Privacy Policy
Last updated: August 2026
The protection of your personal data is important to us. This Privacy Policy explains which personal data is processed when you visit our website, the purposes for which it is processed, the legal bases for the processing, and the rights available to you.
Personal data means any information relating to an identified or identifiable natural person. This may include, for example, your name, telephone number, email address, IP address and the content of a message.
1. Data controller
HEMA2014 S.L.
Managing Director / Administrator:
Manuela Wittler Widmer
Calle Ramón Gómez de la Serna 23
Edificio Marbella House
29602 Marbella (Málaga)
Spain
Telephone:
+34 952 820 714
WhatsApp:
+34 637 947 624
Email:
info@bellissimi-marbella.com
Website:
https://bellissimi-marbella.com
2. Legal bases for processing
We process personal data only where there is a lawful basis for doing so. Depending on the purpose concerned, processing is carried out in particular on the basis of the following provisions:
- Article 6(1)(a) GDPR: the data subject has given consent to the processing of personal data for one or more specific purposes.
- Article 6(1)(b) GDPR: processing is necessary for the performance of a contract or in order to take steps at the request of the data subject before entering into a contract.
- Article 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation.
- Article 6(1)(f) GDPR: processing is necessary for the purposes of our legitimate interests or those of a third party, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests.
Consent may be withdrawn at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
3. Hosting and provision of the website
Our website is hosted by a hosting service provider commissioned by us. The hosting provider processes technical data required to provide, secure and stabilise the website.
This may include in particular:
- the IP address of the device used,
- the date and time of access,
- the page or file accessed,
- the amount of data transferred,
- browser type and browser version,
- the operating system used,
- the referring URL,
- the HTTP status code, and
- technical error and security information.
Processing is carried out to ensure the technically correct and secure provision of our website on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and economical operation of our online services.
Where the hosting provider processes personal data on our behalf, such processing is carried out under a data processing agreement in accordance with Article 28 GDPR.
4. Server log files
When you access our website, so-called server log files may be created automatically. These are used in particular for error analysis, the prevention of attacks, the detection of misuse and the safeguarding of technical operation.
As a general rule, server log data is not combined with other data sources. The data is deleted once it is no longer required for the purposes stated, unless a legal obligation or a specific security incident requires longer storage.
The legal basis is Article 6(1)(f) GDPR.
5. Contact by email
When you contact us by email, we process the data you provide in order to handle your enquiry and any subsequent communication.
This may include in particular:
- your name,
- your email address,
- the subject of your message,
- the content of your message, and
- any other information you provide voluntarily.
Where your enquiry relates to our services or an appointment request, processing is based on Article 6(1)(b) GDPR. In the case of general enquiries, processing is based on our legitimate interest in responding to your enquiry pursuant to Article 6(1)(f) GDPR.
The data is deleted once the enquiry has been fully resolved and there are no statutory retention obligations or other legitimate grounds for continued storage.
Please note that the transmission of unencrypted emails may involve security risks. You should therefore not send particularly sensitive or confidential information by unencrypted email.
6. Contact by telephone
When you contact us by telephone, we process the information you provide solely for the purpose of dealing with your enquiry, arranging an appointment or taking pre-contractual steps.
This may include your name, telephone number, requested appointment, requested service and any other information you provide voluntarily.
The legal basis is Article 6(1)(b) GDPR or, in the case of general enquiries, Article 6(1)(f) GDPR.
7. Contact via the contact form
A contact form is available on our website. If you use this form, we process the information you enter in order to handle your enquiry.
This may include in particular:
- your name,
- your email address,
- your telephone number, where provided,
- the subject,
- the content of your message,
- the time of submission, and
- technical information used to prevent misuse.
Mandatory fields are marked accordingly. All other information is provided voluntarily.
Processing of enquiries relating to our services, appointment requests or pre-contractual steps is based on Article 6(1)(b) GDPR. Other enquiries are processed on the basis of Article 6(1)(f) GDPR.
The data submitted via the contact form is deleted once your enquiry has been fully resolved and there are no statutory retention obligations or other legitimate grounds for continued storage.
8. WhatsApp
Our website contains a floating WhatsApp link. This link allows you to start a conversation with us via WhatsApp.
The service provider for users in the European Economic Area is:
WhatsApp Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland
When you click the WhatsApp link, a connection to WhatsApp is established. In this process, WhatsApp may process your IP address, device and browser information, as well as the information that you visited our website. If you subsequently contact us via WhatsApp, WhatsApp processes further data in accordance with its own privacy policy.
The following data may be processed during communication via WhatsApp:
- your mobile telephone number,
- your profile name and, where applicable, profile picture,
- the content and time of messages,
- images or files transmitted, and
- technical connection and device data.
