Privacy policy

1. Data controller

2. What data we process and where it comes from

This website has no contact or registration forms. The personal data we process comes solely from communication you initiate voluntarily:

a) Booking and communication by WhatsApp or phone

• Your name, or whatever name you give in the conversation
• Telephone number
• The address of the accommodation where the service will be delivered
• Date, time and type of treatment requested
• Health information you voluntarily share that is relevant to the safety of the session (for example injuries, pregnancy or recent surgery)

b) Email

• Your email address and the content of your message

c) Payment

• Card payments are processed through an external gateway. We neither store nor have access to your full card details, which are handled directly by the payment provider.

3. Special category data (health)

4. Purpose and legal basis

We do not send marketing communications unless you give us separate, express consent, which you may withdraw at any time.

5. Retention periods

• Enquiries that do not lead to a booking: deleted within a maximum of 12 months.
• Data relating to services delivered: for the duration of the relationship and then blocked for the applicable statutory limitation periods (up to 6 years for accounting and tax obligations under Spanish commercial and tax law).
• Health data: deleted once the session has taken place and the period for handling any claim has passed.

6. Recipients

Your data may be disclosed to:

• The independent therapist delivering the service, with only the information strictly necessary (name, address, time, treatment and relevant health notes).
• Technology providers acting as processors: web hosting, payment gateway and messaging service.
• Public authorities, where legally required.

International transfers

Some providers are located outside the European Economic Area or belong to groups headquartered in third countries. Where this happens, transfers rely on the Standard Contractual Clauses approved by the European Commission or on current adequacy decisions. The main ones are:

7. Your rights

You may exercise the following rights at any time by writing to charliebrawnzz@gmail.com, stating the right you are exercising and attaching proof of identity:

• Access: find out what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data.
• Objection: object to certain processing.
• Restriction: ask us to restrict processing.
• Portability: receive your data in a structured format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

We will respond within one month. If you believe your request has not been handled properly, you may complain to the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — aepd.es) or to the supervisory authority in your country of residence.

8. Security

We apply appropriate technical and organisational measures to protect your data against destruction, loss, alteration or unauthorised access, taking into account the state of the art and the nature of the data processed. The website is served entirely over encrypted HTTPS.

9. Minors

Our services are intended for people aged 18 and over. We do not knowingly collect data from minors. Booking a service for a minor requires the presence and consent of their parent or legal guardian.

10. Changes to this policy

We may update this policy to reflect legal changes or changes in how the service is delivered. The version in force is always the one published on this page, with its update date.