Legal
Privacy Policy
Last updated: 2 November 2026
Your privacy matters. This policy explains what personal data is collected through this website and the booking process, why, and what rights you have, in accordance with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Who is responsible for your data
- Data controller: David Muñoz Cayuela (“D · David”)
- Tax ID (NIF): 47321260W
- Address: Calle Mar del Norte 14, 1-G, 11500 El Puerto de Santa María, Cádiz, Spain
- Email: tsdmunozcayuela@gmail.com
- Phone / WhatsApp: +34 618 91 53 29
2. What data is collected
- When you contact me (WhatsApp, phone, email or social media): your name, contact details and the content of your messages.
- When you book an appointment (Google Calendar): name, email, phone number and the date and time of your session.
- When you fill in the first session form (Google Forms): email, name, date of birth, phone number, occupation, previous massage experience, physical activity level, reason for the session, and health information — allergies, previous injuries or surgeries, chronic or other illnesses, current medication or treatments and any other information you choose to share — together with your confirmation of the contraindications and your signature.
- When you browse this website: technical data such as your IP address, which the hosting provider processes to deliver and protect the site.
Health information is a special category of personal data. It is only requested because it is necessary to give you a safe, adapted treatment.
3. Why your data is used and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your questions and requests | Your consent and steps taken at your request before a contract |
| Managing appointments, sessions, payments and cancellations | Performance of the service you have requested |
| Assessing your condition, identifying contraindications and planning and following up your treatment | Your explicit consent (Art. 9.2.a GDPR), given when you submit the first session form |
| Keeping invoices and accounting records | Legal obligation |
| Keeping the website secure and working | Legitimate interest |
Your data is not used for advertising, is not sold, and no automated decisions or profiling are carried out.
4. How long your data is kept
Your data is kept while you are a client and for as long as necessary to provide and follow up your treatment. After that, it is kept blocked only for the periods required by law (for example, tax and accounting obligations) and then deleted. You can ask for your data to be deleted at any time (see section 7).
5. Who has access to your data
Your data is not shared with third parties, except:
- Service providers that process data on my behalf, under the corresponding agreements: Google (Google Forms, Google Calendar and related tools), Cloudflare (website hosting) and Meta (WhatsApp, if you contact me through it) and Notion (client records).
- Public authorities, when required by law.
6. International transfers
Some of these providers (Google, Cloudflare, Meta and Notion) may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission.
7. Your rights
You can at any time:
- access your data, or ask for it to be corrected or deleted;
- object to or ask to restrict its processing;
- ask for a copy of your data in a portable format;
- withdraw your consent, without affecting the processing carried out before.
To do so, write to tsdmunozcayuela@gmail.com or send a WhatsApp message to +34 618 91 53 29, indicating which right you want to exercise. You may be asked for proof of identity.
If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Age
The services are aimed at adults. If you are under 18, you need the consent of your parent or legal guardian to provide your data.
9. Security
Appropriate technical and organisational measures are applied to protect your data against loss, misuse or unauthorised access.
10. Changes to this policy
This policy may be updated. The date at the top shows when it was last changed.