Privacy Policy

The data controller responsible for processing your personal data is:

Business name: Beauty & Body by Micha

Data controller: Michaela Babicova

NIF/NIE: Z1047382J

Business address: C. Flor de Pascua, 31, 38683 Santiago del Teide, Santa Cruz de Tenerife, Spain

Email: misciababic@gmail.com

WhatsApp: +34 663 377 154

Instagram: @micha.beautybody

For privacy-related questions or to exercise your data protection rights, please contact me by email.

Depending on your interaction with Beauty & Body by Micha and the services you request, I may process the following categories of personal data.

Contact and booking data

Name and contact details.

Messages exchanged through WhatsApp, Instagram Direct, email or other communication channels.

Requested services, appointment dates, booking changes and cancellations.

Deposit, payment and transaction information where necessary for business administration and accounting.

Treatment records and health information

Information you provide about allergies, skin conditions, sensitivities, medication or other health-related circumstances relevant to the safe provision of a treatment.

Treatment consultation forms, informed consent forms and aftercare records.

Relevant treatment notes and photographs, where applicable.

Health information is a special category of personal data under the GDPR and receives additional protection.

Photographs and promotional content

Before-and-after photographs or other images taken in connection with a treatment, where applicable.

Photographs or videos used for promotional purposes only where the required separate consent has been obtained.

Website and advertising data

Technical information, cookie identifiers and website usage data may be processed if relevant technologies are installed on the website.

Beauty & Body by Micha uses Google Ads and Meta Ads for advertising. Tracking, conversion measurement or remarketing technologies may be used where configured and legally permitted.

Meta Pixel is intended to be installed on the new website. Its use will be subject to the applicable consent and data protection requirements once implemented.

Personal data are processed only for specified and legitimate purposes.

Enquiries and appointment management

I use contact details and booking-related messages to respond to enquiries, arrange appointments, communicate changes and provide the services requested.

Legal basis: steps taken at your request before entering into a contract and, where applicable, performance of the contract.

Providing treatments and maintaining treatment records

Relevant information may be used to assess whether a treatment is appropriate, document the consultation, record consent to the procedure and provide aftercare guidance.

Where health data are processed, the processing must have a valid legal basis under Article 6 GDPR and an applicable condition under Article 9 GDPR. Where explicit consent is the appropriate basis for processing health data, it will be requested separately and clearly.

You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If necessary information cannot lawfully be processed, I may be unable to provide a treatment safely.

Payments, accounting and legal obligations

Relevant booking and transaction information may be processed to record payments, manage deposits, meet applicable tax and accounting obligations and establish, exercise or defend legal claims where necessary.

Legal basis: performance of a contract, compliance with legal obligations and, where applicable, legitimate interests or the establishment, exercise or defence of legal claims.

Photographs and marketing

Photographs or videos may be used to promote Beauty & Body by Micha only where separate, voluntary and sufficiently specific consent has been obtained.

Where applicable, the consent will identify the intended uses, such as the business website, social media, portfolio materials and paid advertising. Consent to marketing use is separate from consent to receive a treatment. Refusing marketing consent will not, by itself, prevent you from booking a treatment.

Where consent is the legal basis, it may be withdrawn at any time for future use by contacting me. Withdrawal does not make previous lawful processing unlawful. Following withdrawal, I will stop relying on that consent for future use and take appropriate steps regarding content under my control. It may not always be possible to retrieve copies already shared or independently republished by third parties.

Advertising, analytics and cookies

Google Ads and Meta Ads are used for advertising. Website tracking, conversion measurement, remarketing or similar technologies will be used only where actually implemented and in accordance with applicable law.

Where consent is legally required, non-essential advertising and analytics cookies or technologies will not be activated before valid consent is obtained. You should be able to make an informed choice through the website's cookie settings.

The technologies actually active on the published website, their providers, purposes and retention settings must be reflected in the accompanying Cookie Policy.

Treatment-related health questionnaires and signed consent forms are currently stored in paper form only.

Paper documents are kept in a secure location, with access restricted to persons who need the information for legitimate professional purposes. Appropriate organisational measures are taken to reduce the risk of unauthorised access, disclosure, loss or damage.

Health information is collected only to the extent relevant to the requested treatment and its safe provision. It is not used for unrelated marketing purposes.

If digital storage of treatment records is introduced in the future, this policy will be reviewed and updated as necessary.

Personal data may be shared where necessary with:

Providers supporting communication, website hosting, appointment management or business administration.

Accounting or payment service providers, where relevant.

Google and Meta, to the extent their advertising or measurement services are actually used.

Professional advisers, public authorities or courts where required by law or necessary to establish, exercise or defend legal claims.

The use of WhatsApp, Instagram and other third-party platforms is also subject to their own privacy terms and technical arrangements.

I do not sell your personal data.

Some service providers may process personal data outside the European Economic Area. This depends on the services used and how they are configured.

Where an international transfer takes place, it must comply with applicable GDPR requirements. Appropriate safeguards will be used where required, and information about relevant safeguards may be requested from the data controller.

Personal data are kept only for as long as necessary for the purposes for which they were collected, subject to applicable legal retention obligations.

Enquiries and booking messages: for the period needed to manage the enquiry, appointment and related follow-up.

Accounting and transaction records: for the periods required by applicable tax and accounting law.

Treatment records, health questionnaires and signed consent forms: for a documented retention period appropriate to the treatment-related purpose, applicable legal obligations and the need to establish, exercise or defend legal claims.

Marketing consent records: for as long as necessary to demonstrate the permission given and its scope, including after withdrawal where retaining evidence is necessary.

Marketing photographs and videos: until consent is withdrawn or the content is no longer used, subject to any applicable legal requirements.

Website and advertising data: according to the actual technologies used, applicable consent choices and the retention settings of the relevant providers.

When personal data are no longer required, they will be securely destroyed, deleted or anonymised where appropriate, unless the law requires continued retention.

Subject to the conditions and limitations of applicable law, you may have the right to:

Request access to your personal data.

Request correction of inaccurate or incomplete data.

Request erasure of your data.

Request restriction of processing.

Object to processing where the relevant legal conditions are met.

Request data portability where that right applies.

Withdraw consent at any time where processing is based on consent.

Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD).

To exercise your rights, contact misciababic@gmail.com. I may need to verify your identity before responding.

You can find information about the AEPD at https://www.aepd.es/.

Some information is necessary to respond to an enquiry, arrange a booking, fulfil legal obligations or assess whether a treatment can be provided safely.

If you do not provide information that is necessary for these purposes, I may be unable to arrange the appointment or provide the relevant treatment.

Consent to the use of photographs for marketing is voluntary and is not a condition of receiving a treatment.

I do not intend to make decisions about you based solely on automated processing that produce legal effects or similarly significant effects. If this changes, this policy will be updated as required by law.

This Privacy Policy may be updated to reflect changes in the business, services, applicable law or technologies used. The current version and its effective date will be published on the website.