Privacy Policy

At Harmony by Agas (owned by Dra. Ava Guila Ardila Soto) we process your personal data with the utmost diligence, in accordance with Regulation (EU) 2016/679 (GDPR) and with Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

1. Data controller

• Identity: Ava Guila Ardila Soto
• NIF (tax identification number): [to be completed]
• Postal address: C/ de los Almendros, 3 — 28821 Coslada, Madrid
• Contact email: estetica@harmonybyagas.com
• Telephone: +34 918 549 377

2. Data we process

• Identifying data: first name, surnames, DNI/NIE.
• Contact data: telephone, email, postal address.
• Clinical data: medical history, background, medication, clinical photographs (only where you expressly consent). This data falls within the category of specially protected data under Article 9 of the GDPR.
• Billing data: when you engage a service or purchase a product.
• Browsing data: IP address, cookies and analytics data (see our Cookies Policy).

3. Purposes and legal basis for processing

4. Retention periods

• Medical records: 5 years from the last visit, in accordance with Ley 41/2002.
• Billing data: 6 years, in accordance with the Código de Comercio (Commercial Code).
• Marketing data: until you withdraw your consent.
• Contact form data: until your enquiry has been resolved, unless you request its erasure sooner.

5. Recipients and disclosures

Your data is not disclosed to third parties except where required by law. The suppliers that access your data (data processors) are:

• Hosting and cloud services provider (with an agreement signed pursuant to Art. 28 GDPR).
• Redsys payment gateway, for online shop transactions.
• Tax and accounting advisers, solely in order to comply with legal obligations.
• Clinical management system with a server in the European Union.

We do not carry out international transfers of data outside the European Economic Area (EEA) except where the recipient has appropriate safeguards in place (standard contractual clauses, countries with an adequacy decision).

6. Your rights

You may exercise the following rights at any time, free of charge:

• Access: to find out what data we hold about you.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request the deletion of your data when it is no longer necessary.
• Objection: to object to the processing on grounds relating to your particular situation.
• Restriction: to request the suspension of the processing in certain cases.
• Portability: to receive your data in a structured and reusable format.
• Withdrawal of consent at any time, without retroactive effect.

To exercise these rights, write to us at estetica@harmonybyagas.com, identifying yourself (DNI or equivalent). If you consider that your rights have not been properly addressed, you may lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

7. Security measures

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction: encryption in transit (TLS), role-based access control, encrypted backups, activity logging and ongoing staff training.

8. Amendments

We may update this Policy to adapt it to legislative changes or to our operations. We will always publish the version in force on this same page, stating the date of the last update at the end.