Privacy policy

This English version is provided for information purposes. In the event of any discrepancy, the Spanish version shall prevail.

I. Privacy and data protection policy

In accordance with the legislation in force, Ángeles María Rodríguez Gómez (hereinafter, also the Website) undertakes to adopt the technical and organisational measures necessary to ensure a level of security appropriate to the risk of the data collected.

Laws incorporated in this privacy policy

This policy is adapted to the Spanish and European legislation in force on the protection of personal data on the Internet:

• Regulation (EU) 2016/679 of 27 April 2016, the General Data Protection Regulation — GDPR (RGPD).
• Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPD-GDD).
• Spanish Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).

Identity of the data controller

The controller of the personal data collected on angierodriguez.es is Ángeles María Rodríguez Gómez, holder of Spanish tax identification number (NIF) 75156242Q (hereinafter, the Data Controller). Her contact details are:

• Address: Calle Isidoro Macabich, 14, 2º izquierda, 07840 Santa Eulària des Riu (Ibiza, Illes Balears)
• Telephone: 653 86 19 50
• Email: [email protected]

Record of processing activities

In compliance with the GDPR and the LOPD-GDD, the personal data collected through the Website’s forms and contact channels will be recorded and processed in order to manage the appointments requested and to respond to the User’s enquiries. A record of processing activities is kept which specifies, according to their purposes, the processing activities carried out and the other circumstances established in the GDPR.

Principles applicable to the processing

The processing of the User’s personal data shall be subject to the principles set out in Article 5 of the GDPR and Article 4 et seq. of the LOPD-GDD:

• Lawfulness, fairness and transparency: the User will always be informed transparently of the purposes for which the data are collected.
• Purpose limitation: data will be collected for specified, explicit and legitimate purposes.
• Data minimisation: only the data that are strictly necessary will be collected.
• Accuracy: data must be accurate and kept up to date.
• Storage limitation: data will only be kept for as long as necessary for the purposes of the processing.
• Integrity and confidentiality: data will be processed in a manner that ensures their security and confidentiality.
• Accountability: the Data Controller will ensure compliance with the above principles.

Categories of personal data

Only identification and contact data, and appointment data, are processed through the Website:

• Appointment requests: name, telephone, email, chosen speciality, location, date and time, and any optional comment the User wishes to add.
• Newsletter: the User’s email address, the date of subscription and the page from which they subscribed.
• Companies and hotels: name of the company or accommodation, contact person, email, telephone and any information provided about their needs.
• Work with us: name, email, telephone, speciality or profession, preferred centre, the cover letter the applicant chooses to write and the curriculum vitae (CV) they attach.
• Contact by email, telephone or WhatsApp: the data the User provides when writing or calling.
• Technical data: the IP address from which the request is sent (to limit abusive submissions) and, if the User consents, browsing data obtained through cookies (see the Cookie policy).

The Website does not request special categories of data (Article 9 of the GDPR), such as health data. Owing to the nature of the therapies, the User may decide to voluntarily disclose information about their health or personal situation, either in the comment field of the request or during the sessions. Such information will be processed with their explicit consent, in the strictest confidence and solely in order to prepare and carry out their support. Users are advised not to include more information in the form than necessary.

Purposes and legal basis for the processing

• Managing appointment requests: recording the request, reserving the slot, confirming or declining it, and sending the related email notifications (acknowledgement of receipt, confirmation, cancellation). Legal basis: the taking of pre-contractual steps and the performance of the service relationship requested by the User (Article 6(1)(b) GDPR).
• Sending the newsletter (wellbeing tips, seasonal news and discounts) to those who subscribe. Legal basis: the User’s consent when subscribing (Article 6(1)(a)). Every email includes a link to unsubscribe at any time.
• Responding to enquiries from companies and hotels and, if requested, preparing a proposal for collaboration or for health and wellbeing packages. Legal basis: pre-contractual steps (Article 6(1)(b)).
• Assessing applications received through «Work with us» for current or future recruitment processes. Legal basis: the applicant’s consent when submitting it (Article 6(1)(a)).
• Responding to enquiries received by email, telephone or WhatsApp. Legal basis: the User’s consent when making contact (Article 6(1)(a)) and pre-contractual steps (Article 6(1)(b)).
• Protecting the forms against automated and abusive submissions (Google reCAPTCHA and a limit on submissions per IP address). Legal basis: legitimate interest in the security of the Website (Article 6(1)(f)).
• Compiling anonymous usage statistics for the Website through Google Analytics, only if the User accepts analytics cookies. Legal basis: consent (Article 6(1)(a)).
• Complying with legal, tax and accounting obligations arising from the services provided. Legal basis: legal obligation (Article 6(1)(c)).

