Privacy Policy

1. Data controller

• Controller: Dámaris Toro Gamero
• Tax ID (NIF): 74827567B
• Trade name: El Arte del Tacto (The Art of Touch)
• Address: Málaga (Spain)
• Phone and WhatsApp: +34 672 07 60 34
• Email: dama.toro.gamero@gmail.com

2. Purposes of processing

• Answering enquiries received by WhatsApp, phone, email or Instagram direct message, and managing appointments.
• Showing the Instagram videos on the site, only if the user accepts third-party cookies. Otherwise, the video opens on Instagram.
• Keeping the site secure and working (technical hosting logs).

There are no forms on this site: contact takes place through the direct channels indicated (WhatsApp, phone, email and Instagram).

3. Legal basis

• Pre-contractual steps and provision of the service (art. 6.1.b GDPR) when the user makes an enquiry or books a session.
• Consent of the user (art. 6.1.a GDPR) for third-party cookies (Instagram videos on the site), which can be withdrawn at any time.
• Legitimate interest of the controller (art. 6.1.f GDPR) in keeping the site secure and keeping a minimal record of communications.
• Legal obligation (art. 6.1.c GDPR) to keep tax and accounting records.

4. Categories of data

• Identification data: first name and surname.
• Contact data: phone number and email address.
• The content of the enquiry sent by the user.
• Technical browsing data (IP address, browser type) for security and operation.

No health data is requested on the site. If, when booking or before the session, the user chooses to mention a health condition that should be taken into account, it will only be used to adapt the session, with the user's explicit consent (art. 9.2.a GDPR), and will not be shared with anyone.

5. Recipients and international transfers

Data are not disclosed to third parties, except where required by law. The following providers are involved so that the site and contact channels work:

• Cloudflare, Inc. (website hosting). Receives technical browsing data as a data processor. This may involve a transfer to the United States, covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
• Meta Platforms Ireland Ltd. (WhatsApp and Instagram). If the user writes via WhatsApp or Instagram, or agrees to watch the Instagram videos on the site, Meta processes their data under its own privacy policy, with a possible transfer to the United States covered by the EU-US Data Privacy Framework.
• Google Ireland Ltd. (email). Emails sent by the user are stored in the controller's email service.

The site's fonts and scripts are served from the site itself: visiting it does not send anything to Google or other external networks.

6. Retention period

• Enquiries: up to one year from the last contact, unless the user asks for them to be deleted sooner or there is a legal obligation to keep them.
• Client data: for the duration of the relationship and the applicable legal periods (tax, commercial and civil liability).
• Cookie preferences: thirteen months from when they are recorded, or until the user changes them.

7. Automated decisions

No automated individual decisions are made and no profiling with legal effects on the user takes place.

8. User rights

Anyone can exercise the rights granted by the GDPR:

• Access: to know which of their data are processed.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask for data to be deleted where applicable.
• Objection: to object to processing based on legitimate interest.
• Restriction: to ask for processing to be restricted in the cases provided for.
• Portability: to receive their data in a structured, commonly used format.
• Withdrawal of consent: at any time, without retroactive effect.

Exercising these rights is free of charge: simply write to dama.toro.gamero@gmail.com stating which right you wish to exercise. If there are reasonable doubts about the identity of the person making the request, proof of identity may be requested.

If the user considers that their rights have not been properly addressed, they may lodge a complaint with the Spanish Data Protection Agency, Agencia Española de Protección de Datos (C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es).

9. Minors

The services are intended exclusively for adults. Data of minors are not knowingly processed; should this be detected, they will be deleted as soon as it becomes known.

10. Security and confidentiality

Reasonable technical and organisational measures are applied to protect data against unauthorised access, loss, alteration or destruction, in proportion to the risk of the processing. Enquiries and anything discussed in sessions are treated in strict confidence.

11. Changes to this policy

This policy may be updated to reflect changes in the law or in how the site works. The version in force is the one published on this page, with the date of the last update.

This English version is provided for information. In case of any discrepancy, the Spanish version prevails.