Privacy Policy
Last updated: 19 September 2026
This policy explains what personal data we collect on https://siamthaimassage.es, what we use it for, who we share it with and what rights you have. It is drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).
1. Data controller
- Controller: Chayanun Pratsersin (Siam Thai Massage)
- Address: Calle Iriarte 9, Santa Cruz de Tenerife
- Telephone: +34 822 90 91 47
2. What data we process, why, and on what legal basis
2.1 Booking an appointment
Data: name, email address, telephone number, type of massage, date and time, chosen language and, if you write them, notes or preferences (for example, an area to avoid). Please do not include health information in the notes beyond what is strictly necessary for us to look after you properly.
Purpose: managing the appointment: assigning a therapist and room, sending you the confirmation and a reminder, letting you cancel from the link in the email and notifying you of any changes.
Legal basis: performance of the service contract you request (Art. 6.1.b GDPR). Without this data we cannot process the booking.
Retention: up to 12 months after the appointment date, so that we can deal with queries or complaints or repeat the booking. After that period the booking is anonymised: the name, email, telephone number and notes are erased, and only the record of the appointment (massage, date, therapist and status), which no longer identifies you, is kept for the centre's statistics.
2.2 Buying gift cards
Data: first name, surname, email address, telephone number, billing address, purchase details and, if you provide it, the name of the person you are giving the voucher to. We do not store bank card details: payment is processed directly by the gateway you choose (Stripe or PayPal).
Purpose: processing the order, issuing the voucher and the invoice, and handling refunds or problems.
Legal basis: performance of the purchase contract (Art. 6.1.b GDPR) and compliance with tax and accounting obligations (Art. 6.1.c GDPR).
Retention: billing data is kept for as long as required by tax and commercial law (generally 6 years from the last accounting entry). Customer account data, if you create an account, is kept until you close it.
2.3 Enquiries by telephone, WhatsApp or email
Data: whatever you provide when you contact us (name, number, email, content of the message).
Purpose: answering your enquiry.
Legal basis: our legitimate interest in responding to those who write to us and the pre-contractual steps you request (Art. 6.1.b and 6.1.f GDPR).
Retention: until the enquiry is resolved and, at most, 12 months.
2.4 Browsing and statistics
With your consent, we use Google Analytics to understand in aggregate how the website is used. Details are in the Cookie Policy, where you can change your choice at any time. Legal basis: consent (Art. 6.1.a GDPR).
For security reasons, the booking system limits the number of requests that can be made from the same IP address in a short period. The IP address is used only for that count, in pseudonymised form and for a maximum of one hour; it is not stored with the booking.
3. Who we share data with
We do not sell or pass on your data to third parties for their own purposes. To provide the service we use providers that process data on our behalf as processors, under the contracts required by Art. 28 GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Webempresa (Webempresa Europa, S.L.) | Website hosting, database and sending of emails | European Union |
| Google (Google Ireland Ltd.) | Google Calendar: the appointment (name, service, time and telephone number) is entered in the centre's internal diary to organise the team. Google Analytics: usage statistics, only with your consent. Google Fonts: the website's typefaces. | EU and USA. Google is certified under the EU-US Data Privacy Framework and applies standard contractual clauses. |
| Stripe (Stripe Payments Europe, Ltd.), via WooPayments | Processing card payments for gift cards | EU and USA (Data Privacy Framework and standard contractual clauses) |
| PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) | Processing the payment if you choose PayPal | European Union |
| CookieYes (CookieYes Ltd.) | Managing the cookie notice and the record of your consent | United Kingdom (country with an EU adequacy decision) |
Stripe and PayPal also act as independent controllers for payment processing and fraud prevention, in accordance with their own privacy policies. If you contact us via WhatsApp, the conversation is also governed by the WhatsApp (Meta) privacy policy.
We may disclose data to public authorities, courts or law enforcement when required to do so by law.
4. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given without affecting the lawfulness of previous processing.
To do so, write to us at Calle Iriarte 9, Santa Cruz de Tenerife, stating which right you wish to exercise and some detail that allows us to identify you (for example, the email address you booked with). If we have reasonable doubts about your identity, we may ask you to prove it. We will reply within one month at most.
If you believe we have not handled your rights correctly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
5. Minors
The centre's services and the website are intended for adults. Children under 14 may not provide their data through the website; bookings for minors must be made by their parents or guardians, who will accompany them to the session.
6. Security
We apply technical and organisational measures appropriate to the risk: the website runs over HTTPS encryption, access to the diary is restricted to the centre's staff by username and password, the appointment management links are unique and impossible to guess, and we do not store payment data. If a security breach occurred that posed a high risk to your rights, we would inform you without delay.
7. Changes to this policy
We may update this policy when the website's services or the law change. The current version will always be the one published on this page, with its update date.