Data, terms and the limits of liability
Last updated on 23.09.2026. The document applies to every visitor of {{DOMAIN}} and to everyone who gets in touch through the contacts listed on it.
This template has to be adapted to your jurisdiction
This is a general text written in neutral terms: it describes the actual data handling practice, but deliberately does not cite the laws of any particular country. Before publishing, have the document reviewed by a lawyer who practises in your jurisdiction — the mandatory details of the data controller, the wording of the legal basis, the retention periods, the consent requirements (including separate consent for health data), the rules for cookies and analytics, and the procedure for complaining to a supervisory authority all need to be checked. Until that is done, this document remains a draft rather than a legally verified policy.
1. Who processes the data
The data controller is the private practice Hondo Massage — Ale, Barcelona. The address for any enquiry about personal data: {{EMAIL}}. Phone: {{PHONE}}. Studio address: Balmes 200. I prepare the answers to such enquiries personally — the practice has no receptionist, no call centre and no external support department.
The policy covers the data you provide through the booking form on the site, through messengers and by phone, as well as the technical data the site receives automatically. Processing is carried out in accordance with the applicable data protection legislation.
2. What data is collected
The amount of data is deliberately minimal: only what is needed to contact you and to run a session safely is collected.
- Data from the booking form: your name or how you wish to be addressed, a phone number or messenger contact, an email address, the preferred date and time, the chosen service, the place of the session (home, hotel, office, studio) and the text of your message.
- Information about your health that you share voluntarily: complaints, how long the symptoms have lasted, past injuries and surgeries, chronic conditions, medication you take. This information belongs to a special category of data, is requested solely to assess contraindications and to choose pressure and working areas safely, and how much of it you share always remains up to you.
- Correspondence data: the content of messages in messengers and email, including the history of agreeing on the time, the address and the price.
- Technical data received automatically: IP address, browser type and language, device type, the address of the page you came from, the date and time of the visit, the pages viewed, cookie identifiers.
- Payment data to the extent needed to confirm a payment at your request. The site does not collect, transmit or store card details: the booking form does not take payments.
The site does not collect data on race or ethnicity, religious or political views, sexual life, or biometric data. No photography or video recording of any kind takes place during sessions.
3. Why the data is needed
- To reply to your enquiry: answer, ask follow-up questions, offer a time and name the final price.
- To organize the session: agree the address, the route and the length, send a reminder the day before, warn you about a change of time.
- To keep the session safe: assess contraindications, choose the pressure and the working areas, and decline the session if your state of health requires it.
- To keep a history of visits for regular clients, so that the same questions are not asked at every appointment and progress from session to session is visible.
- To confirm payment and prepare documents at your request.
- To understand how the site works: which pages are read, where people leave, where visitors come from — in aggregated form only, with no attempt to identify a particular person.
The data is not used for marketing mailings, is not sold and is not passed to data brokers. No automated decision-making or profiling with legal consequences for you is applied.
4. Legal basis
The basis for processing is your consent, expressed by a clear affirmative action. When you send the form, you tick the consent box; the box is not pre-ticked and can be cleared before sending. When you write on a messenger, call or send an email, you provide the data on your own initiative and for the purpose you state yourself — booking a session or asking about the services.
Information about your health is processed on the basis of your separate explicit consent and only to assess the safety of the session. You have the right not to share it at all: in that case I will tell you honestly that I cannot assess contraindications, and I have the right to decline the session. Some data may be retained after consent is withdrawn where this is necessary to comply with obligations under applicable law or to protect the legal interests of the parties.
5. How long the data is kept
- An enquiry that did not lead to a booking: up to six months from the last message, after which it is deleted.
- Contact details and session history of regular clients: up to three years from the date of the last visit, or until consent is withdrawn — whichever comes first.
- Information about your health: kept no longer than the contact details and deleted together with them; on a separate request it is deleted earlier than the rest.
- Correspondence in messengers and by email: within the same period; at your request it is deleted from my devices within a reasonable time.
- Documents confirming payment: for the period set by applicable law for keeping financial records.
- Aggregated web analytics statistics are kept in non-personalized form and are not linked to any particular person.
6. Sharing with third parties
Your data is not sold, not passed to advertising networks and not published. Technical access to it is limited to the infrastructure of the site and of the communication channels.
- The site’s hosting provider — hosts the site and handles form submissions as a technical processor, acting on my instructions and with no right to use the data for its own purposes.
- Communication service providers: messenger operators, the email service and the phone operator — to the extent that this is unavoidable in the very act of communicating through them. These services have their own privacy policies, which I do not influence; if that matters to you, write by email instead of a messenger.
- The web analytics service — in the form of anonymized visit statistics, if such a service is connected.
- Competent authorities — solely on a properly issued request provided for by applicable law.
Separately, on professional confidentiality: the content of your complaints, the course of the session and any information about your condition are not discussed with third parties, including your relatives and whoever paid for a certificate. If a session was a gift, the giver is told only that the certificate has been used.
7. Cookies and web analytics
Cookies are small files that a site stores in your browser. On this site they are used in two roles.
- Strictly necessary: they remember the chosen interface language and the fact that you closed the cookie notice, and they protect the form from automated submissions. Without them the site does not work properly, so they are always set.
- Analytical: they make it possible to see, in aggregated form, which pages are read, how long people spend on them and where visitors come from. They are set only after your consent in the cookie banner and are not used to identify a particular person.
Advertising and tracking cookies from third-party ad networks are not used on this site. You can decline analytical cookies in the banner on your first visit, and at any time afterwards by clearing the site’s cookies and blocking them in your browser. Declining does not restrict access to the content: all the pages, the booking form and the contacts keep working. Many browsers support a do-not-track signal, and this site respects it.
