Privacy policy
Last updated: 25 August 2026
This policy explains what personal data we process when you use https://www.masajecastelldefels.com, for what purpose, on what legal basis, and what rights you have. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller:
- Joan Jiménez Rigat
- Spanish tax ID (NIF):
- 44422775T
- Address:
- Avenida 306, nº 9, 1º 1ª, 08860 Castelldefels, Barcelona
- Phone:
- +34 642 25 15 49
- Email:
- info@masajecastelldefels.com
We have not appointed a data protection officer, as none of the circumstances in Article 37 GDPR apply.
2. What data we process
We only process the data you give us or that is generated when you use the site:
- Appointment booking: name, email address, phone number, chosen service, date and time, and any notes you choose to add.
- Contact form: name, email address, phone number (optional), subject and message.
- Online payment: we neither see nor store your card number. Stripe processes the payment and we keep only the transaction reference, the amount, the payment status and the email address the receipt is sent to.
- Client record and session notes: if you are a client, the therapist may keep a visit history and notes about the session (for example, discomfort level before and after) in order to provide appropriate continuity of treatment.
- Technical data: IP address and basic request data, logged temporarily for security reasons and to limit how often forms can be submitted.
Session notes may reflect information about your physical condition. These count as special category data (Article 9 GDPR); they are recorded only with your explicit consent given at the studio, are accessible only to the therapist treating you, and are not disclosed to anyone.
Please do not include health information in the booking notes field or in the contact form. If you need to tell us something of that kind, it is better to do so at the studio or by phone.
3. Why we use it and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing, confirming and reminding you of your booking | Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) | For the duration of the relationship and then the applicable legal period |
| Taking the deposit or the service payment | Performance of the contract (Art. 6(1)(b)) and compliance with tax and accounting obligations (Art. 6(1)(c)) | 5 years; documents with tax effects, 6 years (Art. 30 Spanish Commercial Code) |
| Answering your enquiries through the contact form | Consent (Art. 6(1)(a)) and pre-contractual steps (Art. 6(1)(b)) | 1 year from the last contact, unless it becomes a client relationship |
| Keeping your visit history and session notes | Explicit consent (Art. 9(2)(a) GDPR) | While you remain a client and until you withdraw consent |
| Issuing invoices and meeting legal obligations | Legal obligation (Art. 6(1)(c)) | The periods laid down by tax legislation |
| Keeping the site secure and preventing form abuse | Legitimate interest (Art. 6(1)(f)) | Technical logs: 30 days maximum |
We do not send marketing communications or newsletters. If we ever start doing so, we would ask for your prior consent and you could withdraw it at any time.
We do not carry out automated decision-making or profiling with legal effects on you.
4. Who else has access to your data
We do not sell or share your data. To provide the service we rely on suppliers acting as processors, under contracts signed in accordance with Article 28 GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Stripe Payments Europe, Ltd. | Card payment processing and receipts | Ireland (EU), with transfers to the Stripe group in the USA |
| Resend, Inc. | Sending confirmation and notification emails | USA |
| Google Ireland Ltd. | Syncing the appointment with Google Calendar | EU, with transfers to the USA |
| Railway Corp. | Hosting the website and the database | Servers in the European Union (Netherlands); provider based in the USA |
International transfers to the United States rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the EU-US Data Privacy Framework. You can request a copy of the safeguards in place by writing to info@masajecastelldefels.com.
Your data may also be disclosed to the tax authorities, banks and the courts where there is a legal obligation to do so.
5. Your rights
You may exercise the following rights at any time:
- Access: find out what data of yours we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when it is no longer needed.
- Objection: object to processing based on our legitimate interest.
- Restriction: ask us to keep the data only for the purpose of legal claims.
- Portability: receive your data in a structured, commonly used format.
- Withdraw consent at any time, without affecting the lawfulness of prior processing.
To exercise them, write to info@masajecastelldefels.com or to Avenida 306, nº 9, 1º 1ª, 08860 Castelldefels, Barcelona, stating which right you wish to exercise. We will reply within one month at the latest. We may ask you to prove your identity if we have reasonable doubts about who is making the request.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or the Catalan Data Protection Authority (apdcat.gencat.cat).
6. Minors
The services are aimed at adults. People under 18 may only book an appointment with the consent and presence of a parent or legal guardian, who must provide their own contact details.
7. Security and accuracy of the data
We apply appropriate technical and organisational measures to protect your data: HTTPS traffic encryption, password-protected and restricted access to the management panel, regular database backups, and rate limiting on form submissions. No system is infallible, but we review these measures regularly.
You are responsible for the accuracy of the data you give us. Please let us know if anything changes or is incorrect.
8. Changes to this policy
We may update this policy if our services, suppliers or the applicable legislation change. The date of the last update appears at the top of the page. If a change affects you significantly, we will let you know.