We use the data transmitted via WhatsApp solely to handle your enquiry, arrange appointments and communicate with you.
The legal basis is Article 6(1)(b) GDPR where the communication is necessary to arrange an appointment, perform a contract or take pre-contractual steps. In the case of general enquiries, the legal basis is Article 6(1)(f) GDPR.
WhatsApp is part of the Meta group of companies. Processing of data outside the European Economic Area, particularly in the United States, cannot be ruled out. Where required, the provider relies on the applicable legal transfer mechanisms for such transfers.
The use of WhatsApp is voluntary. You may alternatively contact us by telephone or email.
Further information is available in WhatsApp’s Privacy Policy: WhatsApp Privacy Policy .
9. Cookies and similar technologies
Our website uses cookies and comparable technologies. Cookies are small text files that may be stored on your device or used to read information from your device.
Some cookies are technically necessary for the proper functioning of the website. Other cookies and services are used only after you have given your prior consent through our consent banner.
We distinguish in particular between the following categories:
- Technically necessary cookies: these are required for the operation, security and basic functions of the website.
- Statistics cookies: these help us evaluate the use of our website statistically and improve our services.
- Marketing and external media cookies: these may be used to embed external content or transmit usage information to third-party providers.
Technically necessary cookies are used on the basis of Article 6(1)(f) GDPR. Where consent is required for access to information on your device, non-essential cookies and comparable technologies are used exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR.
You may withdraw or change your consent at any time with effect for the future:
Detailed information about the cookies used, their purpose, providers and storage periods can be found in our Cookie Policy.
10. Consent management with Complianz
We use the consent management solution Complianz on our website. Complianz stores and technically implements your decisions regarding the use of cookies and services requiring consent.
The following information may be processed in this context:
- your consent decision,
- the date and time of the decision,
- the language used,
- technical browser information, and
- an identifier used to assign the consent decision.
Processing is necessary to document your consent and comply with legal accountability obligations. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR and, additionally, Article 6(1)(f) GDPR.
11. Google Analytics
Following your consent, this website uses Google Analytics, a web analytics service provided by:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics helps us understand how visitors use our website. The following information may be processed:
- pages visited,
- approximate geographical region,
- date and time of the visit,
- duration of the visit,
- source of the visit,
- interactions with the website,
- browser and device information,
- the operating system used, and
- a shortened or technically processed IP address.
Google Analytics may use cookies or comparable technologies. The service is activated only after you have consented to the statistics category via our cookie banner.
The legal basis is your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future through the cookie settings.
The information collected by Google Analytics may be processed by Google and combined with other information to the extent permitted by Google’s terms of use and privacy policies.
Processing by Google companies or subcontractors outside the European Economic Area, particularly in the United States, cannot be ruled out. Where required, such transfers are based on applicable legal safeguards, for example an adequacy decision or Standard Contractual Clauses.
Further information: Google Privacy Policy .
12. Google Site Kit and Google Search Console
Where applicable, we use the WordPress plugin Google Site Kit for the technical management of certain Google services. Site Kit allows us to view information from services such as Google Analytics and Google Search Console in the administration area of our website.
Google Search Console is used in particular to monitor the technical visibility of our website in Google Search. The mere use of Search Console does not generally add additional tracking for visitors to our website. However, the services connected through Site Kit, particularly Google Analytics where activated, remain relevant from a data protection perspective.
13. Google reCAPTCHA
To protect our contact form against spam, automated entries and misuse, we use Google reCAPTCHA. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
reCAPTCHA analyses whether an entry is being made by a natural person or by an automated program. In this process, the following data may be processed:
- IP address,
- browser and device information,
- date and duration of the visit,
- mouse movements and keyboard input,
- referring URL,
- any existing Google cookies, and
- other data required to detect automated access.
Where reCAPTCHA is activated only after consent has been obtained, processing is based on Article 6(1)(a) GDPR.
Where reCAPTCHA is used as a strictly necessary measure to protect the contact form against serious misuse, processing may additionally be based on our legitimate interest in website security and spam prevention pursuant to Article 6(1)(f) GDPR. The specific technical configuration is managed through the consent system installed on the website.
Processing outside the European Economic Area cannot be ruled out.
Further information: Google Privacy Policy and Google Terms of Service .
14. Google Maps
Our website embeds a Google Maps map so that you can find our location more easily and plan your route. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
When the map is loaded, a connection to Google’s servers may be established. In this process, Google may process your IP address, location data, browser and device information, as well as information about the page you visited.
Google Maps is loaded only after you have consented to the use of external media or the relevant service through our consent banner.
The legal basis is your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future through the cookie settings.
