Privacy policy
Last updated: October 21, 2026 (version 3.0)
This page explains what personal data we process, why, on what legal basis, for how long, who we share it with and how you can exercise your rights, in accordance with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
1. Data controller
- Controller: GRANADA WELLNESS, S.L. (Quiroesencia)
- Tax ID (CIF): B19902097
- Address: Calle San Jerónimo, 48, local, 18001 Granada (Spain)
- Email for privacy matters: info@quiroesencia.com
- Phone: +34 621 217 595
We are not required to appoint a data protection officer. For any question about your data, you can email us at the address above.
2. What data we process, why and for how long
We only ask for the data we need for each purpose. When you book, this is usually your name, phone number, email address, the service you choose, and the date and time.
2.1. Inquiries by email, phone or WhatsApp
- Purpose: to answer your questions about services, prices, opening hours or bookings.
- Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) or your consent when you contact us (Art. 6(1)(a) GDPR).
- Retention: as long as needed to handle your inquiry and no more than one year afterwards, unless it leads to a booking.
2.2. Automated WhatsApp assistant
Our WhatsApp number +34 602 696 263 is answered by an automated assistant powered by artificial intelligence, not by a person. It answers general questions (services, prices, opening hours, location) in Spanish and English. It does not handle bookings, does not give health advice and does not make decisions about you. If you need to talk to a person, it will give you our customer service number.
- Purpose: to answer your inquiries automatically and improve our service.
- Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering inquiries outside opening hours (Art. 6(1)(f) GDPR).
- Retention: conversations are kept for no more than 12 months and then deleted.
- Please do not share health data or other sensitive information through this channel.
2.3. Bookings, payments, session packages and gift cards
- Purpose: to manage your appointments, payments, session packages and gift cards, send you booking confirmations and appointment reminders (by email, text message or WhatsApp) and issue invoices.
- Legal basis: performance of the service contract (Art. 6(1)(b) GDPR) and compliance with legal accounting and tax obligations (Art. 6(1)(c) GDPR).
- Retention: while you are a customer and, afterwards, blocked for the legal limitation periods: generally 5 years for contractual liability and 6 years for accounting and tax records.
2.4. Information you share about your physical condition
We do not ask for medical reports or keep health records. Before a session, you may tell us about a circumstance we should take into account (for example, a pregnancy or a recent injury) so that we can adapt the session or advise against it. We use that information only for that session, with your explicit consent (Art. 9(2)(a) GDPR), and we do not record it in our systems.
2.5. Marketing communications
- Purpose: to send you news, offers and promotions from Quiroesencia by email or WhatsApp.
- Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE), which you can withdraw at any time using the unsubscribe link in each email, by replying "BAJA" (unsubscribe) on WhatsApp or by emailing info@quiroesencia.com.
- Retention: until you withdraw your consent and, in any case, three years after your last interaction with us.
2.6. Cookies, analytics and advertising
- Purpose: to measure visits to the website and the effectiveness of our ads.
- Legal basis: your consent through the cookie banner (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE).
- More information: in our Cookie policy.
2.7. Record of your cookie preferences
- Purpose: to be able to show what you chose in the cookie banner and when.
- What we store: date and time, the categories you accepted or rejected, the banner version, country, language and page. We do not store your IP address or any data that directly identifies you.
- Legal basis: compliance with the obligation to be able to demonstrate consent (Arts. 6(1)(c) and 7(1) GDPR).
- Retention: 3 years from the date of your choice.
2.8. Website security and operation
- Purpose: to protect the website against attacks and abuse and keep it available.
- Data: technical connection data, such as your IP address and browser, processed by our hosting provider.
- Legal basis: our legitimate interest in website security (Art. 6(1)(f) GDPR).
- Retention: the short period set by the provider for its security logs.
3. Do you have to give us your data?
To book or buy a session package or gift card, we need your name and a way to contact you; without them we cannot manage the booking. All other data is optional.
4. Who we share your data with
We do not sell or share your data with third parties, except where required by law (for example, with the Spanish Tax Agency or the courts). To provide our services, we use providers that process data on our behalf (data processors), under contract and following our instructions:
| Provider | Purpose | Where data is processed |
|---|---|---|
| Square (Block, Inc. and its affiliates) | Bookings, payments, session packages, gift cards and customer records | EU and US |
| Cloudflare, Inc. | Website hosting and security, and record of cookie preferences | EU and US |
| Google Ireland Ltd. / Google LLC | Analytics (Google Analytics), ad measurement (Google Ads), email and document storage | EU and US |
| Meta Platforms Ireland Ltd. (WhatsApp) | Messaging with customers and WhatsApp assistant | EU and US |
| n8n GmbH | Technical operation of the WhatsApp assistant | EU |
| Anthropic, PBC (Claude) | Artificial intelligence for the WhatsApp assistant and internal administrative support | US |
| Brevo (Sendinblue SAS) | Sending marketing emails | EU |
| Accounting and tax advisors | Bookkeeping, invoicing and taxes | Spain |
Anthropic does not use the data we send to train its models. We do not enter health data into any artificial intelligence tool.
5. International transfers
Some of these providers may process data in the United States. In those cases, transfers are covered by the EU-U.S. Data Privacy Framework (for participating companies) or by the standard contractual clauses approved by the European Commission.
6. Your rights
You can exercise the following rights at any time:
- Access: find out what data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: ask us to delete your data when it is no longer needed.
- Objection: object to certain processing, such as marketing communications.
- Restriction: ask us to temporarily stop using your data.
- Portability: receive your data in a commonly used format.
- Withdraw your consent where processing is based on it, without affecting processing carried out before.
To exercise them, email info@quiroesencia.com stating which right you wish to exercise. If we have doubts about your identity, we may ask for additional information to confirm it. We will reply within one month, which may be extended by two further months for complex requests (we will let you know if so).
If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Automated decision-making
We do not make decisions based solely on automated processing that produce legal effects concerning you, nor do we create profiles for that purpose. The WhatsApp assistant only answers informational questions.
8. Minors
If you are under 14, you need the consent of your parent or legal guardian to give us your data.
9. Security
We apply appropriate technical and organizational measures to protect your data: access limited to authorized people, encrypted connections and providers that offer security guarantees.
10. Changes to this policy
We may update this policy to reflect legal changes or changes to our services. The version in force is always the one published on this page, with its update date.
This English version is provided for convenience. In case of discrepancy, the Spanish version prevails.