Privacy Policy
Last updated: May 2026
At Esencia Estética By Carmen Pereiro we take the protection of your data very seriously. This policy explains clearly what information we collect, why we collect it, how long we keep it and what rights you have over it, in accordance with EU Regulation 2016/679 — the General Data Protection Regulation (RGPD / GDPR) — and Spain's Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD, Spain's Data Protection Act).
1. Data controller
Owner: Carmen Pereiro Aguiar
Trading name: Esencia Estética By Carmen Pereiro
Spanish Tax ID (NIF): [pending]
Address: Carretera de Velilla, 6 — 28510 Campo Real (Madrid), Spain
Phone: +34 91 197 04 25
Email: carmenpereiroaguiar@gmail.com
Website: carmenpereiroaguiarestetica.com
2. What data do we collect, and why?
We only collect the information we need to provide a good service. Here is a breakdown by scenario:
| Source | Data processed | Purpose | Legal basis |
|---|---|---|---|
| Booking by WhatsApp / phone | Name, phone number, treatment requested, preferred date | Manage your appointment and stay in touch with you. | Performance of a contract (art. 6.1.b RGPD) |
| Online booking (Koibox) | Name, phone number, email, treatment, date | Manage your appointment, send you reminders and maintain your client record. | Performance of a contract (art. 6.1.b RGPD) |
| Contact email | Name, email, content of your message | Reply to your enquiry. | Consent (art. 6.1.a RGPD) |
| In-person care at the salon | Identification details, record of treatments performed, skin observations | Delivery of the beauty service and client follow-up. | Performance of a contract (art. 6.1.b RGPD) |
| Invoicing | Full name, tax ID (NIF/DNI), address, amount | Compliance with tax and accounting obligations. | Legal obligation (art. 6.1.c RGPD) |
| Website browsing | Anonymous browsing data (via Google Analytics, only if you accept cookies) | Understand how the website is used and improve it. | Consent (art. 6.1.a RGPD) |
3. How long do we keep your data?
- Client data and treatment record: for as long as our commercial relationship continues, and for up to 5 years after your last visit, unless you request its earlier deletion.
- Invoicing data: for the periods legally required by tax and commercial law (minimum 6 years, art. 30 of the Spanish Commercial Code).
- WhatsApp/email conversations: while operationally useful and for up to 2 years from your last contact.
- Analytics cookies: see our Cookie Policy.
4. Who do we share your data with?
We do not sell or transfer your data to third parties for commercial purposes. The only parties with whom we share it are the following providers, who help us deliver the service (data processors under art. 28 RGPD):
- Koibox (booking management and client record) — Datawin S.L., Spain.
- Google LLC (Google Analytics, Gmail) — USA. International transfer covered by the EU-U.S. Data Privacy Framework.
- Meta Platforms Ireland Ltd. (WhatsApp Business, if we use it for communications) — Ireland.
- Tax and accounting advisors, for compliance with legal obligations.
- Spanish Tax Authority and other public bodies, where legally required.
5. What are your rights?
As the data subject, you may exercise the following rights at any time:
- Access: find out what data of yours we hold.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when it is no longer needed.
- Objection: object to processing for reasons relating to your particular situation.
- Restriction: ask us to restrict processing while an issue is being verified.
- Portability: receive your data in a structured format to transfer to another controller.
- Withdraw consent at any time, without this affecting the lawfulness of earlier processing.
To exercise any of these rights, write to us at carmenpereiroaguiar@gmail.com, clearly stating your request and enclosing a copy of your national ID or an equivalent identification document. We will reply within a maximum of one month.
If you believe we have not properly handled your request or that we have infringed your rights, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD), C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es.
6. Security measures
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse: access restricted by user and password, periodic back-ups, encrypted connections (HTTPS) and selection of providers who comply with the RGPD.
7. Data of minors
Our services are not directed at persons under 14 years of age. If a minor wishes to book a treatment, they must always be accompanied by their mother, father or legal guardian, who authorises the processing of the minor's data.
8. Changes to this policy
We may update this policy to adapt to regulatory changes or new services. We recommend that you check it periodically. If the changes are substantial, we will let you know via our usual channels (website, email).
9. Contact
If you have any questions about this policy or about how we process your data, write to us at carmenpereiroaguiar@gmail.com or call us on +34 91 197 04 25.