Privacy policy

Data controller

Alex Akim, tax ID —, —, . Trading name: TestTest.

Email for data matters: —.

What data we collect and why

We only ask for what is needed to handle your appointment:

• Name — to know who we are expecting.
• Email — to send the confirmation and the reminder.
• Phone — optional, to reach you if something happens with the appointment.
• Note for the salon — optional, whatever you wish to tell us.
• Appointment history — which service, when and at what price.

Health data

Allergies, contraindications, pregnancy, injuries or other health conditions are special-category data. They are recorded in your client card only if you expressly tick the consent box, and only so that the service is safe and suitable.

You can withdraw that consent at any time by writing to —. When withdrawn, the health data is deleted while the rest of the card is kept.

Legal basis

Each item of data has a specific basis:

• The booking and its management: performance of a contract (art. 6(1)(b) GDPR).
• Health data: explicit consent (art. 9(2)(a) GDPR).
• Invoicing: legal obligation (art. 6(1)(c) GDPR).

Outside the European Union, the equivalent provisions of the data-protection law of the country where the salon operates apply.

How long we keep the data

Appointment data is kept while the relationship with the client lasts. Afterwards it is stored, blocked, for the statutory limitation periods that apply to tax and accounting records (in Spain, four and six years respectively).

Health data is kept only while the consent remains in force and is deleted immediately when it is withdrawn.

Who else sees the data

Bookings and client cards are managed through the CitaMate platform, operated by Citamate, which acts as data processor on behalf of TestTest under the contract required by art. 28 GDPR. The data is hosted on servers located in the European Union, and the processor handles it only on the controller's instructions.

If the salon offers online payment, the payment is processed by the salon's own payment provider under that provider's policy; TestTest does not store full card details.

Data is not shared with other third parties except where the law requires it (for example, with the tax authorities).

Your rights

You can exercise them free of charge by writing to —:

• Access your data and obtain a copy.
• Correct anything inaccurate.
• Delete the data when it is no longer needed.
• Restrict or object to the processing.
• Port the data to another controller.
• Withdraw consent at any time.

Complaints

If you believe your data is not being handled correctly, you can complain to the data-protection authority of the country where the salon operates (in Spain, the Agencia Española de Protección de Datos: www.aepd.es).

Minors

Services are provided to adults. A minor may receive a service only when accompanied by a parent or legal guardian, who provides the data.

Cookies

This site uses only technical cookies that are strictly necessary for it to work (for example, to keep your session or remember your choice); they do not require consent.

This site does not use analytics, advertising or tracking cookies, unless the salon enables an analytics tool; in that case your consent is requested first through a cookie notice, and you can refuse or withdraw it at any time.

The Citamate platform

The salon's website and online booking run on the Citamate platform. The contract for each service is concluded between the client and the salon; the salon alone is responsible for its services, their quality, prices, bookings and cancellations, and for clients' data as the data controller. The data processor is the Citamate platform (the platform provider) under the Data Processing Agreement (DPA) concluded with the salon. The platform is not a party to the service contract and is not liable for the salon's services; please address complaints about the services to the salon: Alex Akim.