Privacy Policy
Last updated:
Who we are
This policy explains how Costa Adeje, a studio of Lava Massage, at Av. de Europa 18, 38660 Costa Adeje, Santa Cruz de Tenerife, Spain, handles your personal data when you book a visit, use your client account or talk to us. Costa Adeje is the data controller.
You can reach us at +34 602 743 565.
What data we collect
Contact details: your name, phone number and email address.
Account details: if you sign in with Google or Telegram, the identifier and the name and email that the provider shares with us; if you use our Telegram bot, your Telegram user id.
Booking history: services, masters, dates, cancellations and no-shows.
Health notes: information about your health (for example contraindications) only if you give separate, explicit consent. You can withdraw it at any time.
Session notes: short notes your master writes after a visit to provide safe and consistent care.
Feedback: your rating and comment after a visit. We publish a review on our website only if you agree to it.
Marketing preference: whether you want to receive occasional offers.
Why we use it and on what legal basis
To take, confirm, remind you of and manage your bookings, and to run your client account — necessary for the contract with you (GDPR art. 6(1)(b)).
To keep health notes and send marketing offers — your consent (art. 6(1)(a) and art. 9(2)(a)). Without consent we do not store health notes and do not send offers.
To keep session notes, protect the service against abuse and spam, improve our service from feedback and keep basic records — our legitimate interest (art. 6(1)(f)).
To keep accounting records required by law — legal obligation (art. 6(1)(c)).
Who processes it for us
Hosting: our system runs on our own servers in the European Union.
Brevo: sends booking confirmations, reminders and other emails.
Telegram: delivers messages if you use our Telegram bot or sign in with Telegram.
Google: verifies your identity if you choose to sign in with Google.
Cloudflare Turnstile: may check that the booking form is used by a person and not a bot.
We do not sell your data and do not share it with advertisers. Providers outside the EU act under the safeguards required by the GDPR, such as standard contractual clauses.
How long we keep it
We keep your data while you are our client. If you have no visits for 36 months, your personal data is anonymised automatically; anonymous booking statistics may remain.
Messages exchanged with our bots are kept for 30 days.
When you ask us to delete your account, we remove your personal data after reviewing the request, except what we must keep by law.
Your rights
You can access your data, correct it, download a copy (data portability), restrict or object to processing, withdraw any consent and ask us to delete it.
In your client account (Account page) you can edit your details, manage consents, export your data and request deletion of your account. You can also contact the studio at +34 602 743 565.
You have the right to complain to your national data protection authority.
Changes to this policy
We may update this policy when our service changes. The date at the top shows the latest version.