Privacy policy

This policy explains how Mejores Barcelona handles the personal data of people who visit the site or contact us. The controller is established in Spain, so we follow the General Data Protection Regulation of the European Union (GDPR) and the Spanish Organic Law on Data Protection and Digital Rights (LOPDGDD). If you are in the United Kingdom, the rights below match the ones you have under the UK GDPR.

1. Controller: Jaume Oró Aresté, tax ID (NIF) 43747772V, address Dipòsits 6, 25195 Lleida, contact [email protected].
2. What data we handle, why and on what legal basis:
   • Visiting the site: aggregate usage statistics from Cloudflare Web Analytics, without cookies and without persistent visitor identifiers. Cloudflare may process technical connection data, such as the IP address, to deliver the site and keep it secure. Basis: legitimate interest in measuring use of the site and keeping it secure (art. 6.1.f GDPR).
   • Messages sent to [email protected]: name, email address and the content of the message. Purpose: to answer your enquiry. Basis: your consent when you write to us or, where relevant, steps before entering a contract (art. 6.1.a and 6.1.b GDPR).
   • Enquiries from professionals and centres: professional contact details. Purpose: to reply and manage the relationship. Basis: steps before entering a contract and legitimate interest (art. 6.1.b and 6.1.f GDPR).
   • Clients (partner centres): billing and contact details. Purpose: to provide the contracted service and meet tax and accounting duties. Basis: contract and legal obligation (art. 6.1.b and 6.1.c GDPR).
   • User requests: the request form is not available at the moment. When it is switched on, we will handle your contact details, your area, the reason for your enquiry, any health information you choose to give and your preferred time, only to put you in touch with a partner centre. Basis: your explicit consent (art. 6.1.a and 9.2.a GDPR), which you can withdraw at any time without affecting the lawfulness of earlier processing.
3. Sharing with partner centres: when the request form is active, the centre in your area that receives the request becomes the controller of that data. A request is passed to one centre at a time.
4. Processors and recipients: hosting and delivery network for the site, database, transactional email, client payments and, where relevant and once the request form is active, automatic classification of requests (a language model provider, with no use of the data for training). These providers act as processors under contract in line with art. 28 GDPR. We do not pass data to third parties except where the law requires it or as described in the previous point. International transfers: The data from enquiries is stored in the European Union (database in Ireland) and transactional email is sent through a provider with servers in the European Union. Cloudflare, Inc. (United States) provides the hosting, the delivery network and the security of the site and may process technical data from the visit, such as the IP address, under the European Commission's standard contractual clauses and its participation in the EU-US Data Privacy Framework, as set out in its data processing agreement. No language model provider is used at launch. No personal data is kept in backups outside Supabase..
5. Retention: requests are kept for 12 months and then anonymised; requests that are not handled are kept for 30 days. Client data is kept for the legal periods. Messages sent by email are kept as long as needed to deal with your enquiry and then only for the legal limitation periods for possible claims.
6. Your rights and how to use them: you can ask for access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw any consent you gave, by writing to [email protected] or using the link in each email we send you. We reply within one month of receiving your request. We do not take decisions based solely on automated processing that have legal effects on you. If you think your rights have not been respected, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es), to the data protection authority of the country where you live or work, or, if you are in the United Kingdom, to the Information Commissioner's Office (ico.org.uk).
7. Security: encryption in transit, access controls and technical logs without personal data.
8. Cookies: the site does not use analytics or advertising cookies and does not place identifiers on your device for tracking. If a form is switched on, the Cloudflare Turnstile anti-spam check may use strictly necessary technical storage, which is exempt from consent under art. 22.2 of the Spanish LSSI-CE and the equivalent rule for strictly necessary storage in your country. If a cookie that needs consent is ever added, it will not be set without your prior agreement and this policy will be updated first.
9. Children: the site is not aimed at children and we do not knowingly collect their data.
10. Changes to this policy: we will publish any change here. The version and its date are shown on this page.

Version: privacy-policy en v1.0 (2026-10-17). Written by the system from privacy-policy v1.1 (es), adapted for English-speaking readers, with no lawyer review.