1. Data Controller
- Holder: ARAYA WELLNESS & BEAUTY LIMITED COMPANY (trade name: ARAYA)
- CIF: B23888845
- Address: Carrer del Riu Xúquer, 47, 12006 Castelló de la Plana (Castellón)
- E-mail: arayarituals@arayarituals.es
- Phone / WhatsApp: 651 15 93 12
2. What data do we process and for what purpose?
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| Online bookings | Name, email, phone number, service, date and time, notes | Manage, confirm and remind you of your appointment, and handle changes or cancellations | Contract execution |
| Customer record | Contact information, visit history, and session observations | To attend to you and adapt each session to you. | Contract execution and, for health data, your explicit consent |
| Online payments and gift cards | Payment details (handled by Stripe; ARAYA does not see or store your card), recipient's name, and message | Charge for the experience and issue the gift card | Contract execution |
| "Personalize your experience" forms« | Preferences, areas of tension and health information (injuries, allergies, pregnancy…) | Adapt the session safely | Your explicit consent |
| Company and contact forms | Name, company, email, phone, message | Respond to your request | Your consent or pre-contractual measures |
| Number and conversation | Handle inquiries and reservations | Your consent when writing to us | |
| Navigation and analytical cookies | Usage data | Measure and improve the web | Your consent in the cookie notice |
| Web security | IP and technical logs | Protect the web | Legitimate interest |
| Billing | Identification and tax information | Accounting and tax obligations | Legal obligation |
3. Health data
To ensure your safety, we may ask for information about your health (injuries, contraindications, allergies, or pregnancy). We only process this information with your explicit consent, This information is solely for the purpose of tailoring the service, and only the professionals who treat you have access to it. Providing it is not mandatory, but without it we may not be able to perform certain treatments. You can withdraw your consent at any time.
4. How long do we keep your data?
- Clients and appointments: 5 years since the last appointment.
- Billing: the period set by tax regulations (generally, 6 years).
- Health data: until you request to delete it or after 5 years without visiting.
- Contact requests that do not result in hiring: 12 months.
- Cookies: according to the Cookie Policy.
5. Who we share your data with
We do not sell your data. Only the service providers we need to deliver the service, acting as data processors, have access to it.
- Hostinger: Web and email hosting, with servers in the EU.
- Stripe: payments.
- Google: appointment calendar (customer name and service), gift card sending and registration, and Analytics and Search Console only if you accept analytics cookies.
- Meta / WhatsApp: if you write to us via WhatsApp.
- Customer management program: to save your profile, visit history, and session observations.
Some may process data outside the European Economic Area, always with the guarantees of the GDPR (standard contractual clauses or the EU-US Data Privacy Framework).
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, limitation and portability, and withdraw your consent, by writing to arayarituals@arayarituals.es. If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
We apply technical and organizational measures: encrypted connection (HTTPS), restricted access and backups.
8. Changes to this policy
The current version is always published on this page.
Last updated: October 13, 2026