Last updated 19 September 2026
Controller
Holotropica S.L., tax identification number B53977468, Calle Juana Francés 2, bungalow 10, 03540 Alicante, Spain. Privacy contact: info@holotropica.org. Telephone and WhatsApp: +34 607 302 727.
Scope and data
This policy covers personal data processed through psicoterapiaholotropica.com, holotropica.org and pay.holotropica.org, and through related communications, appointments, payments and administration. Clinical information generated during professional care is also covered by the specific information and informed consent provided to the patient where required.
- Identity and contact details.
- Information about an enquiry, appointment or contracted service.
- Billing, payment and reconciliation data. Holotropica S.L. does not receive or store full card numbers or Bizum credentials.
- Technical and security information needed to protect the services.
- Health or other special-category data only where necessary for the requested care and subject to enhanced safeguards.
Do not use the general contact form to send clinical reports, diagnoses or health information that is not essential to request an initial conversation.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Enquiries and appointment requests | Steps requested before entering into a contract and, where applicable, legitimate interests in handling and documenting the communication. |
| Providing agreed services | Performance of a contract. For health data, the additional basis will be healthcare or treatment by professionals bound by confidentiality where applicable, or explicit consent where legally required. |
| Billing, accounts and legal compliance | Compliance with legal, tax, accounting and professional obligations. |
| Payments and fraud prevention | Performance of the contract, legal obligations and legitimate interests in secure payment processing. |
| Requested marketing information | Consent, which may be withdrawn at any time. |
| Website security and incident response | Legitimate interests in protecting system security, availability and integrity. |
Recipients and payment providers
Data is shared only where necessary and supported by a legal basis. Service providers may process data for hosting, email, communications, videoconferencing, technical support, billing and administration under appropriate contractual and confidentiality duties.
Card and Bizum payments are completed in the secure BBVA and Redsys environment. Payment details are entered directly there. Holotropica S.L. receives the information needed to confirm and reconcile the transaction, but not full card details or Bizum credentials. Data may also be disclosed to advisers, insurers, professional bodies, authorities or courts where required by law or necessary to establish or defend legal claims.
International transfers
Where a technology provider processes data outside the European Economic Area, Holotropica S.L. will rely on a valid transfer mechanism, such as an adequacy decision, standard contractual clauses or another safeguard recognised by the GDPR. Information about applicable safeguards can be requested at info@holotropica.org.
Retention
Data will be kept only for as long as necessary for the relevant purpose and applicable limitation periods. Contract, billing and payment records will be retained for the statutory tax, accounting and commercial periods. Clinical records will be kept for the periods required by health and professional law. Marketing data will be kept until consent is withdrawn.
Rights and complaints
You may request access, rectification, erasure, restriction, portability and objection, and may withdraw consent without affecting prior lawful processing. Contact info@holotropica.org or the postal address above. You may also lodge a complaint with the Spanish Data Protection Agency at www.aepd.es.
Security, automated decisions and minors
Holotropica S.L. applies technical and organisational measures appropriate to the risk. The sites do not make decisions producing legal effects solely by automated means. Advertised services are intended for adults; personal data about minors should not be sent through general forms without a specific arrangement and verification of the relevant authority or representation.