Aurum Wellbeing · Barcelona
Privacy Policy
We want you to know, with full clarity, what data we process, why we use it, and what rights you have at every step. This page summarises our commitment to your privacy under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Last updated: 9 July 2026
Table of contents
01 · Identity
Who is the data controller?
Legal name: Aura Wellbeing S.L.
Trading name: Aurum Wellbeing
Tax ID (CIF): B72952021
Registered address: Calle Casanova 18, local, 08011 Barcelona, Spain
Phone: (+34) 664 47 70 19
Email: [email protected]
Aurum Wellbeing is a wellness and advanced aesthetics centre. We are not legally required to appoint a Data Protection Officer (DPO), as our activity does not involve large-scale processing of special categories of data or large-scale systematic monitoring. Any query or exercise of your rights regarding your data can be directed to [email protected], managed directly by the centre’s management.
02 · Purposes
Why we process your data and on what legal basis
We only process your personal data for specific, explicit and legitimate purposes. For each of them we rely on a legal basis under Article 6 of the GDPR:
| Purpose | Legal basis |
| Managing bookings, appointments and the provision of massage, aesthetics, body treatments and holistic therapy services | Performance of a contract (Art. 6.1.b GDPR) |
| Completing your intake form / clinical-aesthetic history needed to deliver the treatment safely | Explicit consent for health data (Art. 9.2.a GDPR) |
| Processing payments, issuing invoices and complying with tax and accounting obligations | Legal obligation (Art. 6.1.c GDPR) |
| Sending appointment confirmations, reminders and communications about the service booked (WhatsApp, SMS, email) | Performance of a contract (Art. 6.1.b GDPR) |
| Sending marketing communications, newsletter, promotions and Aurum Club offers | Consent (Art. 6.1.a GDPR) |
| Handling contact requests, quotes and customer service | Consent / legitimate interest (Art. 6.1.a and 6.1.f GDPR) |
| Managing recruitment processes, internships and Erasmus+ programmes | Consent / pre-contractual measures (Art. 6.1.a and 6.1.b GDPR) |
| Producing internal statistics and improving service quality | Legitimate interest (Art. 6.1.f GDPR) |
We do not make automated decisions or build profiles that produce legal effects on you without human intervention.
03 · Data
What data do we collect?
Depending on the service you book, we may process the following categories of data:
- Identification and contact data: name, surname, phone number, email, postal address.
- Billing data: address, tax ID, payment details (processed directly by our payment gateway; we never store your full card details).
- Health and intake-form data: allergies, contraindications, medication, skin or body conditions relevant to delivering the treatment safely. This is only collected with your express, written consent, and stored with reinforced security measures.
- Appointment and service history: treatments received, preferences and therapist notes.
- Conversations with our AI assistants: the content of your messages in our website chat and, where applicable, the transcript of calls handled by our phone voice assistant, whenever you interact with these channels.
- Browsing data: IP address, browser type, pages visited, through cookies (see section 8).
Transparency about the use of artificial intelligence. When you interact with our website chat or our phone voice assistant, we let you know you are speaking with an automated system. You can request to be assisted by a member of our team at any time.
04 · Providers
Providers and data processors
We do not sell or share your data with third parties for purposes unrelated to our business. We do work with technology providers acting as data processors, meaning they process your data on our instructions, under a data protection agreement (Art. 28 GDPR) that requires confidentiality and appropriate security measures.
Setmore
The platform we currently use to manage appointments and online bookings. It processes your name, phone, email and booking history in order to let you book and to send you confirmations and reminders. Setmore Solutions Inc. is based in the United States; the data transfer is covered by the Standard Contractual Clauses approved by the European Commission (see section 5).
GoHighLevel (GHL)
We are progressively migrating our appointment management, automated communications (WhatsApp, SMS, email) and CRM to the GoHighLevel platform, operated by HighLevel Inc. During the transition period, both platforms (Setmore and GoHighLevel) may process data in parallel to ensure continuity of service. GoHighLevel processes identification data, contact details and your interaction history with our centre (messages, appointments, communication preferences) in order to automate confirmations, reminders and customer service. As with Setmore, any transfer of data outside the European Economic Area takes place under the safeguards of the Standard Contractual Clauses.
