Privacy Policy
1. Data Controller
The data controller responsible for processing personal data is OLVANE EUROPE, S.L.U. (Single-Member Limited Liability Company), with Spanish Tax Identification Number (NIF) B70915079, the company that owns and provides the services of the establishment operating under the trade name LOTUS THAI SPA.
Registered office: Calle Robert Gerhard, 5, Staircase 1, Ground Floor, Unit 4, 43005 Tarragona, Spain.
Email: info@lotusthaispa.live
Telephone: +34 877 028 250
Website: https://lotusthaispa.live/
2. Personal Data, Purposes and Legal Bases
LOTUS THAI SPA processes the personal data necessary to carry out its business activities, including identification and contact details, bookings, services purchased, payments, invoicing information, communications and participation in loyalty programmes.
Personal data is processed for the following purposes:
- Bookings and services: managing appointments, changes, cancellations and booked treatments. Legal basis: performance of a contract or steps taken prior to entering into a contract (Article 6(1)(b) GDPR).
- Customer service: responding to enquiries and requests. Legal basis: performance of a contract or legitimate interests in responding to communications received, as applicable (Articles 6(1)(b) and 6(1)(f) GDPR).
- Payments and invoicing: managing payments, deposits, refunds, and tax and accounting obligations. Legal bases: performance of a contract and compliance with legal obligations (Articles 6(1)(b) and 6(1)(c) GDPR).
- Loyalty programmes: managing participation in Club Lotus Wellness, prepaid packages, loyalty stamps, discounts and associated benefits. Legal basis: performance of the participation terms accepted by the customer (Article 6(1)(b) GDPR).
- Security: protecting the website and preventing unauthorised access or fraudulent activities. Legal basis: the controller’s legitimate interests (Article 6(1)(f) GDPR), following an assessment of the interests involved.
Personal data required to manage a booking or provide a service must be supplied in order for the request to be processed. Data collected for voluntary purposes will be processed in accordance with the applicable legal basis.
3. Processing of Health Data
LOTUS THAI SPA may collect information concerning allergies, injuries, medical conditions, pregnancy, medication or other relevant circumstances through paper forms completed at the establishment, in order to assess potential contraindications and adapt massage treatments.
Such information constitutes special categories of personal data under Article 9 GDPR.
The collection and recording of this information through these forms is based on the data subject’s explicit consent, pursuant to Articles 6(1)(a) and 9(2)(a) GDPR. This consent is requested through a specific, separate and unticked checkbox.
Health data will be used exclusively to assess contraindications, adapt treatments and support the safe provision of services. Access will be restricted to authorised personnel, and the information will not be used for advertising purposes.
Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
Refusal to authorise the recording of health data will not automatically result in denial of service. However, the establishment may adapt, postpone or decline a treatment where there are objective safety concerns or where essential information is unavailable to reasonably assess potential contraindications.
4. Booking, Payment and Communication Platforms
LOTUS THAI SPA uses external technology platforms and service providers to manage bookings, appointments, payments and customer communications.
These services include:
- Bookings: Booksy or any other booking platform used by the establishment at the relevant time, to manage appointments, availability, changes, cancellations, reminders and communications relating to booked services.
- Payments: Stripe or any other payment service provider used at the relevant time, to manage deposits, payments, refunds and secure transaction processing.
- Communications: WhatsApp or other messaging and communication services used by the establishment, to respond to enquiries and manage communications relating to bookings and services.
Personal data will be made available to service providers where necessary to deliver the relevant services, in accordance with their respective roles and responsibilities.
Where service providers act as data processors, the contractual safeguards required by the General Data Protection Regulation (GDPR) will be established. Certain service providers may act as independent data controllers in accordance with their own privacy policies.
Customers are requested not to send health-related information through messaging applications. Such information is collected using the specific forms provided at the establishment.
5. Marketing Communications and Loyalty Programmes
LOTUS THAI SPA may send information about promotions, news, services and commercial benefits when:
- The data subject has given consent.
- A prior contractual relationship exists and the conditions set out in Article 21(2) of Spanish Law 34/2002 are met for promoting the company’s own products or services similar to those previously purchased.
The legal basis will be the data subject’s consent (Article 6(1)(a) GDPR) or, where applicable and subject to the relevant legal requirements, the controller’s legitimate interests (Article 6(1)(f) GDPR).
In the latter case, customers will be given the opportunity to object to receiving advertising when their data is collected and in every subsequent marketing communication.
Customers may opt out of marketing communications free of charge at any time using the mechanisms provided or by emailing info@lotusthaispa.live.
Participation in Club Lotus Wellness or other loyalty programmes does not automatically constitute consent to receive advertising.
6. Data Recipients and International Transfers
Personal data may be processed by providers of booking, payment, communication, web hosting, technical maintenance and administrative services. Data may also be disclosed to public authorities where legally required.
Certain international service providers may transfer personal data outside the European Economic Area.
Where such transfers are subject to Chapter V GDPR, they must be supported by valid safeguards, such as an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework where applicable to the recipient, or Standard Contractual Clauses accompanied by additional measures where necessary.
Data subjects may request information about the applicable safeguards by contacting the data controller via email.
7. Data Retention
Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected and, subsequently, for any legally required retention periods.
The following criteria apply:
- Bookings and services: for the duration of the contractual relationship and for as long as legal liabilities may arise.
- Commercial records: six years in accordance with Article 30 of the Spanish Commercial Code, where applicable.
- Tax records: for the legally required periods, taking into account the general four-year tax limitation period.
- Contractual claims: for the applicable limitation periods, including the general five-year period for certain personal legal actions.
- Health data: for the period strictly necessary to assess treatment safety, in accordance with the retention period established by the data controller and applicable legal obligations. Withdrawal of consent will result in the cessation of processing based on that consent and, where applicable, deletion of the data.
- Loyalty programmes: for the duration of participation and while any outstanding obligations or liabilities remain.
- Marketing communications: while a valid legal basis exists and until consent is withdrawn or an objection is made, without prejudice to retaining the minimum information necessary to demonstrate legal compliance.
Where legally required, personal data will be retained in a restricted and blocked form for the applicable periods.
8. Data Subject Rights
Data subjects may exercise, where applicable, their rights of access, rectification, erasure, objection, restriction of processing, data portability and withdrawal of consent, as well as the right not to be subject to certain decisions based solely on automated processing.
Requests may be submitted to:
The data controller may request additional information where there are reasonable doubts regarding the identity of the person making the request.
Data subjects may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD):
9. Minors
Where the processing of personal data is based on consent, children under the age of 14 require authorisation from their parents or legal guardians, in accordance with applicable legislation.
The provision of services to minors may require authorisation from their parents or legal guardians, independently of consent for the processing of personal data.
10. Security, Cookies and Updates
OLVANE EUROPE, S.L.U. will implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or improper disclosure.
Paper forms containing health information will be securely stored, with access restricted to authorised personnel subject to confidentiality obligations.
The website uses cookies and similar technologies. Their use is governed by the Cookie Policy available on the website, which provides information about their purposes, providers and consent options.
This Privacy Policy may be updated to reflect changes in legislation, organisational arrangements or personal data processing activities.
Last updated: 23 October 2026.