Owner details missing

Privacy policy

Last updated: 6 October 2026

At INNER by Lau we look after your data with the same respect with which we look after our sessions. This policy explains what data we process, why, and what your rights are, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

1. Data controller

Controller: [OWNER / COMPANY NAME — PENDING]
Tax ID (NIF): [NIF — PENDING]
Address: [ADDRESS FOR NOTIFICATIONS — PENDING]
Email: hello@innerbylau.es

2. What data we process

“Request a session” form and WhatsApp community: first name, surname, date of birth, email, phone number (WhatsApp), the experience you are interested in and, if you provide them, format, area, availability and message.
During our relationship: details of booked sessions, payments and the health information you choose to share so that the practice can be adapted (special category data, which we only process with your explicit consent).
Newsletter: email, phone number and name, the date you subscribed and the messages sent.
The minimum technical data needed for the website to work and be secure (IP address, server logs).

We ask for your date of birth to adapt the sessions to each stage of life and to verify that you are at least 14 years old, the minimum age to give consent in Spain. If you are under 14, the request must be made by your mother, father or legal guardian.

3. What we use it for and legal basis

Responding to your request and managing your sessions (bookings, reminders, payments): performance of a contract or of pre-contractual measures at your request (art. 6.1.b GDPR).
Adapting the practice to your health: your explicit consent (art. 9.2.a GDPR), which you may withdraw at any time.
Sending you the newsletter by email and WhatsApp (news, practices and events): your consent, given by ticking the corresponding box (art. 6.1.a GDPR and art. 21 LSSI-CE). It is voluntary and you can unsubscribe whenever you like.
Adding you to the WhatsApp community: your consent when requesting access.
Complying with legal obligations (tax and accounting): legal obligation (art. 6.1.c GDPR).
Protecting the website against abuse and fraud: legitimate interest (art. 6.1.f GDPR).

We do not make automated decisions or create profiles that affect you.

4. How long we keep it

Requests that do not become a booking: up to 12 months from the last contact.
Clients: for as long as the relationship lasts and, afterwards, for the legally required periods (6 years for accounting and tax records; up to 5 years to handle any possible claims).
Newsletter: until you unsubscribe. We keep proof of your consent and of your unsubscription for as long as necessary to demonstrate them.
Health information: while you are a student; it is deleted afterwards.

5. Who we share your data with

We do not sell or transfer your data. Only providers that supply services to us have access to it, under a data processing agreement and with appropriate safeguards:

Cloudflare (website hosting, database and security).
Your bank and ours (and Bizum) when you pay us via Bizum or bank transfer: we see your name, the amount and the payment reference.
The website's mailbox provider (sending notifications and the newsletter) and Google (Gmail), where we receive requests.
WhatsApp / Meta, when we communicate with you via WhatsApp or you take part in the community.
Accountancy or advisory firm, for tax and accounting obligations.

Some of these providers may process data outside the European Economic Area (for example, in the USA). In such cases, transfers are covered by the EU-US Data Privacy Framework or by standard contractual clauses approved by the European Commission.

In the community WhatsApp groups, your name and phone number are visible to the other participants.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given at any time, by writing to hello@innerbylau.es. We will reply within one month at the latest.

To unsubscribe from the newsletter, simply use the link included in each email or reply “BAJA” to the WhatsApp message.

If you believe we have not processed your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security

We apply appropriate technical and organisational measures: encrypted connection (HTTPS), password-protected access to the management panel restricted to the owner, and providers with recognised security guarantees.

8. Changes to this policy

We may update this policy. The current version is the one published on this page, with its date of update. If the change is significant, we will let you know.