Privacy Policy

In accordance with EU General Data Protection Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you about the controller of your personal data:

• Business name / owner: [PENDIENTE: razón social]
• Tax ID: [PENDIENTE: NIF/CIF]
• Address: Hotel TRH Mijas, 29650 Mijas Pueblo, Málaga, España
• Contact email: info@guindaspa.es

When you purchase a gift voucher, we collect and process the following personal data:

• Buyer data: full name, email address, phone number (if provided) and postal code.
• Recipient data: recipient's name and email address (if provided by the buyer for delivery).
• Order data: voucher description, amount, voucher code, date and order status.
• Personal message: the dedication or personal message included in the gift voucher (if added by the buyer).
• Payment data: payment processing is handled entirely by Stripe. Guinda Wellness & Spa does not store any card data. Stripe may collect and process payment data according to its own privacy policy.
• Technical data: IP address and basic session data necessary for security, error diagnosis and fraud prevention.

We process your personal data for the following purposes:

• Managing and processing your gift voucher purchase.
• Sending the digital voucher to the recipient's email address.
• Generating the voucher validation code and/or PDF.
• Enabling reservation or validation of the voucher at the spa.
• Handling enquiries and providing customer support.
• Complying with applicable legal and tax obligations.
• Preventing fraud and ensuring service security.
• Improving the technical performance of the website.

We process your data on the following legal grounds:

• Performance of a contract (Art. 6.1.b GDPR): processing is necessary to manage your voucher purchase and deliver the requested service.
• Legal obligation (Art. 6.1.c GDPR): retention of billing and accounting data as required by applicable tax and commercial law.
• Legitimate interest (Art. 6.1.f GDPR): website security, fraud prevention and technical error diagnosis.
• Consent (Art. 6.1.a GDPR): for sending marketing communications, if you have explicitly agreed.

Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected:

• Purchase and voucher management data: we will retain the data necessary to manage the purchase, issuance, redemption, customer support and traceability of the voucher for as long as the service is being provided and, thereafter, for a maximum of 4 years to address any liability arising from the contractual relationship.
• Tax and accounting data: we will retain information necessary to comply with tax and accounting obligations for the periods required by law, generally 5 years.
• Technical payment events: payment event records are stored in minimised form. The full Stripe event payload containing personal data is not stored. Technical identifiers and minimum audit data may be retained for up to 5 years.
• Technical logs: technical logs will be retained for the minimum period necessary for security, diagnostics and abuse prevention.

Your personal data will not be shared with third parties except as required by law. To deliver the service, Guinda Wellness & Spa uses the following technology providers as data processors pursuant to Art. 28 GDPR:

• Stripe, Inc. (USA) — secure card payment processing. Stripe acts as a data processor and has Standard Contractual Clauses and a Data Processing Addendum compliant with GDPR. More info: stripe.com/privacy
• Resend, Inc. (USA) — transactional email delivery (purchase confirmation, voucher delivery). More info: resend.com/legal
• Neon, Inc. (EEA — Frankfurt, Germany) — database where orders are stored. Data is hosted within the European Union. More info: neon.tech/privacy-policy
• Vercel, Inc. (USA) — website hosting and deployment platform. More info: vercel.com/legal
• Sentry, Inc. (USA) — technical error monitoring. May receive technical session data in case of an error. More info: sentry.io/privacy

We recommend formalising or verifying Data Processing Agreements (DPAs) with each provider before going live.

You have the right to:

• Access: know what personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data when it is no longer necessary ('right to be forgotten').
• Objection: object to the processing of your data in certain circumstances.
• Restriction: request that we restrict the processing of your data.
• Portability: receive your data in a structured, machine-readable format.
• Withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise your rights, please send an email to info@guindaspa.es with a copy of your identity document.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es

Our gift voucher service is not directed at persons under 14 years of age. If we become aware that we have collected data from a minor without a valid legal basis, we will delete it immediately.

If you are a parent or legal guardian and believe a minor has submitted personal data without your consent, please contact us at info@guindaspa.es.

Guinda Wellness & Spa implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These include encrypted communications (HTTPS/TLS), restricted data access, and the use of providers with recognised security standards.

For any queries about the processing of your personal data:

• Email: info@guindaspa.es
• Phone: +34 654 01 42 68
• WhatsApp: +34654014268
• Postal address: Hotel TRH Mijas, 29650 Mijas Pueblo, Málaga, España