the information you provide (your email address and the content of your message) only in order to answer you.

• — Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).
• — Retention: for as long as your inquiry is open, and thereafter only if required by law.

3.3 Web analytics — Google Analytics 4 (consent-based)

We use Google Analytics 4 (GA4), operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand roughly how many people visit the Site and which pages they read. GA4 is loaded with Google Consent Mode v2 in "denied" state by default — no analytics cookies are written and no measurements are sent until you click Accept on the cookie banner.

• — What is collected (only if you consent): pseudonymous usage data — pages viewed, session duration, device category, approximate geography, referrer.
• — IP handling: GA4 anonymises IP addresses and discards them after deriving an approximate region. We have not enabled any advertising features, audience export, retargeting, or cross-device tracking.
• — Purpose: understanding traffic to improve content and navigation.
• — Legal basis: Art. 6(1)(a) GDPR (your consent). You can withdraw consent at any time by clearing this site's data in your browser; from that point forward, no measurements are sent.
• — Retention: GA4 default settings (typically up to 14 months for user-level data, then deletion).
• — Processor agreement: a Data Processing Addendum under Art. 28 GDPR is in place with Google.

3.4 Google Search Console

We use Google Search Console to see how the Site appears in Google's search results. Search Console processes aggregated, anonymous data about the Site — e.g. queries that led to the Site, click-through rates, indexing status. It does not set cookies on visitors and does not identify individual users.

• — Legal basis: Art. 6(1)(f) GDPR (legitimate interest in maintaining a discoverable website).

3.5 Cookies

The Site uses one functional cookie / localStorage entry to remember your cookie-banner choice (so we don't show the banner on every visit), and the GA4 cookies described in 3.3 only after you have accepted. There are no other cookies.

For full clarity:

• — No advertising. No ad networks, no retargeting, no affiliate tracking, no sponsored content. The GA4 advertising features are explicitly disabled.
• — No third-party scripts beyond Google Analytics (consent-only), Google Search Console (no visitor cookies), the static hosting, and a self-hosted web font (Inter, from rsms.me/inter).
• — No accounts, no logins, no profiles. The training tools require nothing. You don't sign up. You don't sign in.
• — No newsletter, no email collection. Email us if you want to; we don't ask.
• — No fingerprinting. No use of canvas, font, or device characteristics to identify you.
• — No data sales, no data sharing beyond what GA4 processes on our behalf as our processor under a DPA.

This site is a small, free, open-access tool, built and shared as a contribution to public health. The privacy practice is simple: we collect the minimum we need to know whether anyone is reading.

The hosting provider may serve pages from servers outside the European Economic Area, including the United States. In that case, the transfer is safeguarded by an adequacy decision under Art. 45 GDPR (for U.S. entities self-certified under the EU-U.S. Data Privacy Framework) and/or by the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR.

You can request a copy of the safeguards for a specific transfer at any time.

Unless a longer retention period is required by law (e.g. tax-related retention under Spanish law) or stated elsewhere in this policy, personal data is deleted as soon as the purpose for which it was collected no longer applies. In practice this means: server logs are rotated within days; emails are kept only as long as the conversation is open.

The Site is not directed to children under 14. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it promptly.

This policy may be updated to reflect changes in the Site or in the law. The "Last updated" date at the top of this page shows when the current version took effect.

For any question about this policy or about how we process your data, write to:

eduard@neurodynamictraining.com

We take your privacy seriously and will reply within one month under Art. 12(3) GDPR.