Privacy Policy

November 2026

Controller

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data. Full details are in the imprint.

Legal bases

We process personal data on the basis of Art. 6(1)(b) GDPR (steps prior to and performance of a contract), Art. 6(1)(f) GDPR (legitimate interest in secure, trouble-free operation), Art. 6(1)(c) GDPR (statutory retention obligations) and, where consent is required, Art. 6(1)(a) GDPR. Consent given can be withdrawn at any time with effect for the future.

SSL/TLS encryption

This site is delivered exclusively over an encrypted connection (recognisable by https:// in the address bar).

Hosting and Cloudflare

This website runs on a server in a data centre within the European Union. Requests reach the server through the network of Cloudflare, Inc., which protects the site against attacks and speeds up delivery. Cloudflare processes technical data such as the IP address and also collects anonymised performance data (Cloudflare Web Analytics). The legal basis is Art. 6(1)(f) GDPR. Scripts are also loaded from cdnjs.cloudflare.com and cdn.ampproject.org, which involves transmitting your IP address to those providers.

Website access data

When a page is requested, your browser transmits technically necessary information that the server records in log files:

• the address requested, date and time of the request
• the amount of data transferred and the HTTP status code
• browser type and version, operating system
• the referring page, where transmitted
• IP address

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in secure operation and the defence against attacks. This data is not merged with other data sources. Logs are deleted after 30 days at the latest, unless they are needed to investigate a specific case of abuse. To fend off automated attacks we store the IP address of suspicious requests in a block list for a limited time.

Contact and treatment requests

If you write to us by e-mail or use a form on this website, we process your details in order to handle the enquiry and in case of follow-up questions: first and last name, e-mail address, mobile number, the service you are interested in and, on the treatment request form, the desired date, number of persons, selected treatments and your message. The form sends these details to us by e-mail. The legal basis is Art. 6(1)(b) or (f) GDPR. Messages remain with us until the purpose ceases to apply and no statutory retention periods stand in the way.

Cookies and consent tool

This website uses a technically necessary session cookie, which is deleted when the browser session ends. To manage cookie consent we use the service CookieHub, which stores your choice in a cookie.

Google Analytics

This website uses Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It uses cookies to analyse how the site is used. Data may be transferred to Google LLC in the USA; Google LLC participates in the EU-U.S. Data Privacy Framework. Where consent is required, the legal basis is Art. 6(1)(a) GDPR.

Google Maps

The contact page embeds a map from Google Maps, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Displaying the map transmits your IP address and technical data to Google and loads fonts from Google's servers. Data may be transferred to the USA. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in showing how to find us.

Your rights

You have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Please contact [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es).

Changes to this policy

We adapt this policy when our services or the legal situation change. The version published here at the time applies.