Privacy Policy

The controller of your personal data is:

• Identity: [PLACEHOLDER: company name]
• NIF/CIF: [PLACEHOLDER: tax identification number]
• Address: Av. Miguel de Cervantes, Edificio Albatros V, Local 11/12, 29660 Marbella, Spain
• Email: [PLACEHOLDER: privacy contact email]
• Phone: [PLACEHOLDER: contact phone]

We process your personal data for the following purposes:

• Managing your booking and the prepayment of the skin-analysis service (payment processed through Stripe).
• Sending booking confirmations and appointment reminders by email (delivered through Resend).
• Website analytics — only if you have expressly accepted analytics cookies (Google Analytics 4).

Data derived from the skin analysis is considered health data under Article 9 of the GDPR. We process it only with your explicit consent, which is requested through a dedicated checkbox — unticked by default — during the booking process. Your consent is recorded with a timestamp.

You may withdraw this consent at any time by writing to [PLACEHOLDER: privacy contact email]. Withdrawal does not affect the lawfulness of processing carried out before it.

• Performance of a contract (Art. 6.1.b GDPR): managing your booking and payment.
• Explicit consent (Art. 6.1.a and 9.2.a GDPR): processing of skin-analysis data and analytics cookies.
• Legitimate interest (Art. 6.1.f GDPR): maintaining the security and proper functioning of the website.

Your data may be processed by the following providers acting as data processors:

• Stripe, Inc. — payment processing.
• Resend — transactional email delivery.
• Google (Google Analytics 4) — website analytics, only with your consent.

We never sell or share your booking or skin-analysis data with Meta (Facebook/Instagram), Google, or any other advertising network, regardless of any advertising we run.

We use Google Ads conversion tracking, with your consent, to know whether a booking came from an ad — only that a booking happened is shared, never skin-analysis or health data. No advertising pixels beyond this operate on this website today. We plan to run Facebook/Instagram advertising in the future — if and when that happens, this policy will be updated first and the same rule applies: only standard marketing/conversion data, never health data, and only after you consent via the cookie banner.

Booking data is retained for 90 days after the appointment date in order to manage follow-up and the redemption of the analysis fee; after that period it is deleted or irreversibly anonymised. Invoicing and accounting data is kept for the periods required by Spanish tax law.

You may exercise the following rights at any time by writing to [PLACEHOLDER: privacy contact email]:

• Access to your personal data.
• Rectification of inaccurate data.
• Erasure (right to be forgotten).
• Objection to processing.
• Data portability.
• Restriction of processing.
• Withdrawal of consent at any time.

If you believe your data-protection rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD), www.aepd.es.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.