← Back to Home

Privacy Policy

Protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR), the French Data Protection Act (Loi Informatique et Libertés), and Spanish Organic Law 3/2018 (LOPDGDD), as services are delivered in Spain by a French-registered auto-entrepreneur.

1. Data Controller

The entity responsible for processing your personal data is:

2. Data Protection Officer (DPO)

As a sole-proprietor auto-entrepreneur processing only a limited volume of personal data for booking and communication purposes, the appointment of a Data Protection Officer is not required under Article 37 GDPR. For any data protection inquiries, please contact the data controller using the details listed above.

3. What Personal Data We Collect

We collect and process the following personal data:

We do not collect any special categories of personal data (health data, biometric data, etc.) unless specifically required and with your explicit consent.

4. Purpose and Legal Basis for Processing

4.1 Booking Management

Purpose: To confirm, manage, and fulfil your treatment bookings. Bookings are handled through Cal.com, which acts as a data processor on our behalf to provide the scheduling widget, confirmation emails, and calendar synchronisation.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) — processing is necessary to provide the service you have requested. The transfer of your booking data to Cal.com is covered by a Data Processing Addendum (DPA) under Art. 28 GDPR and, where applicable, EU Standard Contractual Clauses.

4.2 WhatsApp Communication

Purpose: To communicate with you regarding bookings, scheduling, and service-related queries via WhatsApp.

Legal basis: Consent (Art. 6(1)(a) GDPR) — by initiating contact via WhatsApp, you consent to communication through this channel. Legitimate interest (Art. 6(1)(f) GDPR) — to respond to your inquiries and provide customer service.

4.3 Payment Processing

Purpose: To process payments for services rendered.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

4.4 Analytics & Marketing (Coming Soon)

Purpose: To analyse website usage and measure the effectiveness of marketing campaigns.

Legal basis: Consent (Art. 6(1)(a) GDPR) — we will request your consent before activating Google Analytics or Meta Pixel tracking. See our Cookie Policy for details.

5. Data Recipients & Third Parties

Your personal data may be shared with the following third parties, all of whom act as data processors under a written Data Processing Agreement with the data controller (Art. 28 GDPR):

We do not sell your personal data to any third party.

6. International Data Transfers

Some of our third-party service providers (Cal.com, Google Workspace, WhatsApp, Google Analytics, Meta, PayPal, GoDaddy) may transfer your data outside the European Economic Area (EEA), primarily to the United States. Where this occurs, we ensure appropriate safeguards are in place, including:

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined above:

After the retention period, your data will be securely deleted or anonymised.

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

To exercise any of these rights, please contact us at: info@magicaltouchbyvanessa.com

As the data controller is established in France and services are provided in Spain, you have the right to lodge a complaint with either supervisory authority:

9. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. This includes:

10. Cookies

Our website uses cookies. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "last modified" date. We encourage you to review this page periodically.

Last updated: 1 April 2026