Privacy policy

Who is responsible for your data

• Owner: Calma de Mar Psicologia, S.L.
• Trading name: Calma de Ser
• Tax ID (NIF): B56586563
• Registered address: Carrer Fontanills, 15, 08320 El Masnou (Barcelona), Spain
• Email: hola@calmadeser.com
• Phone: 620 34 27 92
• Website: calmadeser.com

We apply Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).

In short

• We only ask you for the data we need to reply to you and support you.
• We do not sell your data or use it for advertising.
• If you pay for the first appointment, you do so on Stripe’s secure page: we neither see nor store your card details.
• The website uses no advertising cookies. The statistics cookies (Google Analytics) are set only if you accept them.
• Everything you tell us is confidential and subject to professional secrecy.
• You can ask us at any time to see, correct or delete your data: write to hola@calmadeser.com.

What data we process, what for, and on what legal basis

When you request a first appointment

• Data: Name, phone, email, the format and the time of day you prefer, and whatever you want to tell us.
• Purpose: To reply to you, assess what you need and arrange the first appointment.
• Legal basis: Your consent and the pre-contractual steps you ask us to take (art. 6.1.a and 6.1.b GDPR). For health data, your explicit consent (art. 9.2.a GDPR).

When you book and pay for the first assessment appointment

• Data: Name, email, phone, the kind of therapy you are looking for, the format (in person or online), the day and time, and the language of the page. Of the payment we only receive the confirmation and its reference: your card details go directly to Stripe.
• Purpose: To reserve the time in the calendar, charge for the appointment, send you the confirmation and the calendar event, and manage changes, cancellations and refunds according to the booking terms.
• Legal basis: The contract for the appointment you book (art. 6.1.b GDPR) and tax and accounting obligations (art. 6.1.c GDPR).

The first appointment calendar is Cal.com. We pass it only your name, your email, the language and the time, so that it can send you the confirmation. We do not pass it your phone number or anything you tell us. If the appointment is online, the video call is on Google Meet: the link reaches you by email and you can see it in “My appointment”.

After booking, you can tell us what brings you to therapy. It is optional, and we treat it as health data (explained below).

When you write to us

• Data: Name, email, phone if you give it to us, and your message, via the contact form, email, phone or WhatsApp.
• Purpose: To reply to your enquiry.
• Legal basis: Your consent (art. 6.1.a GDPR).

When you subscribe to “La isla”

• Data: Your email address.
• Purpose: To send you the newsletter, with content and news from the centre and the podcast.
• Legal basis: Your consent (art. 6.1.a GDPR). You can unsubscribe from any email.

When you send us your job application

• Data: Name, contact details, CV, training and experience.
• Purpose: To assess your profile for the centre’s recruitment processes.
• Legal basis: Your consent and the pre-contractual steps you ask us to take (art. 6.1.a and 6.1.b GDPR).

When you begin a therapeutic process

• Data: Identification, contact and billing details, and clinical record.
• Purpose: To provide you with psychological care, manage the calendar and invoice.
• Legal basis: The contractual relationship (art. 6.1.b GDPR), the obligations under health and tax regulations (art. 6.1.c GDPR) and the provision of healthcare (art. 9.2.h GDPR).

When you visit the website

• Data: With Plausible, nothing that identifies you: only aggregated data and no cookies, such as the most viewed pages, the website you came from, the country and the type of device; your IP address is not stored. And, only if you accept the statistics cookies, with Google Analytics: a random identifier stored in a cookie, the pages you visit, the buttons you click and technical data such as the browser, the device and the approximate country or city. Google Analytics does not store your IP address.
• Purpose: To know which pages are useful and improve the website.
• Legal basis: For Plausible, our legitimate interest in knowing how the website is used (art. 6.1.f GDPR), with no personal data and no cross-site tracking. For Google Analytics, your consent (art. 6.1.a GDPR), which you can withdraw at any time with “Cookie settings”, at the bottom of every page.

When you follow us on social media

• Data: Your public profile and your messages.
• Purpose: To manage our presence on the network and reply to you.
• Legal basis: Your consent, which you give to the social network when you follow us (art. 6.1.a GDPR).

About health data

In the appointment forms you can tell us what is happening to you. This information is health data and we treat it with the utmost confidentiality. Only the team that arranges the first appointment sees it. We ask you to write only what you need to so that we can guide you; the details are better left for the consultation.

When you begin a therapeutic process, we will give you specific written information about the clinical record and informed consent.

Minors

If you are under 14, your mother, father or legal guardian has to give consent on your behalf. The forms for children and adolescents must be filled in by a responsible adult. If we find that a person under 14 has sent us data without this consent, we will delete it.

