Privacy policy

1. Data controller

Owner

La Boutique de la Estética, S.L.

Trade name

SpaClick

Tax ID (NIF / CIF)

B97907414

Address

C/ Bartolomé Vicente Ramón 13, 1º, 07800 Eivissa

Email

hola@spaclick.es

WhatsApp

613 404 552

Commercial Register

Registro Mercantil de Eivissa, tomo 241, libro 240, folio 58, hoja IB-10031, inscripción 3ª

2. What data we process and why

• Purchase and voucher: name, email and mobile number, to issue and send you the voucher and to manage your order. Basis: the purchase contract.
• Gifts: name and email or mobile number of the recipient and your message, to send them their voucher. Basis: the contract.
• Bookings: day, time, centre and number of people, which the staff at that spa see in order to serve you. Basis: the contract.
• Payment: secure card payment through Redsys. SpaClick only receives the payment result, never the card details. For the bank's security verification (3DS), we send it your email and, if you gave them to us, your name and your mobile number (with Bizum, the mobile number so that you do not have to type it). Basis: the contract.
• Reviews: two days after your visit we send you a single email asking for your review (basis: legitimate interest; you can unsubscribe with one click from the email itself). If you leave a review, we publish on the website your stars, the words you choose, your comment, the spa and the month; your name and the initial of your surname, only if you select this (basis: your consent). We verify it with your voucher, which is not published. You can ask us to delete it whenever you like.
• News: your email, only if you tick the box, to send you SpaClick news. Basis: your consent, which you can withdraw whenever you like.
• Welcome code: your email, to send you your 10% code, which is only valid when paying with that email, once. If you tick the box “I want to receive SpaClick offers by email” (unticked by default), also to send you offers; every email includes the link to unsubscribe. To prevent abuse, we keep a fingerprint of your IP address (not the IP) for 24 hours and check that you are not a robot with Cloudflare Turnstile. Basis: your request (the code) and your consent (the offers), which you can withdraw whenever you like.
• Black Friday list: your email, only if you tick the box “I want to receive the Black Friday alert and other SpaClick offers by email” (unticked by default), to tell you about Black Friday prices before anyone else and send you other SpaClick offers. Legal basis: your consent, which you can withdraw at any time with the unsubscribe link in every email or by writing to us. We keep a record of when and with which wording you gave your consent.
• Email and WhatsApp: if you write to us, to assist you. On WhatsApp, Mia, SpaClick's virtual assistant, replies first and, if you prefer, a member of the team. Basis: your request.

3. Who it is shared with

To the hotel spa where you enjoy the experience (only what is needed for the booking) and to the providers that serve us: website and database hosting (Cloudflare), card payments (Redsys and the merchant’s bank), WhatsApp (YCloud and Meta), email (Resend) and, only if you accept analytics cookies, Google Analytics (Google Ireland Limited). Some may process data outside the EU with GDPR safeguards (standard contractual clauses). We do not sell your data.

4. How long

• Purchases, vouchers and bookings: while the voucher is valid and then 6 years (accounting and tax records, art. 30 of the Spanish Commercial Code); for possible claims, 5 years (art. 1964 of the Spanish Civil Code).
• Unfinished basket (your email and what was in it): 30 days.
• Welcome code: up to 30 days after your code expires or you use it (with the offers box ticked, until you unsubscribe). After that, only an encrypted fingerprint of the email, so that the offer is not repeated.
• Black Friday list: until you unsubscribe.
• Copy of the emails we send you: 12 months.
• News: until you unsubscribe; the unsubscribe record is deleted 30 days later.
• “Tell me when it opens”: until 30 days after we notify you or until you unsubscribe; 2 years at most.
• Bookings made on third-party booking platforms: only the date, time and number of people, to manage spa occupancy; they are not used for anything else.
• Attempts (staff PIN, balance enquiries, sign-ups and invitations) with the IP address: 24 hours.
• Visits that come from a campaign: 13 months, with no data that identifies you.
• Reviews: until you ask us to delete them.
• Database backups: 30 days.

5. Your rights

Access, rectification, erasure, objection, restriction and portability, by writing to hola@spaclick.es. You can also lodge a complaint with the Agencia Española de Protección de Datos (aepd.es).

6. En tu navegador

Tu pedido, tus favoritos y el acceso a tus bonos se guardan además en tu navegador y se borran con «Borrar mi cuenta».