Privacy Policy

Last updated: 21 September 2026

Lux & Line Studio (“we”, “us”, “our”) — C. Manuel González Portilla, 8, 29670 San Pedro Alcántara, Málaga, Spain — is the data controller responsible for personal data processed on this website (luxandline.com). Contact: info@luxandline.com · +34 623 60 44 88.

1. Data we collect

When you make a booking or contact us we collect: first name, last name, email address, phone number, appointment details (service, date, time, staff preference, optional notes) and technical data (IP address, browser, cookies).

2. Why we process it & legal basis

  • Delivering your appointment — legal basis: contract performance (GDPR Art. 6(1)(b)).
  • Sending confirmation, reminders and cancellation emails — contract performance.
  • Internal staff coordination via Telegram Messenger (see §4) — legitimate interest and your consent (Art. 6(1)(a), (f)).
  • Legal & tax records — legal obligation (Art. 6(1)(c)) — Spanish tax law requires we retain invoice-related data for up to 6 years.
  • Website analytics & Google Ads — consent (Art. 6(1)(a)).

3. How long we keep it

  • Appointment records in our booking system: up to 2 years after your last visit (then anonymised).
  • Invoice / payment records: 6 years (Spanish tax law).
  • Telegram staff-notification messages: auto-deleted 24 hours after the appointment ends.
  • Website cookies: as per our cookie banner (session or up to 12 months).

4. Sharing your data / international transfers

We do not sell your data. It may be processed by these categories of recipients:

  • Our hosting provider (Namecheap, USA) — data-in-transit is TLS-encrypted; SCCs in place.
  • Telegram Messenger (Telegram FZ-LLC, United Arab Emirates) — used strictly for staff notifications. Cards contain your name, phone, email, and appointment details and are automatically deleted 24 hours after your appointment. Because the UAE is a third country without an EU adequacy decision, this transfer relies on your explicit consent (GDPR Art. 49(1)(a)). You may withdraw consent at any time by emailing us — this will not affect the lawfulness of processing prior to withdrawal.
  • Google (Ireland/USA) — analytics & ad measurement only if you accept optional cookies. Google is Data Privacy Framework-certified.
  • Spanish tax authorities — where legally required.

5. Your rights (GDPR Arts. 15–22)

You have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to withdraw consent at any time. To exercise any right, email info@luxandline.com. We respond within one month.

If you believe we are not handling your data lawfully, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

6. Security

We use TLS/SSL encryption, a web application firewall (Wordfence), file-integrity monitoring (Imunify360), least-privilege admin accounts and regular backups. Access to booking data is restricted to authorised staff. Notifications sent to Telegram are limited to information strictly necessary for service delivery and are automatically erased.

7. Automated decision-making

We do not make solely automated decisions with legal or similarly significant effects (GDPR Art. 22).

8. Changes to this policy

We may update this policy. Material changes will be posted on this page with an updated revision date.

Scroll to Top