Website virtual assistant (chat)
The chat widget on our website is built on GoHighLevel and integrates Google’s Gemini artificial intelligence model to answer your initial questions. This assistant processes the content of your conversation (and your name, phone or email if you provide them) in order to guide you and, when appropriate, hand the conversation over to a team member. You can always ask to speak with a human member of our team.
Phone voice assistant (Twilio)
Calls to our centre may be forwarded to a number managed by Twilio Inc., connected to GoHighLevel, where an AI voice assistant handles your query or transfers it to our team. This service processes your phone number and the content of the call (and its transcript) in order to manage your request, booking or query. Twilio acts as a data processor and is based in the United States; the transfer is covered by the safeguards described in section 5.
Payment gateway (Stripe)
Processes card payments securely and encrypted. Aurum Wellbeing never stores your full card details.
Mailchimp
Manages the sending of our newsletter and marketing communications to those who have given their express consent. You can unsubscribe at any time via the link included in every communication.
Google Analytics 4 and Google Ads / Meta Ads
Help us understand how our website is used and measure the effectiveness of our campaigns. They are only activated if you accept the corresponding analytics and advertising cookies (see section 8).
We only share your data with third parties other than those listed above where there is a legal obligation to do so (for example, to the Spanish Tax Agency, or to our accounting firm for tax and bookkeeping compliance) or where you have expressly authorised it.
05 · Transfers
International data transfers
Some of our technology providers (such as Setmore, GoHighLevel, Twilio, Mailchimp or Google) are based, or host servers, outside the European Economic Area, mainly in the United States. When this happens, we ensure the transfer has appropriate safeguards under Chapter V of the GDPR, through:
- European Commission adequacy decisions, where they exist (for example, the EU-U.S. Data Privacy Framework), or
- Standard Contractual Clauses (SCCs) approved by the European Commission, which require the provider to protect your data to a level equivalent to that of the EU.
You can request more information about the safeguards applied to each provider by writing to [email protected].
06 · Retention
How long do we keep your data?
We keep your personal data for as long as we have an active business relationship with you and, after it ends, for the following periods:
- Billing and accounting data: 6 years, under the Spanish Commercial Code; up to 5 additional years for tax purposes under the General Tax Law.
- Appointment and intake-form data: 5 years from the last service provided, unless you request earlier deletion and no legal obligation requires us to keep it.
- Marketing communications data: until you withdraw your consent or unsubscribe.
- CVs and recruitment data: a maximum of 1 year from receipt, unless you agree to remain in a talent pool for a longer period.
Once these periods have elapsed, the data is securely deleted or anonymised.
07 · Rights
Your rights and how to exercise them
At any time, you can exercise the following rights over your personal data:
| Access Find out what data of yours we process. |
Rectification Correct inaccurate data. |
Erasure Request that we delete your data. |
| Restriction Limit processing in certain cases. |
Objection Object to a specific processing activity. |
Portability Receive your data in a structured format. |
| Withdraw consent At any time, without affecting the lawfulness of prior processing. |
||
How to exercise these rights
Send a request to [email protected], attaching a copy of your ID document and indicating which right you wish to exercise. We will respond within one month at the latest, extendable to two months in complex cases, as provided by the GDPR.
If you believe we have not properly handled your request, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
09 · Security
Information security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration: encrypted connections (HTTPS/SSL), role-based access control, regular backups, and confidentiality agreements with our team and providers. Health data collected in your intake form is stored with reinforced security measures and access restricted to the therapy staff attending to you.
Changes to this policy. We may update this privacy policy to reflect legislative changes or changes to our services and providers. We recommend reviewing it periodically. The date of the last update appears at the top of this page.
10 · Contact
Have questions about your privacy?
Write to us and we will get back to you personally. We’re here to help you understand and control your data.
Email [email protected]
Call +34 664 47 70 19
Aura Wellbeing S.L. · Tax ID B72952021 · Calle Casanova 18, 08011 Barcelona