Processing outside the European Economic Area, particularly in the United States, cannot be ruled out. Where required, Google relies on the applicable legal transfer mechanisms for such transfers.
Further information: Google Privacy Policy .
15. Instagram
Our website contains a link to our Instagram profile. Instagram is a service of the Meta group of companies. The provider for users in the European Economic Area is generally:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland
As long as you do not click the Instagram link and no active Instagram content is loaded on our website, the mere presence of the link does not generally result in a direct transfer of data to Instagram.
When you click the link, you leave our website. Instagram may then process your IP address, device information, the time of access and other usage data. If you are logged into Instagram at the same time, Instagram may associate the visit with your user account.
We have no control over the subsequent processing of data by Instagram. Processing outside the European Economic Area cannot be ruled out.
Further information: Instagram Privacy Policy .
16. Technical website services and WordPress plugins
Our website is based on WordPress and is designed using Elementor, among other components. We also use technical plugins for security, search engine optimisation, cookie management, contact forms and the reliable display of the website.
Where these components operate exclusively within our WordPress installation and do not establish connections to external providers, their mere use does not generally result in any additional transfer of visitors’ personal data to the plugin manufacturers.
Where a plugin loads external content or services, the processing of data is governed by the relevant sections of this Privacy Policy and by the selection you make in the consent banner.
17. Recipients of personal data
Personal data is disclosed only where this is legally permitted or necessary.
Possible recipients may include in particular:
- hosting and IT service providers,
- website maintenance and security providers,
- communications service providers,
- Google Ireland Limited and affiliated companies where the relevant services are used,
- Meta Platforms Ireland Limited or WhatsApp Ireland Limited where the relevant services are used,
- tax advisers, legal advisers or public authorities where required by law.
Where service providers process personal data on our behalf, they are contractually bound in accordance with Article 28 GDPR.
18. International data transfers
Some of the providers used on our website belong to internationally operating groups of companies. It therefore cannot be ruled out that personal data may also be processed in countries outside the European Economic Area.
Such transfers take place only where the legal requirements of Articles 44 et seq. GDPR are met. Depending on the provider, the transfer may be based in particular on an adequacy decision of the European Commission, Standard Contractual Clauses or other appropriate safeguards.
Despite these safeguards, certain third countries may provide a level of data protection that differs from that of the European Union. In particular, public authorities in those countries may be able to access data where the conditions under local law are met.
19. Storage period
We store personal data only for as long as it is required for the relevant purpose or for as long as statutory retention obligations apply.
Where the purpose of processing no longer applies and there is no legal or contractual basis for continued storage, the data is deleted or anonymised.
Where statutory retention obligations apply, processing is restricted to compliance with those obligations. The specific storage period may vary depending on the type of enquiry, contractual relationship or legal obligation.
20. Data security
We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other forms of misuse.
Our website uses an encrypted HTTPS connection. This generally protects data transmitted between your browser and our website from being read by unauthorised third parties.
However, absolute protection during transmission over the internet cannot be guaranteed.
21. Your data protection rights
Subject to the statutory requirements, you have in particular the following rights:
- Right of access: you may request information as to whether we process personal data concerning you and, if so, which data is processed.
- Right to rectification: you may request the correction of inaccurate data or the completion of incomplete data.
- Right to erasure: you may request the deletion of your personal data where the statutory requirements are met.
- Right to restriction of processing: you may request that the processing of your data be restricted where the statutory requirements are met.
- Right to data portability: where the statutory requirements are met, you may receive data you have provided in a structured, commonly used and machine-readable format or request its transfer to another controller.
- Right to object: you may object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR.
- Withdrawal of consent: you may withdraw consent previously given at any time with effect for the future.
- Right to lodge a complaint: you have the right to lodge a complaint with a competent data protection supervisory authority.
22. Right to object to processing
Where we process personal data on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is required for the establishment, exercise or defence of legal claims.
23. Competent supervisory authority
You may lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.
In Spain, the competent authority is in particular:
Agencia Española de Protección de Datos (AEPD)
Calle Jorge Juan 6
28001 Madrid
Spain
Website: https://www.aepd.es
24. No automated decision-making
We do not use decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR, which produces legal effects concerning you or similarly significantly affects you.
25. Notice on the use of artificial intelligence
This website may contain images based on our own photographs that have been edited or enhanced with the assistance of artificial intelligence (AI). Some texts have also been created or revised with the support of AI.
All content is carefully reviewed before publication, revised where necessary, and published under our editorial responsibility.
The presentation of this content does not generally involve automated processing of visitors’ personal data by an artificial intelligence system.
26. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy if legal requirements, the technical configuration of our website or the services we use change.
The current version published on this website shall apply.
Last updated: August 2026