What data you have to give us

In each form we mark which fields are required. Without them we cannot reply to you. You must give us true and up-to-date data. If you give us another person’s data, you must have their permission.

How long we keep your data

• Appointment requests and contact messages: as long as needed to reply to you and, if you do not begin a process with us, a maximum of 12 months.
• First appointment bookings: 12 months from the date of the appointment. If the payment is not completed, one month. The payment record forms part of the billing data.
• Newsletter: until you unsubscribe.
• Google Analytics statistics: 14 months.
• Job applications: until the end of the recruitment process, with a maximum of 6 months. If you tick the box for future processes, a maximum of 12 months. Your CV is not stored on the website: it reaches the centre’s email and we delete it within the same periods.
• Clinical record: the period required by health regulations. In Catalonia, a minimum of 15 years from the discharge of each care process (Law 21/2000).
• Billing data: 6 years, as required by commercial and tax regulations.

When the period ends, we delete the data or anonymise it.

Who else sees your data

We do not share your data with third parties, except when a law requires us to (for example, the Tax Agency or a court).

So that the website and the centre can operate, we engage the providers on this list. They process the data only according to our instructions and have signed a data processing agreement with us:

Provider	Service	Where the data is
Hetzner Online GmbH	Hosting of the website and its databases	Germany (EU)
Sendinblue SAS (Brevo)	Sending of the website’s emails and the “La isla” newsletter	France (EU)
Plausible Insights OÜ	Website visitor statistics, with no cookies or personal data	EU (Germany)
Google Ireland Ltd. (Google Analytics and Google Tag Manager)	Website usage statistics, only if you accept the statistics cookies	EU and USA (EU-US Data Privacy Framework)
Cloudflare, Inc.	Checking, with its Turnstile service, that whoever sends a form or books an appointment is a person and not an automated program. It uses technical browser data and the IP address	USA (see below)
Eholo Psicología, S.L.	The centre’s calendar and clinical records	Spain (EU)
Cal.com, Inc.	Calendar for the first assessment appointment and its confirmation emails	USA (see below)
Google Ireland Ltd.	The centre’s email, calendar and documents, and video calls for the online first appointment (Google Meet)	EU, with possible transfers to the USA (see below)
Zoom Video Communications, Inc.	Video calls for online therapy	USA (see below)
Stripe Payments Europe, Ltd.	Card payments, including the first assessment appointment	Ireland (EU), with possible transfers to the USA (see below)
Meta Platforms Ireland Ltd. (WhatsApp)	Messages you send us on WhatsApp	EU, with possible transfers to the USA (see below)

Stripe also processes some payment data as a controller in its own right, to meet its legal obligations and prevent fraud. Its policy is at stripe.com/privacy.

International transfers

Some of these providers may process data outside the European Economic Area. In these cases, the transfer has the safeguards of the GDPR: the EU-US Data Privacy Framework, for companies that have joined it, or the European Commission’s standard contractual clauses.

Your rights and how to exercise them

You have the right to:

• Access: know whether we process your data and obtain a copy.
• Rectification: correct incorrect or incomplete data.
• Erasure: ask us to delete your data when it is no longer necessary.
• Objection: object to a specific processing.
• Restriction: ask us to stop using your data while we resolve a complaint.
• Portability: receive your data in a commonly used format to give it to another organisation.
• Not to be subject to automated decisions: we do not make decisions about you automatically, nor do we build profiles.
• Withdraw consent at any time. Withdrawal does not affect what we did before with your permission.

To exercise your rights, write to hola@calmadeser.com with the subject “Data protection”, or send a letter to Calma de Mar Psicologia, S.L., Carrer Fontanills, 15, 08320 El Masnou (Barcelona), Spain. If we have doubts about your identity, we will ask you for a document that proves it. You can exercise them yourself or through someone who represents you. Exercising your rights is free of charge. We will reply within a maximum of one month. If the request is complex, the period may be extended by two more months, and we will tell you within the first month.

If you believe we have not respected your rights, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es, C/ Jorge Juan, 6, 28001 Madrid).

How we protect your data

We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), access restricted to the team members who need the data, passwords and backups. The whole team is bound by professional secrecy.

No system is completely secure. If there is a security breach affecting your data, we will notify the Spanish Data Protection Agency and, if there is a high risk to you, you as well.

Changes to this policy

We may update this policy when the law, our services or our providers change. The date of the last update is at the top and bottom of the page. If the change is significant, we will let you know.

Last updated: 4 October 2026.