Legal notice, privacy and cookies

Website owner

Legal name: Massaaziakadeemia OÜ, Spanish branch
Tax ID (NIF): W0384638C
Trading name: NULAN — Bienestar Corporal
Address: Carrer Rodríguez de Valcárcel 9, 07849 Santa Eulària des Riu, Illes Balears, Spain
Telephone: +34 609 481 379
Email: hola@nulan.es
Branch registered at the Commercial Registry of [TO BE COMPLETED: province], volume [·], folio [·], sheet [·], entry [·]
Parent company: Massaaziakadeemia OÜ, registered office at [TO BE COMPLETED: address in Estonia], entered in the Estonian Commercial Register under registry code [TO BE COMPLETED]

[TO BE CONFIRMED] the exact spelling of "Massaaziakadeemia OÜ" as it appears on the deed and the NIF card — the Estonian name may carry accented characters (ž).

Purpose

This website is informational. It presents the massage and body-care services NULAN offers at its studio in Santa Eulària des Riu, their prices and its contact details. No sales or payments take place on this website. Bookings are handled on the external platform Fresha, and payment is made at the studio.

Terms of use

Access to this website is free and open, and grants the status of user. The user undertakes to make proper use of the contents and not to use them for unlawful activities, activities harmful to the rights of third parties, or activities that may damage, disable or overload the website.

Information on treatments, durations and prices is published in good faith and may change without notice. The prices in force at the time of booking are those shown on the booking platform.

Intellectual property

The texts, photographs, logo, visual identity and code of this website belong to NULAN or to third parties who have authorised their use. Their reproduction, distribution, public communication or alteration without express written permission is prohibited.

Liability

NULAN aims to keep the information on this site accurate and up to date, but does not guarantee that it is free of errors or that the service will be uninterrupted. Wellbeing content is informational and does not constitute medical advice or treatment; it is no substitute for consulting a healthcare professional.

Third-party links

The booking buttons lead to Fresha, a platform independent of NULAN with its own terms of use and privacy policy. NULAN neither controls nor is responsible for its content. The same applies to links to maps, WhatsApp or social media.

Bookings, cancellations and payment

Appointments are booked through Fresha and paid for at the studio. Cancellations or changes must be notified at least [TO BE COMPLETED: hours] in advance. In the event of a no-show, [TO BE COMPLETED: no-show policy, or "no charge applies"].

This section must match exactly what is configured in Fresha; if they differ, what the client accepted when booking prevails.

Applicable law

This relationship is governed by Spanish law. For any dispute, the parties submit to the courts that apply by law, without prejudice to the jurisdiction legally available to the user as a consumer.

Data controller

Massaaziakadeemia OÜ, Spanish branch — NIF W0384638C
Carrer Rodríguez de Valcárcel 9, 07849 Santa Eulària des Riu, Illes Balears, Spain
hola@nulan.es · +34 609 481 379

[TO BE CONFIRMED with your adviser] who is formally the data controller: the Spanish branch or the Estonian parent company. That also determines whether data moves between the two and whether a representative must be appointed. Both are in the EU, so this is not an international transfer outside the EEA.

No data protection officer has been appointed; this is not mandatory for an activity of this nature and size. [TO BE CONFIRMED with your adviser if health data is processed routinely.]

What we process, why, and on what legal basis

1. The contact form on this site. Name, phone, email, session of interest, preferred date and the message you write. Purpose: answering your enquiry. Legal basis: your consent (art. 6(1)(a) GDPR), ticked expressly before sending.

2. Bookings. These do not happen on this site but on Fresha. The data you provide there is also governed by Fresha's privacy policy. NULAN processes the appointment data received through that platform in order to provide the service. Legal basis: performance of a contract or pre-contractual steps (art. 6(1)(b) GDPR).

3. Invoicing and accounting. Tax data needed to issue and keep invoices. Legal basis: compliance with a legal obligation (art. 6(1)(c) GDPR).

4. Server logs. Our hosting provider (Netlify) keeps access logs containing the IP address and technical request data, for security and service continuity. Legal basis: legitimate interest (art. 6(1)(f) GDPR).

Health-related data

Before the session we ask about injuries, pregnancy, recent surgery, allergies or medication, purely to adapt the technique and pressure and to avoid movements that are inadvisable in your case. This is health information and therefore a special category of data: we process it only with your explicit consent (art. 9(2)(a) GDPR), which you may withdraw at any time. Providing it is not mandatory, but without it we cannot guarantee the session is suitable for you and may have to limit or decline certain techniques. It is not shared with anyone outside the team treating you.

[TO BE REVIEWED with your adviser.] This section is only accurate if you do collect that information and the consent is documented in writing in the client record. If you never write it down, delete this section. If you do, also ask about the record of processing activities and the applicable retention period.

Retention periods

Form enquiries: [TO BE COMPLETED — e.g. 1 year from the last contact].
Client records: [TO BE COMPLETED].
Invoicing: for as long as tax and commercial law requires, [TO BE CONFIRMED with your adviser].
Server logs: the period applied by the hosting provider.

Recipients and processors

We do not sell or share your data. Only the providers needed to deliver the service have access: the booking and invoicing platform (Fresha), the web host (Netlify), the email provider (Google Workspace) and the firm that handles our accounts. Public authorities may also receive data where the law requires it.

[TO BE CONFIRMED] that a data processing agreement (art. 28 GDPR) is signed with each of them, and whether any involves an international transfer outside the European Economic Area and under which safeguard.

Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, without affecting the lawfulness of processing carried out beforehand. Write to hola@nulan.es or to our postal address, stating which right you wish to exercise and enclosing proof of identity.

If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Automated decisions

We do not make automated decisions or carry out profiling with your data.

This website does not use cookies.

There is no analytics, no advertising pixels and no third-party cookies. Nothing is stored in your browser, which is why no consent banner appears. Each language has its own address (/en/), not in storage.

The moment analytics, a Meta pixel or an embedded map is added, this section stops being true and a prior-consent banner becomes necessary.

When booking through Fresha

The booking button takes you to Fresha, a separate site with its own cookies and its own privacy policy. What happens there is outside this website's control.