Legal

Privacy Policy

Protecting your personal data matters to me. This policy explains which data is processed on this website, for what purpose and on what legal basis — in accordance with the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing on this website is:

Javiera Gatica Oyarce
Wallensteinstr. 10 · 90439 Nürnberg
Email: hola@handsoftheandes.com

Full contact details are in the Imprint.

2. Visiting the website (server log files)

When you visit this website, our hosting provider automatically processes technically necessary data your browser transmits: IP address, date and time of access, page requested, browser and operating system, and the previously visited page (referrer). This data serves solely the secure and stable operation of the site and is deleted after a short period.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

Hosting: The site is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. A data-processing agreement (Art. 28 GDPR) is in place.

3. Cookies

This website uses only one technically necessary session cookie (PHPSESSID), required for the booking process and admin sign-in. No tracking, analytics or advertising cookies are used. See the Cookie Policy for details.

Legal basis: § 25(2) TTDSG together with Art. 6(1)(f) GDPR.

4. Booking & health information

When you book a session, I collect the details you provide in the intake form: your name and email address, plus health-related information (height, weight, chronic complaints, pain, physical activities and, where relevant, pregnancy). This information is necessary to prepare a safe massage session suited to you.

Health data is a special category of data under Art. 9 GDPR. I process it solely on the basis of your explicit consent, which you give by ticking the box when submitting the form.

Legal basis: Art. 9(2)(a) GDPR (explicit consent) and Art. 6(1)(b) GDPR (performance of the treatment). You may withdraw your consent at any time with future effect; I will then delete your data unless a statutory retention obligation applies.

5. Newsletter

If you subscribe to the newsletter, I store your first name and email address. Sign-up uses the double opt-in procedure: you first receive an email with a confirmation link, and are only subscribed after clicking it. This documents your consent.

To protect against automated abuse, the IP address of a sign-up is stored briefly and automatically deleted after at most one day.

You can unsubscribe at any time via the link in every newsletter email; your data is then removed from the mailing list.

Legal basis: Art. 6(1)(a) GDPR (consent).

6. Gift certificates

When you buy or redeem a gift certificate, I process the data required for this (e.g. email address and order/redemption details).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

7. Online payment

If you pay online, the payment is handled by an external payment provider. You enter your payment data (e.g. card details) directly with that provider — I do not store card details. The payment amount and an order reference are transmitted to the provider.

Providers: PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) and, where enabled, Stripe (Stripe Payments Europe Ltd., Ireland). The respective provider's privacy notices additionally apply.

Alternatively you can pay in cash on site — no data is transmitted to third parties in that case.

Legal basis: Art. 6(1)(b) GDPR.

8. Contact by email

If you contact me by email, I process your details in order to answer your enquiry. Email is sent via IONOS.

Legal basis: Art. 6(1)(b) or (f) GDPR.

9. Recipients of your data

Your data is only passed on where necessary for the purposes described. Processors/recipients may be: the hosting and email provider (IONOS) and the payment providers (PayPal, and Stripe where enabled). Your data is never sold.

10. Retention period

I store personal data only as long as necessary for the stated purposes or as required by statutory retention periods (e.g. commercial and tax-law periods of up to 10 years for payment-related records). Booking and health data are deleted once no longer needed for your care or when you withdraw your consent.

11. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You may withdraw any consent given at any time with future effect (Art. 7(3)).

To exercise your rights, an email to hola@handsoftheandes.com is sufficient.

You also have the right to lodge a complaint with a supervisory authority (Art. 77). The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the "https://" in your browser's address bar.

13. No automated decision-making

No automated decision-making, including profiling, takes place.

14. Changes to this policy

I will update this privacy policy if the data processing changes or legal requirements make it necessary. The version published on this page applies.

Last updated: 02.09.2026