Privacy Policy

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), users of amaraguaspa.com are informed about the processing of their personal data.

1. Data controller

  • Controller: Karen Niro Gapuz
  • Tax ID (NIF): 77980847Z
  • Address: C/ Los Nidos, 23, 29620 Torremolinos (Málaga), Spain
  • Email: amaraguaspa@gmail.com
  • Phone: +34 688 447 985

2. Data we process

Through the website forms we collect the data provided by the user: name, email address, phone number, preferred booking date and time, and the content of the message. No special categories of data are requested. If a user voluntarily shares information relevant to the service (for example pregnancy, injuries or allergies when requesting a treatment), it will be used solely to provide the service safely and treated with strict confidentiality.

3. Purposes and legal basis

  • Managing bookings and providing spa services — legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).
  • Responding to enquiries received through contact forms — legal basis: consent (Art. 6(1)(a) GDPR).
  • Sending commercial communications about spa services and offers, only if the user expressly opts in by ticking the corresponding box — legal basis: consent (Art. 6(1)(a) GDPR). Consent may be withdrawn at any time.
  • Compliance with legal obligations (invoicing, taxation) — legal basis: legal obligation (Art. 6(1)(c) GDPR).

4. Recipients

Data is not disclosed to third parties except where legally required. The following may access data, as processors or service providers, strictly to the extent necessary:

  • Collaborating professionals who provide massage and treatment services at Amaragua Spa, with access limited to booking details.
  • Technology providers: web hosting, email and, where applicable, the booking management system.

If any of these providers is located outside the European Economic Area, transfers are covered by European Commission adequacy decisions (such as the EU-US Data Privacy Framework) or standard contractual clauses.

5. Retention periods

Booking and invoicing data is kept for the periods required by tax and commercial legislation. Enquiry data is kept for as long as necessary to handle the enquiry. Data used for commercial communications is kept until the user withdraws consent.

6. Your rights

Users may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent, by writing to amaraguaspa@gmail.com with the subject "Data protection", enclosing proof of identity. Users also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security measures

The controller applies appropriate technical and organisational measures to guarantee the confidentiality, integrity and availability of the data, in accordance with Article 32 GDPR.

8. Accuracy of data

Users guarantee that the data provided is accurate and undertake to notify any changes. The forms on this website are not intended for children under 14 years of age.

Last updated: July 2026.