Arantxa Roca Hair Studio
Privacy policy
Last updated: 21 July 2026.
1. Data controller
- Controller / trade name
- Arantxa Roca Hair Studio
- Tax ID (NIF/CIF)
- PENDING UPDATE
- Operating address
- Carrer Mallorca, 32, PENDING UPDATE (street number), Montcada i Reixac, PENDING UPDATE (postcode), PENDING UPDATE (province), Spain
- Privacy email
- PENDING UPDATE
- Legal telephone
- PENDING UPDATE
2. Processing activities
| Flow | Data and purpose | Likely legal basis | Retention |
|---|---|---|---|
| Contact | Name, email, optional telephone, subject, message and anti-fraud data to answer enquiries. | Consent and, where relevant, requested pre-contractual steps. | PENDING UPDATE. |
| Newsletter | Email, consent evidence and unsubscribe record to send marketing communications. | Withdrawable consent. | Until unsubscribe; later blocking: PENDING UPDATE. |
| Careers | Name, email, optional telephone, area, message, IP and acceptance to assess an application. No CV is requested or accepted. | Consent and candidate-requested pre-contractual steps. | PENDING UPDATE. |
| External booking | Data entered directly in MyBeautyPlanner to manage appointments. | Pre-contractual steps/service performance and, where relevant, consent. | Supplier policy/contract: PENDING VERIFICATION. |
| Technical/session | IP, logs, session, browser and preferences for security, operation and abuse prevention. | Legitimate interests in security; consent for non-essential categories. | Logs: PENDING UPDATE; preferences: 180 days. |
3. MyBeautyPlanner
Booking is embedded from MyBeautyPlanner only with external-media consent. The salon controls this website, but data entered inside the iframe is sent directly to the external service. The supplier's legal identity, role, processing agreement, subprocessors, retention and privacy policy must be verified before publication.
4. Recipients and transfers
Necessary hosting, email, maintenance, security and booking suppliers may access data under contract when acting as processors. Hosting, email and complete supplier list: PENDING UPDATE. Unrelated disclosure is not expected unless required by law.
Where a supplier processes data outside the EEA, its country, adequacy decision or safeguards such as standard contractual clauses must be checked and disclosed.
5. Rights
You may exercise access, rectification, erasure, restriction, portability and objection, and withdraw consent without affecting earlier processing. Send requests to the privacy email still to be specified. You may also complain to the AEPD.
6. Children, security and required fields
The services are not directed to children who cannot validly consent. Risk-appropriate measures are used, but no system is infallible. A request may not be handled without its required fields.
7. Changes
This policy will be reviewed whenever processing, suppliers or law changes.