Privacy policy
Last updated: 6 November 2026.
This is an English translation for your convenience. If there is any difference, the Spanish version prevails.
Here I explain, in plain language, what personal data Peluquero Santana processes, why, for how long and what rights you have, under the General Data Protection Regulation (GDPR, Regulation EU 2016/679) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
The basics
| Controller | Alexis Armas Santana (Peluquero Santana) |
|---|---|
| Purpose | Giving you appointments and answering your questions, providing and charging for the service, meeting legal obligations, publishing photos of work only if you authorise it, and keeping the website secure. |
| Legal basis | Your request and the service you ask for, legal obligations, your consent (photos) and legitimate interest (website security and reviews). |
| Who else sees it | The accountancy firm and public authorities when the law requires it, and the technical providers listed below (web hosting and WhatsApp, if you use it). I do not sell data. |
| Your rights | Access, rectification, erasure, objection, restriction, portability and withdrawal of consent, plus the option of complaining to the AEPD. |
1. Controller
| Owner | Alexis Armas Santana |
|---|---|
| Trade name | Peluquero Santana |
| Address | Calle José Díez Mora, 26, ground floor · 03205 Elche (Alicante), Spain |
| Telephone | +34 645 73 26 37 |
| santanapeluquero |
There is no data protection officer because, given the type and volume of data a hair salon processes, the law does not require one (article 37 of the GDPR and article 34 of the LOPDGDD).
2. What data I process
- Contact: your name and phone number. If you write to me on WhatsApp, also the name and profile photo you have in the app; if you write to me by email, your email address.
- Appointment: the day, time and service.
- Payment and invoicing: the receipt details and, only if you ask for a full invoice, your name or company name, your tax ID and your address.
- Image: photographs of your hair before and after the service, only if you sign the authorisation.
- Reviews: from the public Google reviews I show on the website, the text, the rating and the author's first name and surname initial.
- Technical visit data: IP address, browser type, date and time, processed by the hosting provider to serve and protect the website.
The website has no forms, registration or subscription. Apart from technical visit data, your data only reaches me when you call me, write to me or come to the salon.
3. Why, on what legal basis and for how long
| Purpose | Legal basis | How long |
|---|---|---|
| Giving you appointments and answering your questions by phone, WhatsApp or email | Taking steps at your request before providing the service (art. 6.1.b GDPR) | While I manage the appointment or question and for up to one year after the last contact |
| Providing the service, charging for it and issuing the receipt or invoice | Performance of the service you ask for (art. 6.1.b GDPR) and tax and accounting obligations (art. 6.1.c GDPR) | Invoicing data, for the periods set by tax and commercial law: generally four to six years |
| Handling complaints and rights requests | Legal obligation (art. 6.1.c GDPR, in connection with consumer and data protection law) | While they are processed and, afterwards, blocked for the periods in which liability may be claimed |
| Publishing photos of work (before and after) on the website and, if you tick it in the authorisation, on social media and the salon's Google listing | Your express written consent (art. 6.1.a GDPR and Spanish Organic Law 1/1982 on the right to one's own image) | Until you withdraw your consent; they are then removed as soon as possible |
| Showing on the website reviews that their authors published on Google | Legitimate interest in sharing real opinions about the salon, showing only the first name and surname initial (art. 6.1.f GDPR) | While the review remains published on Google and you do not object |
| Serving the website and protecting it against attacks and abuse | Legitimate interest in the website working and being secure (art. 6.1.f GDPR) | The minimum time set by the hosting provider for those technical logs |
Where the basis is legitimate interest, I have checked that your interests and rights do not override it: the data is minimal, technical or already public, and you can object at any time. If you wrote a review and would rather it didn't appear on the website, tell me and I'll remove it.
I do not use your data to send you advertising, I do not create profiles and I do not make automated decisions about you.
4. Whether you have to give me your data
To give you an appointment I need your name and a contact phone number. You don't have to give them to me, but without them I can't reserve a slot for you; in that case you can come without an appointment and I'll see you if there's availability. Full invoice details are only needed if you ask for one. Photos are always voluntary.
5. Health data
I do not ask for or record information about your health. If you mention something related to your health in conversation, such as an allergy or medical treatment, I use it only to provide the service safely at that moment, and I do not write it down or keep it.
6. Minors
For under-14s, the appointment is made and the details are given by their mother, father or legal guardian (article 7 of the LOPDGDD). No photos of minors are published.
7. Who else can see your data
- Cloudflare, Inc., which hosts and serves this website, as data processor. It is a United States company that participates in the EU-US Data Privacy Framework.
- WhatsApp, only if you choose to write to me there. In Europe the service is provided by WhatsApp Ireland Limited (Meta group), which processes messages under its business terms and may transfer them to WhatsApp LLC and Meta Platforms, Inc., in the United States, under the EU-US Data Privacy Framework. Your WhatsApp account is also governed by its own terms and privacy policy. If you prefer not to use it, call me.
- The accountancy firm that handles the salon's accounts and taxes, as data processor and only for invoicing data.
- The Spanish Tax Agency, the courts and other authorities, when a law requires it.
- The platforms where photos of work are published, only if you authorise it: Meta Platforms Ireland Limited (Instagram and Facebook) and Google Ireland Limited (Google listing). They process them under their own terms and may transfer them outside the European Union.
I do not sell or pass on your data to anyone for commercial purposes.
8. Transfers outside the European Union
The only data transfers outside the European Economic Area are those described in the previous section. Those by Cloudflare and WhatsApp are based on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, and on the other safeguards those companies offer in their contracts. You can ask me for more information about these safeguards.
9. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time and free of charge. If you gave me your consent, for example to publish photos, you can withdraw it whenever you like; withdrawing it does not affect what was done before.
To exercise them, write to me at santanapeluquero@gmail.com, send me a WhatsApp or tell me in the salon (Calle José Díez Mora, 26, ground floor · 03205 Elche). If I had reasonable doubts about your identity, I could ask you to prove it. I will reply within one month at most, which can only be extended by two more months in complex cases and after telling you.
If you feel I have not handled your request properly or that I am processing your data incorrectly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es; C/ Jorge Juan, 6 · 28001 Madrid).
10. Security
I apply proportionate technical and organisational measures to protect your data against loss, unauthorised access or misuse. I keep your data confidential and I never reply to a review or public comment with your data. The website only works over an encrypted connection (HTTPS).
11. Changes to this policy
If anything explained here changes, I will update this page and its date. More information about cookies in the cookie policy.