PRIVACY AND PERSONAL DATA PROTECTION POLICY OF PSICOTEDDY

1. INTRODUCTION

What is this policy about?
This document explains how PsicoTeddy collects, uses, stores and protects your personal data to achieve the purposes described herein, in compliance with:

• General Data Protection Regulation (GDPR) — European Union
• Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPD-GDD) — Spain
• Children's Online Privacy Protection Act (COPPA) — United States
• Law 29733 on Personal Data Protection — Peru
• California Consumer Privacy Act (CCPA/CPRA) — California, USA
• Law 34/2002 on Information Society Services (LSSI-CE) — Spain
• Apple App Store and Google Play Store policies
• European Medical Device Regulation (MDR 2017/745) — clarification: PsicoTeddy is NOT a medical device

What is personal data?
Personal data is any information that can be used to identify you, either directly or indirectly. This includes:

• Identification data: name, surname, email
• Technical data: IP address, device type, operating system
• Tracking technologies: cookies, pixels, unique identifiers
• User activity: usage patterns, interactions, searches
• Sensitive data: emotional content, responses to assessments, mental health indicators

2. CONTACT INFORMATION

3. TYPES OF DATA COLLECTED

Among the types of personal data collected by PsicoTeddy, either directly or through third parties, are:

4. DATA PROCESSING MODALITY AND LOCATION

Processing Methods:
PsicoTeddy adopts appropriate technical and organizational security measures to prevent unauthorized access, improper disclosure, alteration or unauthorized destruction.

Processing Location:
Data is processed on servers located in the Republic of Peru, European Union (to comply with GDPR) and internationally certified data centers.

5. DETAILED INFORMATION ON DATA PROCESSING

General Purposes:
Your personal data is collected for PsicoTeddy service provision, guidance analysis of emotional state (not diagnosis), improvement and optimization of the platform, detection and prevention of serious risks, and compliance with legal obligations.

6. LEGAL BASIS FOR PROCESSING

PsicoTeddy processes personal data according to the following legal bases:

• Consent: When you have given explicit consent for specific treatments
• Legal Obligation Compliance: Compliance with legal requirements of the operating country
• Contract Execution: Service provision according to Terms and Conditions
• Legitimate Interests: Platform improvement and security
• Protection of Vital Interests: Detection and referral in case of serious imminent harm risk

7. SPECIFIC PROCESSING PURPOSES

• Service Provision: Create and maintain your account, provide access to functionalities
• Platform Improvement: Usage and pattern analysis, interface optimization
• Security and Prevention: Fraud or abuse detection, security risk analysis
• Communication: Response to user inquiries, notifications about changes
• Legal Compliance: Internal audits, response to authority requests

8. VITAL SAFETY AND EMERGENCY REFERRAL

9. RETENTION PERIOD

General Rule:
Unless otherwise indicated, personal data is processed and retained for the time necessary for the purposes for which it was collected.

Specific Periods:

• Identification Data: While the account is active, 30 days after deletion request
• Sensitive (Emotional) Data: While the account is active, deleted when closing account
• Right to be Forgotten: Once the retention period ends, your data is deleted or anonymized

10. DATA SHARING

General Policy:
PsicoTeddy does NOT sell personal data to third parties for commercial purposes.

Permitted Sharing:

• With Authorized Processors: Cloud hosting providers, security services
• Regulatory Compliance: Judicial authorities (with legal order), data protection authorities
• Emergency Services: When vital risk is detected, limited information may be provided

11. YOUR RIGHTS UNDER GDPR

According to the General Data Protection Regulation (GDPR), you have the following rights:

• Right to Withdraw Consent: You can withdraw consent at any time
• Right to Object: You can object to the processing of your data
• Right of Access: You can request access to your data and obtain a copy
• Right to Rectification: You can request correction of inaccurate data
• Right to Restriction: You can request restriction of processing
• Right to Erasure (Right to be Forgotten): You can request deletion of your data
• Right to Data Portability: Receive data in a structured, commonly used and machine-readable format
• Right to Lodge a Complaint: With the data protection authority of your country

How to Exercise Your Rights:
You can communicate any request to: 📧 support@psicoteddy.online

12. ADDITIONAL INFORMATION BY JURISDICTION

• European Union Residents (GDPR): You have all the rights described above
• California, USA Residents (CCPA/CPRA): Right to know, access, deletion, opt-out
• Peru Residents (Law 29733): Right to information, access, rectification, updating or cancellation
• Switzerland Residents: Right of access, rectification, opposition, portability

13. SPECIAL PROTECTION OF CHILDREN'S DATA

CHILDREN UNDER 13 (COPPA):

PsicoTeddy does not knowingly collect personal information from children under 13. If we discover that we have collected data from a child under 13 without verifiable parental consent, we will delete that information immediately.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, contact us at: support@psicoteddy.online

USERS AGED 13 TO 17 (GDPR / LOPD-GDD):

For users under 18, data processing is carried out under the legal basis of parental consent granted during the registration process.

• In Spain: pursuant to the LOPD-GDD, the age of digital consent is 14. For 13-year-old users in Spain, express and verifiable parental consent is required.
• In the European Union: pursuant to Art. 8 of the GDPR, for users aged 13 to 15 in countries where the consent age is 16, additional safeguards apply.

Parents or guardians of minor users may exercise the rights of access, rectification, erasure, and portability on behalf of their children by contacting: support@psicoteddy.online

14. BIOMETRIC DATA — FACIAL AND FINGERPRINT AUTHENTICATION

PsicoTeddy optionally offers authentication via Face ID and Touch ID (biometric data) to protect access to the application.

Processing: Biometric recognition is processed EXCLUSIVELY on the user's device via Apple's native APIs (LocalAuthentication). PsicoTeddy does NOT access, store, transmit, or process biometric data on its servers.

Legal basis: Explicit user consent (Art. 9.2.a GDPR). The user may enable or disable this feature at any time from Profile > Privacy and Security.

Special category: Biometric data is a special category of personal data under Art. 9 of the GDPR and receives the highest level of protection.

15. DATA PROCESSORS

Pursuant to Art. 28 of the GDPR, PsicoTeddy works with the following data processors that may access personal data in the context of providing the service:

International transfers: Data transfers to providers outside the European Economic Area (EEA) are carried out with appropriate safeguards through Standard Contractual Clauses (SCC) approved by the European Commission, pursuant to Art. 46 of the GDPR.

PsicoTeddy does NOT sell personal data to third parties for commercial purposes.

16. COOKIES AND TRACKING TECHNOLOGIES (WEB VERSION)

The web version of PsicoTeddy (app.psicoteddy.online) uses the following technologies:

Essential cookies (no consent required):

• User session: keeps the session active during use.
• Language and theme preferences: remembers user settings.

Analytics cookies (consent required):

• Firebase Analytics: anonymous usage analysis to improve the service.

The user may manage or reject non-essential cookies through the cookie banner shown on first access or from their browser settings. In accordance with the Spanish LSSI-CE and the EU ePrivacy Directive, the use of non-essential cookies requires prior, informed consent.

17. PRIVACY CONTACT