Privacy policy

1. Data controller

• Identity: Andara Centro Auditivo, S.L.
• Tax ID (NIF/CIF): B93934933
• Address: C. Valentín Fuster, 16 B, 03170 Rojales (Alicante)
• Contact email for privacy matters: info@andaracentroauditivo.es

2. Purpose of processing

The data you provide through the contact form (name, telephone and/or email, the time of day you would prefer us to call, and the reason for your enquiry, which you choose from a set of predefined options) is processed for the sole purpose of handling your request for information and contacting you to reply.

3. What kind of data do we process?

Identification and contact details (name, telephone, email), a scheduling preference (the time of day that suits you best for us to call) and the reason for your enquiry, which you select from predefined options.

In addition, when you submit the form we generate an encrypted, irreversible code derived from your IP address, for the sole purpose of preventing mass automated submissions. We do not store your IP address and cannot deduce it from that code, which is deleted automatically after one hour.

4. Legal basis

The legal basis for processing is your explicit consent (Art. 6(1)(a) GDPR), which you give by ticking the acceptance box on the form.

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal, by writing to info@andaracentroauditivo.es.

The only exception is the encrypted code derived from your IP address described in the previous section, which we process on the basis of legitimate interest (Art. 6(1)(f) GDPR) as a security measure for the form (Art. 32 GDPR).

5. Recipients and processors

To store and manage the contact form data we use Supabase (operated by Supabase, Inc.), which acts as a data processor and hosts the database on infrastructure located in the European Union (Frankfurt, Germany), under a Data Processing Agreement (DPA).

To notify us by email that you have sent a request, we use the email delivery service Resend (operated by Resend, Inc.), which processes your contact details for the sole purpose of delivering that notification, also as a data processor and under a DPA.

Our corporate email runs on Google Workspace (operated by Google Ireland Limited, based in Ireland). Google acts as a data processor under the Cloud Data Processing Addendum we have entered into with it, and processes only the data we give it - your name, your phone number or email and the reason for your enquiry, when you write to us or when we receive the notification of your request - on our instructions and not for its own purposes. Google may rely on other companies for specific maintenance and support tasks; the full list, with what each one does and from which country, is published on Google’s website.

This website is hosted and delivered through Cloudflare (operated by Cloudflare, Inc.), which therefore processes the technical data of your visit (such as your IP address), as a data processor and under a DPA.

On the contact page we show our location using an embedded Google Maps map (operated by Google Ireland Limited, and Google LLC in the United States). If you accept that map, Google receives your IP address and places cookies on your device. The map loads only if you give your consent in the cookie banner shown when you visit the site; until you do, your browser makes no connection to Google. You can change your decision at any time from “Cookie settings” in the footer. You will find the details in our cookie policy.

We do not transfer your data to third parties for purposes other than those described here, except where legally required.

6. International transfers

The database where we store your request is located in the European Union (Frankfurt, Germany). The email delivery service (Resend) may involve the processing of your contact details by its provider on infrastructure located outside the European Economic Area. In that case, such transfer is covered by the Standard Contractual Clauses (SCC) approved by the European Commission (Implementing Decision (EU) 2021/914), incorporated into the Data Processing Agreement signed with that provider.

Our corporate email is operated by Google Ireland Limited, a company established in the European Union. To provide the service, Google may use companies in its group and providers located outside the European Economic Area, including the United States. Where your data travels to the United States, the transfer relies on the EU–US Data Privacy Framework (Google LLC is certified) and, as a fallback, on the Standard Contractual Clauses approved by the European Commission. Where it travels to other countries, it relies on those same Standard Contractual Clauses, which Google imposes by contract on its providers.

Cloudflare, Inc. is established in the United States: the transfer of the technical data of your visit relies on the EU–US Data Privacy Framework (Cloudflare states that it complies with it) and, as a fallback, on the Standard Contractual Clauses incorporated into its DPA.

Likewise, if you accept the Google map’s cookies, your IP address may be transferred to Google LLC in the United States. That transfer relies on the EU–US Data Privacy Framework (Google LLC is certified) and, as a fallback, on the Standard Contractual Clauses. This transfer only occurs if you give your consent in the cookie banner.

7. Retention period

We will keep your data for as long as necessary to deal with your request and, at most, for 24 months from receipt, after which it is deleted automatically. This is without prejudice to any legally required periods for addressing potential liabilities.

The encrypted code derived from your IP address (section 3) is kept for one hour only and is deleted automatically.

8. If you become a client: your record, history and appointments

If, after your enquiry, you decide to become a client of the centre - or you simply come by in person - we create a client record with your identification and contact details, a history of our relationship (calls, visits, agreements and follow-up) and the appointments we arrange with you. This information is used exclusively to manage our relationship with you and to organise the centre’s diary (Art. 6(1)(b) GDPR); it is not used for advertising and is not shared with third parties except where legally required.

That history may reflect information relating to your hearing health (for example, the reason for a visit). We record it only to the extent necessary to assist you, it is accessed solely by the centre’s staff, who are bound by a duty of confidentiality, and it is stored in the database described in section 5, with the same safeguards.

We keep your record, history and appointments for as long as your relationship with the centre continues and, once it ends, for the periods legally required to address potential liabilities. You can request their erasure at any time (section 9); we will handle your request in accordance with Art. 17 GDPR.

9. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to info@andaracentroauditivo.es, enclosing a copy of your ID document or equivalent.

If you believe that the processing of your data does not comply with current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (www.aepd.es).

10. Security measures

We apply appropriate technical and organisational measures to guarantee the security of your data, in accordance with Art. 32 GDPR.