Privacy Policy

In accordance with EU General Data Protection Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you about the controller of your personal data:

• Owner: Emma Rodríguez Espinosa (sole trader)
• Trading name: Guinda Wellness & Spa
• Tax ID (NIF): 74732158Y
• Address: Hotel TRH Mijas, C. Tamisa, 2, 29650 Mijas Pueblo, Málaga, España
• Contact email: info@guindaspa.es

We process different personal data depending on how you use this website.

Gift voucher purchases:

• Buyer data: full name, email address, phone number (if provided) and postal code.
• Recipient data: recipient's name and email address (if provided by the buyer for delivery).
• Order data: voucher description, amount, voucher code, date and order status.
• Personal message: the dedication or personal message included in the gift voucher (if added by the buyer).
• Payment data: payment processing is handled entirely by Stripe. Guinda Wellness & Spa does not store any card data. Stripe may collect and process payment data according to its own privacy policy.
• Technical data: IP address and basic session data necessary for security, error diagnosis and fraud prevention.

Service bookings:

• Booking data: the name, phone number, email, service and date you enter in the Booksy calendar. Booksy collects them on its platform (see section 6). This data is needed to book through the calendar; without it we cannot manage your appointment. If you prefer not to provide it to Booksy, you can book by phone or WhatsApp.
• Bookings by phone, WhatsApp or email: the data you give us to manage your appointment.

Website usage measurement, only if you accept analytical cookies:

• Identifiers: the browser and session identifiers stored in the Google Analytics cookies.
• Browsing data: pages visited, referring page, clicks on the booking and WhatsApp links, and the date and time of each visit.
• Device data: device type, browser, language and approximate location. Google derives that location from the IP address and states that Google Analytics does not log or store the address.

We process your personal data for the following purposes:

• Managing and processing your gift voucher purchase.
• Service bookings: managing your appointment.
• Sending the digital voucher to the recipient's email address.
• Generating the voucher validation code and/or PDF.
• Enabling reservation or validation of the voucher at the spa.
• Handling enquiries and providing customer support.
• Complying with applicable legal and tax obligations.
• Preventing fraud and ensuring service security.
• Improving the technical performance of the website.
• Measuring how the website is used with Google Analytics, if you accept analytical cookies, in order to improve its content and services.

We process your data on the following legal grounds:

• Performance of a contract (Art. 6.1.b GDPR): processing is necessary to manage your voucher purchase and deliver the requested service.
• Service bookings (Art. 6.1.b GDPR): processing is necessary to manage the appointment you request, as performance of a contract or as steps taken at your request before entering into one.
• Legal obligation (Art. 6.1.c GDPR): retention of billing and accounting data as required by applicable tax and commercial law.
• Legitimate interest (Art. 6.1.f GDPR): website security, fraud prevention and technical error diagnosis.
• Consent (Art. 6.1.a GDPR): for sending marketing communications, if you have explicitly agreed, and for analytical cookies and measurement with Google Analytics, if you accept them in the cookie banner. This measurement is not based on legitimate interest.

Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected:

• Purchase and voucher management data: we will retain the data necessary to manage the purchase, issuance, redemption, customer support and traceability of the voucher for as long as the service is being provided and, thereafter, for a maximum of 4 years to address any liability arising from the contractual relationship.
• Booking data: the booking calendar is a Booksy service. The data in your Booksy account, if you have one, is processed by Booksy as an independent controller under its own policy. The data in your booking (name, phone, email, service and date) is kept for as long as necessary to manage your appointment and, thereafter, for the limitation periods of any claims that may arise from the service. You can exercise your right to erasure as described in section 7.
• Tax and accounting data: we will retain information necessary to comply with tax and accounting obligations for the periods required by law, generally 5 years.
• Technical payment events: payment event records are stored in minimised form. The full Stripe event payload containing personal data is not stored. Technical identifiers and minimum audit data may be retained for up to 5 years.
• Technical logs: technical logs will be retained for the minimum period necessary for security, diagnostics and abuse prevention.
• Measurement with Google Analytics: data associated with your identifiers is kept in Google Analytics for a maximum of 14 months. Cookie lifetimes are listed in the Cookie Policy.

