Courtesy translation. In the event of any discrepancy, the Spanish version prevails.

Website privacy policy

1. Data controller

Identity: EVOLIA DESARROLLOS COMERCIALES, S.L.U.
NIF: B55386221
Address: Paseo de La Castellana, 257, Torre Sur, Planta 1, 28046 Madrid
Email: ayuda@arcadea.es
Telephone: 944 34 80 65

2. Data we collect and how we obtain it

Contact form. When the user completes the contact form available on the Site, the data they voluntarily provide is collected: first name, surname, email address, telephone number (if provided) and the content of the message. This data is strictly that necessary to deal with the enquiry or request made.

Browsing data. As a general rule, simply visiting the Site does not require the user to identify themselves. However, the servers automatically record certain technical information: IP address, browser and device type, pages visited, date and time of access, and referring URL. This data is used exclusively for statistical and system security purposes and is not associated with any identifiable natural person.

Cookies and similar technologies. The Site may use its own and third-party cookies. For detailed information about their use and how to manage them, please see our Cookie Policy.

3. Purposes and legal basis of processing

Dealing with enquiries and requests received through the contact form. Legal basis: taking steps prior to entering into a contract at the request of the data subject (Art. 6.1.b GDPR).
Management of the commercial relationship with customers who purchase Arcadea services. Legal basis: performance of a contract to which the data subject is party (Art. 6.1.b GDPR).
Sending commercial communications about Arcadea's services, promotions and news, only where the user has given their express consent. Legal basis: consent of the data subject (Art. 6.1.a GDPR). Consent may be withdrawn at any time.
Security and improvement of the Site through the analysis of browsing data on an aggregated and anonymised basis. Legal basis: legitimate interest of the controller (Art. 6.1.f GDPR).
Compliance with legal obligations applicable to the controller. Legal basis: compliance with a legal obligation (Art. 6.1.c GDPR).

4. Retention period

Data provided through the contact form is retained for as long as necessary to deal with the enquiry and, where applicable, for the duration of any subsequent contractual relationship. Once this has ended, the data is blocked and retained solely at the disposal of the competent authorities for the applicable statutory limitation periods (generally between three and six years, depending on the matter), after which it is permanently erased.

Browsing data is retained for a maximum period of 13 months.

5. Recipients and international transfers

As a general rule, data is not disclosed to third parties except where required by law. However, for the provision of certain ancillary services (web hosting, booking platform, analytics tools), data processors are used who act under contract and solely on the controller's instructions. These providers are located in the European Union or in countries with an adequate level of protection recognised by the European Commission, or have signed the standard contractual clauses approved by the Commission.

No international transfers of data are made outside the framework described.

6. Rights of the data subject

At any time, the user may exercise before the controller the following rights recognised by the GDPR and the LOPDGDD:

Access: to know which of their data the controller processes.
Rectification: to request the correction of inaccurate or incomplete data.
Erasure: to request the deletion of their data where, among other grounds, it is no longer necessary for the purposes for which it was collected.
Restriction of processing: to request that the processing of their data be suspended in certain circumstances.
Portability: to receive their data in a structured, commonly used format, or to request its transmission to another controller.
Objection: to object to processing based on legitimate interest or for direct marketing purposes.
Withdrawal of consent: for processing based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, the user must send a written request, providing proof of identity, to the email address ayuda@arcadea.es or to the registered office indicated. The controller will respond within a maximum of one month, which may be extended by a further two months in particularly complex cases.

If the user considers that the processing of their data does not comply with the applicable legislation, they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), through its electronic office at www.aepd.es.

Processing of health data — Informed consent

1. Data controller

The data controller for the health data collected in the context of the provision of massage and wellness services is EVOLIA DESARROLLOS COMERCIALES, S.L.U., whose contact details are given in Part I.

2. Special category of data and legal basis

Data concerning people's health constitutes a special category of data under Article 9 of the GDPR and is subject to an enhanced protection regime. Arcadea only processes this type of data where the customer has given their explicit, freely given, specific, informed and unambiguous consent by signing the informed consent form, in accordance with Article 9.2.a of the GDPR.

