Privacy policy

Controller and scope

The controller is Víctor Cugat Pérez, self-employed professional, NIF 34766004D, trading as Donde los Yayos de Barcelona. Business address: Carrer de Roger de Flor, 259, 2º 1ª, 08025 Barcelona, Spain. For privacy matters you can contact [email protected] or +34 615 830 378.

This information covers browsing, enquiries, bookings, gift cards and payments handled through the website and the professional’s contact channels. Reading it does not amount to consenting to all processing. Each purpose has its own legal basis.

What data is used and why

• Enquiries: name, contact details and the content of the message needed to reply. When you ask about a service or request a booking, the legal basis is pre-contractual measures taken at your request. For other enquiries, the legitimate interest in responding to the communication received, limited to what is necessary and subject to your right to object.
• Bookings and provision of the session: identification and contact details entered, service, length, date, time, status and handling of the appointment. They are used to process the booking and its confirmation, reminder and change notifications, on the basis of performance of the contract or pre-contractual measures taken at your request.
• My appointments: booking email address, personal access credentials and appointment data to enable the available actions, on the same contractual basis. Access security also relies on the legitimate interest in preventing unauthorised access.
• Payments and invoicing: transaction data, amount, status and the data needed to issue receipts or invoices and handle refunds. Legal bases: performance of the contract and compliance with legal tax and accounting obligations.
• Gift cards: details of the purchaser, transaction, chosen session and the recipient’s name or minimal reference, in order to prepare and manage the gift. Legal bases: contract with the purchaser and legitimate interest in managing the service on behalf of the recipient, with information and the possibility of exercising their rights. If someone provides your name to give you a session as a gift, you can ask where it came from. There is no need to provide another person’s health data.
• Security and operation: technical data and logs needed to protect the website, resolve issues and prevent fraud or misuse. Legal basis: legitimate interest in security and, where applicable, legal obligations.
• Statistics and optional external services: identifiers and browsing data according to the technologies described in the Cookie policy. Consent is requested where required. You can change the categories using the controls on that page.

Fields marked as mandatory are necessary for the action you request. If essential data is missing or the email address is incorrect, it may not be possible to process the booking or send you the access link. Do not use the general fields to send reports, diagnoses, details of medication or other health data. This policy does not constitute authorisation to keep health records; such processing requires specific information and a separate valid legal basis.

This policy does not turn booking data into a subscription to marketing communications. Communications needed for an appointment are distinct from advertising, which must meet its own legal requirements.

How access to your appointments works

Bookings and the My appointments panel use the booking platform integrated into this website. To request access, the email address you booked with is used. Sign in with the same email address you booked with and your password, or with Google when that option is shown. If you need to set or reset your password, use the personal link sent by the system. Once signed in, you can view or manage the available options for your appointments, including any available payments.

The link works as an access credential to personal information: do not share or forward it. Avoid leaving the panel open on shared devices and log out when that option is available. If you suspect someone else has accessed it, contact me. Managing an appointment in the panel does not replace exercising your data protection rights. The expiry of a link does not in itself delete the booking history.

Providers and recipients

Infrastructure, hosting, email, backup, security and payment providers are used for the functions described. Access must be limited to what is necessary for each service. An integration does not mean that every provider receives all appointment data.

• Hosting and outgoing email: Webempresa infrastructure for the website and for sending system messages. Information from Webempresa.
• Bookings: the booking platform integrated into WordPress manages the calendar and the panel. Using this platform does not in itself mean sending the entire calendar to the tool’s provider. Any additional support access or integration must have its own scope and conditions.
• Online payments: Stripe processes transactions made with that option and may act as processor or as controller for certain purposes of its own, such as financial requirements and fraud prevention. Stripe privacy. The entities behind the other payment methods used are involved in the corresponding transactions.
• Backups: UpdraftPlus manages website backups with Google Drive configured as the destination. These backups may include website and booking data. Information from Google.
• Contact via WhatsApp: if you choose this channel, WhatsApp is involved under its own terms. You can use email or phone instead. WhatsApp privacy for the EEA.
• Browsing and external content: Google Analytics, reviews via Trustindex and accessibility tools may process technical data or identifiers depending on their function and the applicable preferences. See the cookie policy for details of technologies and categories; the providers have their own policies: Google and Trustindex.

Data may also be disclosed to public authorities, courts or other recipients where there is a legal obligation, and to professionals with a justified role in tax obligations or in the defence of claims. It is not claimed that all these categories are involved in every transaction.

International processing

Some technology providers operate internationally and carry out processing outside the European Economic Area. It should not be assumed that all data always remains in Spain or the European Union. Stripe and Google explain their international processing and the applicable transfer mechanisms in their policies.

Any transfers must be based on the mechanisms provided for in the GDPR, such as an adequacy decision or appropriate safeguards, including standard contractual clauses where applicable. You can ask the controller for information about the recipients, destinations and safeguards applicable to your processing and how to obtain a copy of those safeguards. The linked policies also allow you to read the information published by each provider; they do not replace the controller’s obligations.

Retention criteria

• Enquiries without a contract: while the request is being handled and, afterwards, only the information needed to deal with issues or possible liabilities arising from it, for the applicable periods.
• Bookings and the client relationship: while appointments and the service relationship are being managed; once it ends, retention must be limited to legal obligations and dealing with liabilities. The panel profile does not constitute authorisation for unlimited retention.
• Payments, invoices and receipts: for the periods required by tax and accounting law and those needed to handle obligations or claims; interruptions of limitation periods or ongoing proceedings may require certain documents to be kept for longer.
• Security logs: for as long as necessary to prevent, analyse or resolve incidents and establish liability, with restricted access.
• Cookies and identifiers: according to the durations and criteria of the cookie policy and the specific service. Withdrawing consent does not make any previous valid processing unlawful.
• Backups: subject to the backup rotation cycle. Deletion from the live system should not be confused with the instant disappearance of all backups; data kept for legal obligations or liabilities must be restricted to those purposes.

These criteria do not announce automatic deletion of the history or a single period applicable to all data. You can ask which criterion applies to your data or request its deletion; any applicable retention or blocking obligations will be examined.

Your rights and how to exercise them

You can request access, rectification, erasure, restriction, objection and portability in the cases provided for by law, by writing to [email protected]. If processing is based on your consent, you can withdraw it without affecting the lawfulness of prior processing. For cookies, use the controls in the cookie policy.

Additional necessary and proportionate information will only be requested if there are reasonable doubts about your identity; a copy of your ID document is not always required. A reply will be given within the GDPR deadline, normally one month, with any permitted extensions where applicable. You can lodge a complaint with the Spanish Data Protection Agency (AEPD).

The calendar uses automatic availability rules and handling deadlines. If an option in the panel does not resolve your case, you can contact the professional to have the issue and your rights reviewed.

Updates

This information will be reviewed when the processing or providers change. Publishing a new version does not replace individual information or any specific consent that may be required for new processing.

Last review of the website scope: 22 October 2026.