To deliver the service, Guinda Wellness & Spa uses the providers below. They act as data processors (Art. 28 GDPR), except for the processing that an entry describes as the provider's own. Beyond those cases, your data is not disclosed to third parties except as required by law:

• Stripe, Inc. (USA) — secure card payment processing. Stripe acts as a data processor and has Standard Contractual Clauses and a Data Processing Addendum compliant with GDPR. More info: stripe.com/privacy
• Resend, Inc. (USA) — transactional email delivery (purchase confirmation, voucher delivery). More info: resend.com/legal
• Neon, Inc. (EEA — Frankfurt, Germany) — database where orders are stored. Data is hosted within the European Union. More info: neon.tech/privacy-policy
• Vercel, Inc. (USA) — website hosting and deployment platform. More info: vercel.com/legal
• Sentry, Inc. (USA) — technical error and performance monitoring. It receives technical visit data, such as the URL, browser and connection IP address, when an error occurs and for a sample of visits. More info: sentry.io/privacy
• Google (Google Ireland Limited, Ireland, and Google LLC, USA) — measurement of website usage with Google Analytics 4, only if you accept analytical cookies. The script is downloaded from www.googletagmanager.com and is not loaded before you accept. Google acts as a data processor and receives the measurement data described in section 2. International transfers: this data may be processed in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023, and, where necessary, uses standard contractual clauses. More info: Google privacy frameworks and how Google uses information from websites
• Booksy (Booksy Iberia, S.L.U., Spain, part of Booksy International Sp. z o.o., Poland) — online booking system embedded in the Book page. The calendar is displayed inside a frame served by Booksy: the data you enter when booking (name, phone, email, chosen service and date) is collected and processed by Booksy directly on its own platform, and Guinda Wellness & Spa receives it as the provider of the booked service. This website does not capture, store or forward that data. The calendar loads when you open the booking page, without a prior click, because it is the very service you request by visiting it. Before you decide about cookies: the Booksy frame contacts security and anti-fraud providers (hCaptcha/Cloudflare, Stripe and Feroot), its consent manager (Cookiebot), its experimentation tool (Eppo) and its image network (CloudFront), sets the security and anti-fraud cookies detailed in the Cookie Policy, and loads its Google Tag Manager container. It also sends Google cookieless measurements, including a call to the advertising domain pagead2.googlesyndication.com. Those that state a consent status mark it as denied and request non-personalised advertising. Google receives technical data such as your IP address, browser, the page visited and calendar usage events. Analytics and advertising cookies: Booksy manages them with its own tool, separate from this website, and only sets them if they are accepted. In our measurement of 2 November 2026, without accepting anything, the calendar showed no banner and did not set those cookies. Dual role: Booksy acts as a data processor (Art. 28 GDPR) for your booking data, which Guinda Wellness & Spa manages in its panel; and as an independent controller for the processing it carries out for its own purposes (its marketplace, analytics and advertising). Guinda Wellness & Spa chooses to embed the calendar, which triggers the initial collection and transmission of that data, but does not decide how it is used afterwards. International transfers: Booksy Iberia operates within the EEA, but inside its frame it loads providers such as Google, before and after your choice, and other analytics and advertising providers (TikTok, Snapchat, Hotjar), that may involve transfers to the United States, subject to the safeguards Booksy declares in its own policy. More info: booksy.com/en-gb/p/privacy

You have the right to:

• Access: know what personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data when it is no longer necessary ('right to be forgotten').
• Objection: object to the processing of your data in certain circumstances.
• Restriction: request that we restrict the processing of your data.
• Portability: receive your data in a structured, machine-readable format.
• Withdraw consent: at any time, without affecting the lawfulness of prior processing. For analytical cookies, use "Cookie preferences" in the page footer.

To exercise your rights, please send an email to info@guindaspa.es with a copy of your identity document.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es

Our gift voucher service is not directed at persons under 14 years of age. If we become aware that we have collected data from a minor without a valid legal basis, we will delete it immediately.

If you are a parent or legal guardian and believe a minor has submitted personal data without your consent, please contact us at info@guindaspa.es.

Guinda Wellness & Spa implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These include encrypted communications (HTTPS/TLS), restricted data access, and the use of providers with recognised security standards.

For any queries about the processing of your personal data:

• Email: info@guindaspa.es
• Phone: +34 654 01 42 68
• WhatsApp: +34654014268
• Postal address: Hotel TRH Mijas, C. Tamisa, 2, 29650 Mijas Pueblo, Málaga, España