Privacy & Cookie Policy

The data controller is the business operating as AMBAR Massage Barcelona, Rambla de Catalunya 124, Eixample, 08008 Barcelona, Spain. Privacy requests may be sent to ambarmassagebcn@gmail.com or +34 614 797 769 by phone or WhatsApp.

This policy applies to this website and to booking communications handled directly by AMBAR. Third-party websites and apps have their own policies.

When you contact or book with us, we may process your name or alias, phone number, email address, preferred language, requested date and time, selected treatment, therapist preference, message history, and payment or transaction details where applicable.

We may also process limited technical information such as consent status, page views, referring page, device and browser type, approximate location, IP address, and booking-link interactions when the relevant tool is active. We do not use solely automated decisions that produce legal or similarly significant effects.

We use booking and contact information to answer enquiries, take steps requested before a booking, confirm and deliver an appointment, provide customer care, and manage related records. The legal bases are steps taken at your request before a contract, performance of the booking agreement, and legal obligations that apply to business records.

We may use limited information to protect guests, staff, the website, and legal claims where this is necessary for our legitimate interests and does not override your rights. Optional Google Analytics and PostHog analytics run only with your consent, which may be withdrawn at any time.

A request for an adult massage or a message about health, sex life, or sexual orientation may reveal specially protected information. Please share only what is necessary for safety, comfort, boundaries, and the requested service.

Where processing of this information is not otherwise permitted by law, we rely on your explicit and voluntary disclosure and consent. You may withdraw that consent, although this does not affect processing that was lawful before withdrawal or information that must be retained for a legal claim.

The website presents one combined confirmation button for age and cookie consent. Selecting ‘I am over 18 and I accept’ stores an age-verification cookie and an analytics-consent cookie for up to 12 months. These cookies are not used for advertising.

Google Analytics and PostHog remain off until you select the confirmation button. You can withdraw consent by clearing AMBAR site cookies and site data in your browser, then leaving the website, or by contacting ambarmassagebcn@gmail.com. Withdrawal prevents future optional tracking but cannot undo processing already completed.

Information is accessible only to AMBAR personnel and service providers who need it for booking, communications, hosting, security, accounting, or consented analytics. Depending on how you contact us and your consent choice, providers may include WhatsApp or Meta, email and hosting providers, Google Analytics, and PostHog.

Some providers may process information outside the European Economic Area. Where required, transfers must rely on an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism. Each provider also processes information under its own privacy terms.

We keep enquiries and booking communications only for as long as reasonably needed to respond, manage the appointment, provide follow-up care, handle disputes, and meet tax, accounting, or other legal duties. The period depends on whether a booking was completed, whether a transaction record must be retained, and whether a claim is possible.

Sensitive preferences that are no longer needed should be deleted or separated from routine records. Consent cookies expire after 12 months unless you replace or delete them sooner. Analytics retention is also limited by the settings and policies of the accepted provider.

AMBAR uses reasonable technical and organisational measures to limit access, avoid unnecessary collection, and protect information against loss, misuse, or unauthorised disclosure. No internet or messaging service can be guaranteed completely secure, so avoid sending identity documents, financial credentials, or intimate detail that is not needed for your booking.

Subject to the conditions in applicable law, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; and ask for information about recipients and transfers. A request may be sent to ambarmassagebcn@gmail.com. We may need to verify your identity and normally respond within one month.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es. Some rights are not absolute, and information may be retained where a legal duty or the establishment, exercise, or defence of claims requires it.

We may update this policy when our services, providers, or legal obligations change. The date above identifies the current version. Material changes will be presented clearly on the website where appropriate.