Privacy policy

Current version: 2026-10-30. This document explains what personal data we collect, why, how long we keep it, and what you can do about it.

1. Who is responsible for your data

Data controller (responsable del tratamiento): Cielo Beauty Coworking, Valencia, Spain, email: [email protected].

The coworking operates as Cielo Beauty Coworking, Valencia, Spain. Write to that address with any question about your data — we answer within one month.

2. What data we collect

What you give us yourself:

• full name, email, phone number;
• NIE or NIF — needed for the agreement and for invoices;
• your specialty and the few words about yourself from the application form;
• Instagram — optional, this field is not required;
• whether you are registered as autónomo, and the document confirming it.

What the system records by itself as you use it:

• your bookings, cancellations and the hour packages you buy;
• invoices issued to you and whether they are marked paid;
• the signed agreement (a file);
• an action log — who did what, and when;
• your IP address at the moment you tick the consent box — this is evidence of the consent itself; your IP is not stored anywhere else.

We do not collect data about your health, origin, beliefs or any other “special category”, and we never ask you for it. We do not see your own clients’ data either: you keep your own appointment book, outside this system.

3. Why we do this, and on what legal basis

• Reviewing your application — legitimate interest: deciding whether we are a good fit for each other.
• The agreement, bookings and access to the space — performance of the contract between us.
• Invoices, accounting and tax — legal obligation under Spanish law.
• Emails about bookings, cancellations and invoices — performance of the contract. These are service emails, not marketing.
• Instagram — your consent only. You may leave it out, or ask us to remove it at any time.
• The action log and keeping the system secure — legitimate interest: being able to find out what happened if something goes wrong.

We do not send marketing emails. If we ever want to, we will ask for your consent separately first.

4. Do you have to give us this data

Name, email, phone and NIE/NIF — yes: without them we cannot sign an agreement or issue a legally valid invoice. Instagram and the note about yourself — no, those are optional.

5. Who we share your data with

• our accountant (gestoría) and the invoicing service — so that invoices are issued as the law requires;
• the bank — when you make a transfer;
• the company providing the server for this system and the service that sends our emails — they act on our instructions under a data processing agreement (DPA);
• public authorities — only where the law requires it.

We do not sell your data, do not pass it to advertisers and do not publish it. Other residents cannot see your personal data — the calendar shows a slot as busy, without a name.

6. Does your data leave the EU

The server and the backups are physically located in the European Union (the Netherlands). The companies providing the server and the email delivery are registered in the United States, so technical access from outside the EU is in theory possible. This is covered by a data processing agreement with the EU Standard Contractual Clauses (SCC) — the instrument the GDPR itself provides for.

7. How long we keep your data

• Applications we do not take further — 6 months, whether we declined them or never got to them. Then they are deleted automatically, along with the consent recorded with them.
• Invoices and accounting records — 6 years: required by Spanish commercial and tax law, and we cannot shorten this even at your request.
• The agreement — for the whole time we work together plus 4 years after it ends (the limitation period).
• Bookings and hour packages — for the whole time we work together; after that they survive only as part of the accounting records.
• The action log — 2 years; once your account is deleted, those entries remain with no link to you.
• The record of emails we sent you — 3 months. Passwords are never kept in it.
• A guest written into the calendar (someone who is not a resident) — the name and phone are kept for as long as the booking is in the calendar, and at most one year; the owner can erase them at any moment by freeing the time.

When a period runs out, the data is either deleted or anonymised — the name, phone and NIE are removed for good and only the amount in the accounts remains.

8. Your rights

• Access — find out exactly what data of yours we hold.
• Rectification — correct anything inaccurate. Your details, including your login email, can be changed from your profile at any time; ask us and we will correct anything you cannot reach yourself.
• Erasure — ask us to delete your data, except what we are obliged to keep for accounting.
• Restriction — ask us to pause the use of your data while a disputed point is sorted out.
• Portability — receive your data as a file, to take it wherever you want.
• Objection — object to processing that relies on our legitimate interest.
• Withdrawing consent — where consent was the basis (Instagram, for example), withdraw it at any time. This does not undo what happened before the withdrawal.

If you ask us to delete your data and we still have to keep your invoices, we erase the personal part: your name, phone and NIE disappear for good, and the invoices stay in the accounts without a person behind them.

The simplest way is from your own profile: it has “Download my data” and “Request deletion”. Or write to [email protected]. We answer within one month. There is no charge.

9. If you are not satisfied with our answer

You have the right to lodge a complaint with the Spanish supervisory authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es. Please write to us first, though — most things are settled faster that way.

10. Does the system make automated decisions about you

We do not profile anyone. There is one automatic rule: if an invoice is not paid on time, the system temporarily stops you creating new bookings. That is a term of the agreement, not a judgement about you; the owner can lift it manually and is always open to discussing it.

11. Cookies

We use technical cookies only: one to remember that you are logged in, and a single-use one to show you a message after an action. There is no analytics, no advertising and no third-party tracking on this site — which is why there is no cookie banner either.

12. How we protect your data

The connection to the site is encrypted (HTTPS). Passwords are not stored as text but in a form that cannot be read back. Only the owner and the administrator can see resident data, and every action of theirs is written to the log.

13. Changes to this policy

If we change this document, the version date at the top of the page changes with it. We will email you about significant changes, and if the legal basis of any processing changes we will ask for your consent again.

Back