Commercial communications (the newsletter) are only sent to those who have expressly subscribed, and the data are not used for profiling that produces legal effects for the User. The User may withdraw their consent at any time, as easily as they gave it, without affecting the lawfulness of processing carried out before its withdrawal.

Retention periods

Data from appointment requests will be kept for 18 months from the date of the appointment, or until the User requests their erasure. Data needed to address any potential legal liabilities will be kept blocked for the periods required by law. Enquiries received by email or WhatsApp, and those from companies, will be kept for as long as necessary to deal with them. Newsletter email addresses will be kept until the User unsubscribes. Applications and their CVs will be kept for a maximum of 1 year, unless the applicant requests their erasure sooner.

Recipients of the data

Personal data are not disclosed to third parties, except where required by law. To provide the service, the Data Controller relies on the following providers, who act as data processors and only access the data to the extent necessary:

• Hostinger International Ltd.: hosting of the Website and of the appointments database, and the email service used to send notifications.
• Google Ireland Ltd. / Google LLC: Google reCAPTCHA (form protection), Google Tag Manager and Google Analytics (only if the User accepts analytics cookies) and Google Search Console (aggregated search data, with no personal data of the User).
• Meta Platforms Ireland Ltd.: WhatsApp, if the User decides to write through that channel, and Instagram, if they visit the linked profile.
• Kaizen Studio: design, development and technical maintenance of the Website.

Some of these providers may process data outside the European Economic Area. In such cases, the transfer is based on adequacy decisions of the European Commission (such as the EU-U.S. Data Privacy Framework) or on standard contractual clauses. The User may request further information using the contact details provided.

Personal data of minors

In accordance with Article 8 of the GDPR and Article 7 of the LOPD-GDD, only persons over the age of 14 may give their consent to the processing of their data. Appointments for minors under 18 must be requested by their father, mother or legal guardian.

Secrecy and security of the data

The technical and organisational measures necessary to ensure the security of the data and to prevent their destruction, loss, alteration or unauthorised access are adopted. The Website has an SSL certificate, so that the transmission of data between the browser and the server is encrypted. The appointments database is stored outside the public part of the server. Data will be treated as confidential and the User will be notified, without undue delay, of any security breach likely to result in a high risk to their rights and freedoms.

Rights of the User

The User may exercise the following rights recognised in the GDPR and the LOPD-GDD before the Data Controller:

• Right of access: to know whether their data are being processed and to obtain information about them.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure («right to be forgotten»): to obtain the erasure of their data when they are no longer necessary.
• Right to restriction of processing in the cases provided for by law.
• Right to data portability: to receive their data in a structured, commonly used and machine-readable format.
• Right to object to the processing of their data.
• Right not to be subject to automated decision-making, including profiling.

To exercise these rights, the User may write, quoting the reference «RGPD-angierodriguez.es» and stating their name and specific request, to [email protected] or to the postal address Calle Isidoro Macabich, 14, 2º izquierda, 07840 Santa Eulària des Riu (Ibiza, Illes Balears). A document proving their identity may be requested.

Links to third-party websites

The Website includes links to third-party pages (Instagram, WhatsApp, Google Maps) that are not operated by the Data Controller. Their owners have their own privacy policies and are themselves responsible for their practices.

Complaints to the supervisory authority

If the User considers that there is a problem or an infringement of the regulations in the processing of their data, they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).

II. Acceptance of and changes to this policy

In order to send an appointment request, subscribe to the newsletter or submit the Companies, Hotels and Work with us forms, the User must have read and accepted this Privacy Policy by ticking the corresponding box on the form. The Data Controller reserves the right to amend it in response to legislative or case-law changes or changes in the criteria of the Spanish Data Protection Agency. Users are advised to check this page periodically.