Signing this form is an essential prerequisite for the provision of the service, as the health information provided by the customer is necessary for the therapist to adapt the session to the customer's physical condition, identify possible contraindications and guarantee their safety during the treatment.

3. Data collected

The informed consent form collects, among others, the following data:

Identification data: full name, date of birth and contact details.
Relevant health history: diagnosed conditions, recent surgery or procedures, allergies, pregnancy, ongoing medication and any other condition the customer considers relevant.
Specific contraindications for massage or the techniques requested.
Session goals and preferences communicated by the customer.
The therapist's observations regarding the customer's condition at each session.

4. Purpose of processing

Health data is processed exclusively for the following purposes:

To adapt the session protocol to the customer's physical condition and individual needs.
To identify and prevent contraindications or risks during the treatment.
To carry out longitudinal monitoring of the customer's progress over successive sessions, in order to improve the quality and continuity of the service.
To guarantee the safety of the customer and the therapist during the provision of the service.

Health data is not used for commercial or statistical purposes, or for any other purpose unrelated to the direct therapeutic relationship.

5. Access to data and confidentiality

Access to health data is strictly restricted to the Arcadea therapists directly involved in the customer's care, who are bound by a duty of confidentiality. This data is not disclosed to third parties except where expressly required by law or with the customer's explicit consent.

Arcadea applies specific technical and organisational measures to guarantee the security of health data, including storage in physical format under lock and key in restricted-access facilities.

6. Retention period

Informed consent forms and the associated health information are retained for the duration of the service relationship with the customer and for a minimum period of five years from the last session, in line with the limitation periods applicable to professional civil liability in the field of wellness and health services. Once this period has elapsed, the documentation is securely destroyed.

7. Withdrawal of consent

The customer may withdraw at any time the consent given for the processing of their health data, without this affecting the lawfulness of processing carried out beforehand. Withdrawal of consent means that the service can no longer be provided, as this information is essential to guarantee the safety of the sessions. The request may be made in writing to ayuda@arcadea.es.

8. Rights of the data subject

The customer may exercise the rights of access, rectification, erasure, restriction, portability and objection in relation to their health data under the same terms described in Part I, section 6, of this policy. In the case of erasure, the request will be granted unless a legal retention obligation prevents it.

Video surveillance system

1. Data controller

EVOLIA DESARROLLOS COMERCIALES, S.L.U., whose contact details are given in Part I of this policy.

2. Existence of the system and location of the cameras

Arcadea's premises at Calle Uribitarte 5, 48001 Bilbao, are equipped with a video surveillance system using security cameras. The cameras are installed in the access and common areas of the premises (reception, main entrance and corridors). There are no cameras in areas that affect people's privacy, such as treatment rooms, changing rooms or toilets.

The areas under video surveillance are duly signposted with the standard information sign as required by Article 22 of the LOPDGDD and the criteria of the Spanish Data Protection Agency, indicating the presence of cameras, the identity of the controller and the contact address for exercising rights.

3. Purpose and legal basis

The sole purpose of the video surveillance system is to guarantee the safety of the people, facilities and property on the premises, as well as to prevent and, where applicable, help clarify any incidents or unlawful activities that may occur.

The legal basis for the processing is the legitimate interest of the controller in protecting the safety of its premises, its employees and its customers, in accordance with Article 6.1.f of the GDPR and Article 22 of the LOPDGDD, which expressly authorises the use of video surveillance systems for security purposes.

4. Retention period for the footage

Footage captured by the video surveillance system is retained for a maximum of 30 calendar days from capture, after which it is automatically deleted by overwriting, unless it has been made available to the competent authorities in the context of an ongoing investigation or a court order requires its retention for a longer period.

5. Access to the footage

Access to the video surveillance footage is strictly restricted to authorised Arcadea staff with security or management functions and, where applicable, to the State law enforcement agencies and the judicial authorities when they so require in the exercise of their legal functions.