8. Security
- The site runs over the secure HTTPS protocol, and form data is transmitted encrypted.
- Only I have access to the correspondence and the client records; the devices are protected by a password and disk encryption.
- Health records are kept to the minimum needed for the safety of the session and are not exported to third-party services.
- Data is not stored in publicly accessible spreadsheets and is not sent over open channels.
- If an incident affecting your privacy occurs, I will notify you and — where applicable law requires it — the supervisory authority within the set deadline.
Absolute protection does not exist when data travels over the internet, and promising it would be dishonest. That is exactly why the amount of data is kept minimal: the less that is collected, the less can be lost.
9. Your rights
- To obtain confirmation that your data is being processed, and a copy of that data.
- To correct inaccurate or incomplete information.
- To have data deleted if the purpose of processing no longer applies, or consent has been withdrawn and there is no other basis for keeping it.
- To restrict processing — for example, while the accuracy of the data is being checked.
- To object to processing for purposes you consider unacceptable for yourself.
- To receive the data in a portable form — in a common machine-readable format.
- To withdraw consent at any moment, without giving a reason and without consequences for services already provided.
- To lodge a complaint with the data protection supervisory authority provided for by the applicable law of your country.
To exercise any of these rights, write to {{EMAIL}}. I reply within a reasonable period set by applicable law, and there is no charge for it. I may ask a clarifying question to be sure the request really comes from you — for example, asking you to write from the same address or number you used before.
10. How to withdraw consent
One message to {{EMAIL}}, or on the messenger we used, saying “I withdraw my consent to the processing of personal data” is enough. You do not need to justify the decision.
- After withdrawal I stop processing and delete the data, except what I am obliged to keep under applicable law — payment records, for instance.
- Deletion covers contact details, correspondence and health records; I send confirmation of the deletion in a reply message.
- Withdrawing consent does not affect the lawfulness of the processing carried out before it and does not cancel sessions that have already taken place.
- If you decide to book again after withdrawing consent, new consent will be required: restoring the deleted history will no longer be possible.
11. Children and teenagers
The site is addressed to adults. Data about minors is deliberately not collected. A booking for a teenager is made by a parent or legal guardian, who also gives consent to the processing of data and provides the health information; the session takes place in their presence and with the agreement of a paediatrician. If you learn that a child has submitted data on their own, write to {{EMAIL}} and I will delete it.
12. Terms of use
The second part of the document sets out the terms of use of the site {{DOMAIN}}. By continuing to use the site, you accept these terms. If you do not agree with them, please leave the site.
- The purpose of the site is informational. The site describes the services of the private practice Hondo Massage and lets you send a booking enquiry. It does not provide services by itself and is not a medical resource.
- Prices are not a public offer. The prices shown as tokens in the services and pricing sections are for reference; the final amount, taking the length and the travel zone into account, is named in the correspondence before booking and fixed at confirmation.
- A booking counts as confirmed only after my reply message with a specific date, time and amount. A submitted form is an enquiry, not a reserved slot.
- The site’s materials are protected. The texts, the page structure, the anatomical illustrations and the design belong to their rights holders. Copying for commercial purposes without written permission is not allowed; quoting with an active link to {{DOMAIN}} is welcome.
- The reviews on the site are marked as samples and are given to demonstrate the format. Real reviews are published only with the written consent of their author and without any details that would identify them.
- External links. I am not responsible for the content of third-party sites that links lead to: their privacy policies apply independently of this one.
- Availability of the site. The site may be temporarily unavailable because of maintenance or a failure at the hosting provider. If the form will not send, write on {{WHATSAPP}} or to {{EMAIL}} — that is more reliable than any number of retries.
- Changes to the document. The text may be updated; the current version is always on this page and the date of the update is shown at the top. Material changes that affect the handling of your data are communicated to everyone I have an active conversation with.
The parties aim to settle disputes through negotiation: write to {{EMAIL}} and we will look at the situation on its merits. If no agreement is reached, the dispute is resolved in the manner provided for by the applicable law at the place where the practice operates.
13. Medical disclaimer
Massage is not medical care
All the content of {{DOMAIN}}, including the descriptions of techniques, the muscle atlas and the blog articles, is informational and does not replace a doctor’s consultation, examination or prescriptions. Nobody here makes diagnoses, prescribes medication or overrides a doctor’s instructions. A massage therapist is not a physician, and a session is not a medical procedure. Do not delay seeing a specialist and do not stop the treatment they have prescribed because of something you read on this site.
- A doctor first, not a session: with acute pain of unclear origin, an injury, numbness, tingling, weakness in a limb, a shooting episode with loss of sensation, fever, swelling or signs of inflammation.
- Massage has contraindications, and some of them are absolute. The full list is in the contraindications section; please read it before booking.
- Health information is your area of responsibility: I can only assess contraindications from the information you have given me. Leaving out a chronic condition or a medication makes the session unsafe.
- Results are not guaranteed. Tissue responses are individual; the honest benchmark is a change in range of motion and in the character of the pain, not a promise to remove the problem in a single visit.
- Some categories of client — pregnant women, people with a cancer diagnosis, with thrombosis, or taking anticoagulants — need a decision from a doctor or a specialist in that field, not from me.
14. Contacts and details for enquiries
For any question about this document, about your data and about your rights regarding it: {{EMAIL}}, phone {{PHONE}}, studio Balmes 200, working hours 09:00–21:00. The controller is the private practice Hondo Massage, Ale, Barcelona. The document was last updated on 23.09.2026.