1. Data controller
POWERDISE SL · NIF B16529596
Calle Eusebio Estada, 81A, 07004 Palma de Mallorca, Baleares
2. Data we process
- Identification and contact data: name, telephone number and email address.
- Customer and appointment data: services, date, notes, preferences, language and basic history.
- Billing and payment data where applicable.
- Appointment communications by email or WhatsApp/SMS and their sent, delivered or read status.
- Technical and security data: IP address, session identifiers, access or security logs, browser and device.
- With consent, pseudonymous advertising identifiers, source campaign and analytics or conversion events. We do not disclose the customer name, telephone number or email address to advertising platforms. With advertising consent, Meta also receives the IP address and browser details to link bookings to ads.
3. Purpose and legal basis
- Manage appointments, provide services and send confirmations or reminders. Basis: contract or pre-contractual steps (Art. 6.1.b GDPR). Required data are necessary to book; without them we cannot manage the appointment
- Customer service and internal customer management. Basis: contract and legitimate interest in assisting clients and organising the customer relationship (Art. 6.1.b and f GDPR)
- Billing, accounting and legal obligations. Basis: legal obligation (Art. 6.1.c GDPR)
- Analytics, advertising measurement and personalisation Basis: consent (Art. 6.1.a GDPR)
- Fraud prevention and system security. Basis: legitimate interest in protecting the service and preventing misuse (Art. 6.1.f GDPR)
4. Recipients
We use hosting, email, WhatsApp/SMS, analytics and advertising, advisory and support providers. They act as processors or, depending on the service, as controllers or joint controllers, such as Meta and Google.
When a card guarantee is required, SumUp securely collects and stores the card details. We keep an encrypted reference, the card brand and last four digits, the accepted authorisation and a record of charges or waivers. We do not store the full card number or CVV.
Transfers outside the EEA rely, as applicable, on adequacy decisions or standard contractual clauses. You may request a copy of the safeguards. We also disclose data where required by law.
5. Retention periods
- Customers and appointments: during the relationship and afterwards for the legal periods needed to address liabilities. WhatsApp/SMS records are retained with the appointment.
- Billing and accounting: for the periods required by applicable commercial and tax law.
- Consent and technical data: until consent is withdrawn; cookies and platforms follow the Cookie Policy and their settings. Direct click identifiers linked to a booking are retained for up to 90 days; afterwards only aggregated campaign data without direct identifiers may be retained. Account sessions last up to 60 days from the last activity, failed login attempts 1 hour and booking anti-abuse checks up to 24 hours. For this measurement, browser identifiers are used for up to 90 days and the IP address and technical browser details for 48 hours to retry delivery; they are automatically deleted at the next system cleanup.
6. Your rights
You may exercise your rights to access, rectification, erasure, object, restriction and data portability free of charge by contacting Sienna Nails.
- We will request identity documents only if we have reasonable doubts about your identity.
- Indicate the right you wish to exercise and the data concerned.
You may withdraw any consent without affecting prior processing. We do not make decisions with significant effects based solely on automated processing.
7. Minors
Bookings for minors must be made or authorised by their legal representatives where required.
8. Security measures
We apply proportionate measures such as access controls, restricted permissions, session expiry and encrypted communications.
9. Contact for exercising your rights
Sienna Nails
Calle Eusebio Estada, 81A, 07004 Palma de Mallorca, Baleares
Email: info@siennanails.com
10. Right to lodge a complaint
If you believe your rights have not been properly addressed, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
Anniversary giveaway
POWERDISE SL uses your name, mobile number, booking references, services, payments and participation preference to administer the draw and contact the winner. Its legal basis is its legitimate interest in offering this promotion to clients (GDPR Article 6(1)(f)), with prior information and an easy opt-out. This does not subscribe you to marketing. Only the winner supplies documents needed for eligibility, delivery and tax compliance. Authorised staff and service providers have access; tax authorities receive data where required. Data are kept during administration and claims, then erased or restricted for applicable statutory periods. Contact info@siennanails.com for access, correction, erasure, objection, restriction or portability where applicable. You may complain to Spain’s AEPD. See our privacy policy.