Privacy policy

This English version is provided for information only; the Spanish version prevails.

1. Data controller

• Controller: Marta Fernández Temiño
• Tax ID (NIF): 44651211T
• Registered tax address: C. Cristo de la Epidemia, 33, Distrito Centro, 29013 Málaga
• Trading name: Narumi Estética Avanzada & Bienestar
• Premises: Calle Cristo de la Epidemia, 33, 29013 Málaga (Spain)
• Phone: +34 611 500 328
• Email for privacy matters: narumiesteticaavanzada@gmail.com

2. What data we process

We only process the data we need to help you:

• Contact form: your name, email address and/or phone number, the treatment you’re interested in and the content of your message. Please do not include health information in the form; if it’s relevant to a treatment, we’ll discuss it at the consultation at the salon.
• WhatsApp, phone or email: the data you give us when you message or call us (name, phone number or email address and the content of the conversation).
• Technical browsing data: IP address and technical data about your browser and device, which are processed to serve the website, protect it from abuse and measure its use in aggregate, as explained below.
• Analytics and maps, only with your consent: if you accept the relevant cookies, browsing identifiers and website usage data (Google Analytics 4), and the data Google processes when loading the embedded map (Google Maps).

3. What we use your data for and on what legal basis

Purpose	Legal basis
Replying to your enquiries and managing your appointment booking, via the form, WhatsApp, phone or email.	Taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, where applicable, your consent when you send us your enquiry (Art. 6(1)(a) GDPR).
Protecting the form against spam and automated submissions (Cloudflare Turnstile).	Legitimate interest in the security of the website (Art. 6(1)(f) GDPR).
Hosting and serving the website securely and measuring its use in aggregate without cookies (Cloudflare and Cloudflare Web Analytics).	Legitimate interest in the operation, security and improvement of the website (Art. 6(1)(f) GDPR).
Analysing use of the website with Google Analytics 4.	Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE), which you can withdraw at any time.
Displaying the embedded Google Maps map.	Your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE).
Handling requests to exercise your rights and complying with legal obligations.	Compliance with a legal obligation (Art. 6(1)(c) GDPR).

We don’t use your data to build marketing profiles, nor do we make automated decisions that have legal effects on you. We won’t send you marketing communications unless you ask for them or expressly agree to them.

Providing your data is voluntary, but if you don’t give us at least one way to contact you, we won’t be able to reply.

4. How long we keep your data

• Enquiries that don’t lead to an appointment: for as long as necessary to reply and, at most, one year from the last contact, unless you ask us to delete it sooner.
• If you become a client: for as long as the relationship continues and, after that, for the legal limitation periods for any claims that may arise.
• Technical and analytics data: for the periods set out in the cookie policy and in each provider’s terms.

Once those periods have passed, the data is deleted, or blocked where the law requires it to be kept available to the authorities.

5. Who we share your data with

We don’t pass your data on to third parties unless required by law. To provide our service we use providers that process data on our behalf (data processors), with whom we have signed or accepted the contractual terms required by Article 28 GDPR:

• Cloudflare, Inc.: hosting and delivery of the website, security, anti-spam protection for the form (Turnstile) and aggregate cookie-free statistics (Cloudflare Web Analytics).
• Resend: the email delivery service that forwards messages from the form to us.
• Google: the email service in which we receive your messages and, only if you consent, Google Analytics 4 and Google Maps.

If you message us on WhatsApp, that service is provided by WhatsApp Ireland Limited (Meta group), which processes the conversation data under its own terms and privacy policy. We recommend reviewing them before using it. If you prefer, you can contact us by phone or email instead.

6. International transfers

Some of these providers may process data outside the European Economic Area, particularly in the United States. In those cases, transfers are covered by the safeguards provided for in the GDPR: the adequacy decision for the EU-US Data Privacy Framework for participating companies or, failing that, the standard contractual clauses approved by the European Commission.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and you can withdraw any consent you have given, without affecting the lawfulness of processing carried out before you withdrew it. To do so, email us at narumiesteticaavanzada@gmail.com or write to us at the premises’ address, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

We’ll reply within one month, which may be extended in the cases provided for in the GDPR. If you feel we haven’t handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

To withdraw your consent to analytics or map cookies, use the “Cookie settings” link in the footer.

8. Minors

This website is not aimed at children under 14, who should not give us personal data through it. If someone under 18 would like a treatment, the booking must be made by their parent or legal guardian.

9. Client data at the salon

When you visit the salon, we may need additional information for the consultation and to follow up your treatments, including health information relevant to deciding whether a technique is suitable for you. That processing is governed by the specific information we give you at the salon and, where it includes health data, is based on your explicit consent.

10. Security

We apply appropriate technical and organisational measures to protect your data against loss, misuse or unauthorised access, such as encrypting the website’s communications (HTTPS) and restricting access to information.

11. Changes to this policy

We may update this policy to reflect changes in the law or in our services. The version in force is always the one published on this page, with its last updated date.