Privacy policy

1. Data controller

• Controller: José María Gomaríz García
• Tax ID (NIF): 30543195T
• Address: C/ La Unión Mercantil nº 34, Local 8, 29004 Málaga, Spain
• Data Protection Officer (DPO) email: dpd@somosnuva.com

2. Purposes

• Handling information requests, appointments and queries sent through the website.
• Providing the contracted services (assessments, programs and treatment follow-up).
• Complying with applicable legal, accounting and aesthetic-sector obligations.
• Sending informational communications related to your services, only where there is a legal basis or consent.

3. Legal basis

• Your explicit consent when submitting the form or accepting this notice.
• Performance of a contract or pre-contractual measures requested by the data subject.
• Compliance with legal obligations applicable to the aesthetic activity.
• Legitimate interest in site security and fraud prevention.

4. Retention

Data will be kept for the time required to fulfil the purpose for which it was collected and to determine any liabilities. Treatment data will be retained in accordance with applicable aesthetic-sector regulations (at least 5 years from the end of the treatment process).

5. Recipients and processors

Data will not be shared with third parties except where required by law. Necessary technology providers (hosting, email, centre management tools) may access data as processors under a contract compliant with art. 28 GDPR.

6. International transfers

Some providers may be located outside the European Economic Area. In such cases, Standard Contractual Clauses approved by the European Commission, or other adequate safeguards under GDPR, are used.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to dpd@somosnuva.com with a copy of an identification document. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply appropriate technical and organisational measures in line with the state of the art to ensure a level of security appropriate to the risk, including encryption, role-based access control and audit logging.