1. Data controller
Gleidys Medina, owner of SISU-NAILS. Contact email: info@sisunails.com. Tax ID (NIF): Z0781544D. Registered address: Calle José García Sánchez 21, principal A, 50005 Zaragoza, Spain (registered address for notifications; not premises open to the public nor the place where services are provided).
2. What data we collect and why
Depending on how you interact with the site, we process the following data:
- Booking an appointment: first name, surname, email, phone, chosen service, date and time, and comments. Purpose: to manage and confirm your appointment.
- Contact: name, email, phone (optional) and message. Purpose: to reply to your enquiry.
- Client account and "My details": in addition to the above, your password (encrypted) and, optionally, a profile photo, date of birth, gender and postcode (with province and region). Purpose: to manage your account, your profile and your booking history.
- Appointment history: we keep your bookings linked to your account so you can check them and so we can manage the service.
- Blog newsletter: your email, if you subscribe. Purpose: to notify you of new articles. The subscription is only activated when you confirm it from the link we email you, and you can unsubscribe at any time from the link included in every email.
- Photos of work done and testimonials: the photos you send us after your appointment are stored in a private space linked to your account and are not published on their own. We only publish a photo or a comment of yours on the website (testimonials section or gallery) if you have given your express authorisation by ticking the corresponding box when sending them, and always with your first name only, never your surname. You can withdraw that authorisation at any time by writing to info@sisunails.com and we will remove the publication.
- "Book again" reminder: if you are a client, about 15 days after an appointment we may email you a reminder that it may be time to renew the treatment and, if there is one, the current gift card promotion. We only send it to clients with an account and you can object at any time: with the box on the booking form, in "My details" in your account, or with the "I do not want to receive these reminders" link at the foot of every email.
- Sign-in with Google or Facebook: if you choose to sign in this way, the provider sends us your name and email to create or find your account. We do not receive your password or any other data from your profile on those networks. See section 6.
- "Rate us on Google" button: when you click that button (on the website or in an email) we note in your account that you have done so, solely so that we do not ask you again. We do not know whether you finally published a review or what you wrote.
- Our own audience measurement: we count visits and which sections are used with a tool hosted on our own server, with no third parties. Your IP address is not stored: to tell visits from different people apart within the same day, a code is generated from your IP, your browser and a key that changes every day, so the next day that code can no longer identify you. Data is kept for a maximum of 400 days and is deleted automatically.
- Form security: to stop spam and brute-force login attempts we store, for a maximum of 24 hours, your IP address linked to each form submission or login attempt (rate limiting). After that period it is deleted automatically.
3. Legal basis for processing
- Your consent (art. 6.1.a GDPR), which you give by ticking the acceptance box on the corresponding form. You can withdraw it at any time by writing to info@sisunails.com, without affecting the lawfulness of processing carried out before withdrawal.
- Performance of the service you request (art. 6.1.b GDPR), in the case of managing your appointment.
- Compliance with legal obligations (art. 6.1.c GDPR), for example tax and accounting rules.
- Our legitimate interest (art. 6.1.f GDPR) in: keeping the site secure (rate limiting by IP), understanding in aggregate how the website is used (our own audience measurement, without identifying you) and, for existing clients, sending the "book again" reminder about services similar to those booked (art. 21.2 of the Spanish Information Society Services Act, LSSI-CE). In all these cases you can object whenever you wish (section 7); the reminder also carries a one-click unsubscribe link in every email.
4. Minimum age
To book an appointment through this site you must be 16 or older. By requesting an appointment you confirm that you meet this requirement. People under 16 may come to the salon accompanied by their mother, father or legal guardian, who will manage the booking.
5. Data retention
- Account and profile data: for as long as you keep your account active. You can request its deletion whenever you wish.
- Appointment and invoicing data: for the periods required by tax and commercial law (generally 4 to 6 years).
- Newsletter data: until you unsubscribe.
- Contact form enquiries: for as long as needed to deal with them and, afterwards, until the legal limitation period expires.
- Photos of your appointments (private space in your account): until you remove them or delete your account. Published testimonials and photos: until you withdraw your authorisation.
- Audience measurement data: 400 days, automatic deletion.
- Form security records (IP per attempt): 24 hours, automatic deletion.
- Preference about the "book again" reminder: for as long as your account exists, so we can honour your objection.
6. Recipients
Your data is not disclosed to third parties, except where required by law. We use the hosting and email provider IONOS (1&1 IONOS España S.L.U.), with servers in the European Union, as a data processor to store the data and send the service emails.
Sign-in with Google or Facebook. Only if you decide to use this option, the provider you choose (Google Ireland Limited / Google LLC, or Meta Platforms Ireland Limited / Meta Platforms, Inc.) acts as an independent controller of the processing it carries out to identify you, under its own privacy policy, and sends us your name and email. These providers may process data in the United States, which is an international transfer; both are certified under the EU-US Data Privacy Framework and apply the standard contractual clauses approved by the European Commission. If you prefer to avoid this, you can create your account with email and password, which involves no transfer outside the European Union. Apart from this case, we make no international data transfers.
7. Your rights
You have the right to access your data, rectify it, erase it, object to its processing, request restriction, exercise portability and withdraw your consent at any time. To exercise them, write to info@sisunails.com stating the right you wish to exercise.
In particular, you can object to receiving the "book again" reminder without writing to us: by ticking the box on the booking form, from "My details" in your account, or with the unsubscribe link in each of those emails. And you can withdraw the authorisation to publish a testimonial or a photo by writing to us: we will remove it from the website without affecting the lawfulness of the previous publication.
If you believe we have not handled your request correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain — www.aepd.es.
8. Security
We apply technical and organisational measures to protect your data: encrypted connection (HTTPS), passwords stored encrypted, restricted access to information and backups managed by the hosting provider.
9. Cookies
This site uses only the technical session cookie needed for it to work and does not load third-party resources. The audience measurement described in section 2 uses no cookies and stores nothing in your browser. More information in our Cookie Policy.