Privacy policy

1. Data controller

• Name: Lucía Borghi
• Tax ID (NIF): [PENDIENTE — Lucía]
• Address: [PENDIENTE — Lucía]
• Email: [PENDIENTE — Lucía]

2. What data we process and why

When you book a discovery session, an individual session, or a place in the four-session package, we process your name, your email and, if you leave it, your phone number, in order to manage that booking and to communicate with you about it.

3. Legal basis

Processing your name and email to manage the booking is based on taking pre-contractual steps at your request (GDPR art. 6.1.b): you provide them so we can schedule the session you asked for.

Processing your phone number is based on your explicit consent (GDPR art. 6.1.a): it is optional, we only process it if you choose to provide it, and you can book and be attended to without it.

4. Your phone number, in detail

If you leave your phone number when booking, we use it for a single purpose: so that Lucía can send you a WhatsApp reminder before your session. It is not used for anything else, is not shared with third parties outside this purpose, and is never added to any mailing or messaging list.

The path it travels is short. The booking engine (Cal.com) collects it on the form. Our own server (Cloudflare Workers) receives it to put the message together, but does not store it or log it anywhere: it is processed on the fly and discarded as soon as it responds. From there, the email provider (Resend) delivers it to Lucía inside an email, already formatted as a ready-to-send WhatsApp link. The number remains, inside that email, in the brand's inbox, until that email is deleted — there is no separate database where it is stored.

5. Data processors

The following providers process data on our behalf, each for its own part:

• Cloudflare — hosts the site and runs the server that puts the reminder together, without storing personal data.
• Cal.com — the booking engine: collects name, email, optional phone number and the chosen time, and syncs the session to Lucía's Google calendar.
• Google — Google Calendar, where the booked session is recorded.
• Resend — sends the automatic confirmation emails and the internal notice to Lucía.

6. When online payment is enabled

Today, paid sessions are settled directly with Lucía, by bank transfer or Bizum, off the site: no payment data passes through it. The day online payment is enabled, this policy will be updated before that date to name the payment processor as a new data processor.

7. International transfers

Cloudflare, Cal.com, Google and Resend may process data outside the European Economic Area. Each applies the GDPR safeguards for international transfers set out in its own privacy policy, such as standard contractual clauses.

8. How long we keep your data

Booking data is kept for as long as our relationship with you lasts and, afterward, for the periods required by tax law and to defend against possible claims. Your phone number is not kept in any system of ours: see clause 4.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, by writing to [PENDIENTE — Lucía].

If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

10. Cookies

This site does not use analytics or advertising cookies, and does not show a cookie banner because it does not need one: no non-essential cookie is installed while you browse. The only external element, the Cal.com booking widget, loads only when you click to see available times — an action you choose to take.