The footage is not disclosed to third parties for any other purpose.

6. Rights of the data subject

People recorded by the video surveillance system have the right to:

Access: to request confirmation as to whether footage of them is being processed and, if so, to obtain a copy. Given the short retention period (30 days), the request must be made as soon as possible after the footage was captured.
Erasure: to request the deletion of the footage where there is no legitimate or legal ground for its retention.
Objection and restriction: under the terms provided for in the GDPR, where particular circumstances justify it.

To exercise these rights, the data subject must submit a written request accompanied by a copy of their identity document, indicating the approximate date and time at which they were on the premises, addressed to ayuda@arcadea.es or to the controller's registered office.

If the data subject considers that the processing infringes their rights, they may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es.

Customer service via WhatsApp

1. Data controller

EVOLIA DESARROLLOS COMERCIALES, S.L.U., whose contact details are given in Part I of this policy.

2. Description of the service

Arcadea offers a customer service channel via WhatsApp Business (number 623 00 23 83). This channel is assisted by an automated virtual assistant based on artificial intelligence, called “Nara”, which can answer enquiries, provide information about services, manage bookings and carry out other operations autonomously.

Where the virtual assistant is unable to resolve the enquiry, the conversation may be transferred to a human agent from the Arcadea team, who will reply through the same channel within a maximum of 24 hours.

3. Data processed

When this channel is used, Arcadea processes the following personal data:

Telephone number: provided automatically by WhatsApp when the conversation is started.
Profile name: the public name set on the user's WhatsApp account.
Message content: text and, where applicable, images or other files sent voluntarily by the user during the conversation.
Data provided during the handling of requests: first name, surname, email address or other data that the user voluntarily provides for the processing of bookings, enquiries or requests.
Conversation metadata: date, time and technical identifiers of the messages.

4. Purposes and legal basis

Dealing with enquiries and requests from the user relating to services, availability, prices and bookings. Legal basis: taking steps prior to entering into a contract at the request of the data subject (Art. 6.1.b GDPR).
Management of bookings and appointments requested by the user through the channel. Legal basis: performance of a contract (Art. 6.1.b GDPR).
Transfer to a human agent where the virtual assistant is unable to resolve the enquiry, in order to ensure appropriate service. Legal basis: legitimate interest of the controller in offering a quality service (Art. 6.1.f GDPR).
Service improvement: analysis of the virtual assistant's performance on an aggregated basis and without personal identification. Legal basis: legitimate interest (Art. 6.1.f GDPR).

5. Use of artificial intelligence

The virtual assistant “Nara” uses artificial intelligence models to understand and reply to the user's messages. Processing is carried out via the API of an external provider (Anthropic, Inc., based in the USA), which acts as a data processor. The content of the conversations is sent to the provider solely to generate the reply in real time, and the provider does not use the data to train its models or for any other purpose unrelated to the contracted service.

International transfers of data to the provider are carried out under the standard contractual clauses approved by the European Commission.

The user will be informed at the start of each conversation that they are being attended by a virtual assistant.

6. Data retention

Conversation history is retained for a maximum period of 120 days from the last message, after which it is automatically deleted. Data associated with bookings or transactions is retained for the applicable statutory periods (generally between three and six years).

Conversations transferred to a human agent are retained as part of Arcadea's incident management system, subject to the same retention periods as other customer service communications.

7. Messaging platform

WhatsApp is a service provided by Meta Platforms Ireland Ltd. By using WhatsApp, the user also accepts that platform's own terms and privacy policy, available at www.whatsapp.com/legal/privacy-policy. Arcadea is not responsible for any data processing carried out independently by Meta within the framework of its own service.

8. Rights of the data subject

The user may exercise the rights of access, rectification, erasure, restriction, portability and objection in relation to their data under the same terms described in Part I, section 6, of this policy. The user may also request the deletion of their conversation history at any time by writing to ayuda@arcadea.es.

Last updated: 13/04/2026