Privacy Policy
Last updated: 30 October 2026
At Chyl Spa we look after your personal data with the same care we put into your visit. This policy explains, in plain terms, what data we collect, why, how long we keep it and what your rights are under the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).
1. Who is responsible for your data
Chyl Lifestyle S.L. (trading as Chyl Spa, formerly Le Patio Spa), NIF B22451330, registered office C/ Aragó 151, 3º 1ª, 08011 Barcelona. Spa: Carrer del Comte d'Urgell 107, 08011 Barcelona. Email: hola@chylspa.com. WhatsApp: +34 613 043 053.
We have not appointed a Data Protection Officer (DPO). For any privacy matter, write to hola@chylspa.com.
2. What data we collect and why
| When | What data | Why we use it | Legal basis |
|---|---|---|---|
| You book a treatment or buy a pass (through Fresha) | Name, email, phone, booking history, payment status (card details are handled by the payment provider, not by us) | To manage your booking, send confirmations and reminders, and provide the treatment | Performance of a contract (art. 6.1.b GDPR) |
| You tell us about your health (e.g. pregnancy, injuries, allergies, skin conditions) | Health information you choose to share | To keep your treatment safe and adapt it to you | Your explicit consent (art. 9.2.a GDPR). You can withdraw it at any time, but we may then be unable to offer some treatments safely |
| You buy a gift voucher | Buyer's name, email, billing details; recipient's name and any personal message you write | To sell, send and redeem the voucher, and to issue invoices | Performance of a contract; legal obligation (tax and accounting) |
| Your company buys a corporate pack | Contact person's name, job title, work email and phone; company name, CIF and billing address; names of employees who redeem the pack | To agree, invoice and deliver the pack and manage redemptions | Performance of a contract; legal obligation; our legitimate interest in managing the business relationship (for employee contacts) |
| You contact us (email, WhatsApp, website form, social media) | Name, contact details and what you write to us | To answer you | Your request and our legitimate interest in replying |
| You sign up for news and offers | Email, name, language | To send our newsletter and offers | Your consent. You can unsubscribe at any time with the link in each email |
| You browse the website | Device and browser data, IP address, pages visited, cookies | To run the site securely and, if you accept, to measure visits and show relevant ads | Legitimate interest (technical cookies); your consent, given through our cookie banner (analytics and advertising cookies). See our Cookies Policy |
| You apply to work with us | CV and the details you send | To assess your application | Your request to be considered (pre-contractual steps) |
We do not sell your data and we do not use it for automated decisions that significantly affect you.
3. Who we share it with
We use trusted providers who process data on our behalf under data-processing agreements:
- Fresha (Fresha.com SAAS Ltd, UK): online booking, client records, payments, passes and gift vouchers.
- Squarespace (Squarespace Ireland Ltd / Squarespace Inc.): website hosting, online shop, contact forms and site statistics.
- Payment processing: bookings and payments are processed by Fresha; online shop and gift purchases on this Website are processed through Squarespace's payment processors.
- Google (Google Ireland Ltd): Google Analytics 4 (website statistics, with your consent), Google Maps, and Google Ads tracking (advertising measurement, with your consent).
- Microsoft (Microsoft Ireland Operations Ltd, provided through GoDaddy): Microsoft 365 for our email (hola@chylspa.com).
- Meta (Meta Platforms Ireland Ltd): WhatsApp for messages with you; Meta Pixel for advertising measurement, with your consent.
- Klaviyo (Klaviyo Inc.): email newsletter and offers, and website sign-up tracking with your consent.
- Weglot (Weglot SAS, France): website translation.
- Elfsight: embedded social media or review widget.
We also share data with public authorities when the law requires it (for example the tax agency).
4. Transfers outside the European Economic Area
Some providers (for example Squarespace, Google, Meta, Microsoft and Klaviyo) may process data in the United States. Where they do, the transfer is covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Fresha is based in the United Kingdom, which has an EU adequacy decision.
5. How long we keep it
- Bookings and client records: while you are an active client, and then for up to 3 years after your last visit so we can deal with any claims, unless you ask us to delete them sooner.
- Health information: while you are an active client; deleted after 3 years without visits, or sooner if you withdraw consent.
- Invoices, payments, gift vouchers and corporate packs: 6 years, as required by Spanish commercial and tax law (Commercial Code art. 30; General Tax Law).
- Gift voucher recipient details: until the voucher is redeemed or expires, plus the accounting period above for the sale record.
- Messages (email, WhatsApp, forms): up to 12 months after the conversation ends, unless they become part of a booking or contract.
- Newsletter: until you unsubscribe.
- Job applications: up to 12 months, unless you agree to a longer period.
- Cookies: see the Cookies Policy.
6. Children and young people
Our website and online booking are aimed at people aged 14 and over, the age at which Spanish law allows a person to consent to the processing of their data (art. 7 LOPDGDD). We do not knowingly collect data directly from children under 14. If a younger person visits the spa, their booking must be made by a parent or legal guardian, who provides any information needed.
7. Your rights
You can ask us at any time to:
- access the data we hold about you;
- correct data that is wrong or incomplete;
- delete your data;
- object to or restrict how we use it;
- receive your data in a portable format;
- withdraw your consent at any time (this does not affect anything done before).
Just write to hola@chylspa.com with "Data protection" in the subject. We may ask you to confirm your identity. We will reply within one month.
If you think we have not handled your data properly, you have the right to complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es). We would appreciate the chance to sort it out with you first.
8. Keeping your data safe
We use providers with strong security measures, limit access to the people in our team who need it, and keep our devices and accounts protected.
9. Changes
We may update this policy. If the changes are significant, we will tell you on the website or by email.