Privacy Policy

At Gabinete Blanca Podología, we are committed to protecting and respecting your privacy. This policy explains how we collect, use, disclose, and protect your personal information in accordance with the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Data Protection and Digital Rights Guarantee (LOPDGDD).

1. Data Controller

Personal data collected through this website will be processed by Gabinete Blanca SL, with Tax ID (CIF) B09647306 and registered address at Av. El Ferrol, 4, Local T2, 28029 Madrid, Spain, as the data controller.

2. Purposes of Data Processing

Your personal data will be used for the following purposes:

  • Managing and responding to your enquiries and requests for information
  • Providing the requested services and maintaining the professional relationship
  • Sending informational communications about our services and updates (only with your express consent)
  • Complying with our legal and regulatory obligations

3. Legal Basis for Processing

The processing of your data is based on:

  • The performance of a contract or professional relationship
  • Your explicit consent for specific purposes
  • Compliance with applicable legal obligations
  • Our legitimate interest in keeping you informed about our services

4. Categories of Data Collected

We may collect and process the following categories of personal data:

  • Identifying data: name, surnames, national ID number, postal and email address, telephone number
  • Health data: medical information relevant to the provision of our podiatric services
  • Transaction data: information about services contracted and billing
  • Browsing data:
    • Anonymised IP address
    • Device type and browser used
    • Pages visited and time spent
    • Interactions with the website (clicks, scrolling, mouse movements)
    • Demographic data and interests (where available)

5. Analytics Tools and Third Parties

This website uses a consent gating mechanism: no analytics or advertising tracker is loaded or sends data to third parties before you have accepted the corresponding cookies. If you reject, the tools below are not downloaded and do not set cookies. For full detail on each cookie and its duration, see our Cookie Policy.

Google Analytics 4 (GA4)

Loaded only if you accept the Analytics category. Collects aggregated usage metrics (page views, time on page, clicks on phone or WhatsApp). The IP address is anonymised before transmission.

Measurement ID: G-3K46KNB8NM · Cookies: _ga, _ga_3K46KNB8NM (24 months) · Controller: Google LLC, USA (transfer covered by the EU-US Data Privacy Framework) · Privacy policy: policies.google.com/privacy

Google Ads — conversion attribution

Activated only if you accept the Marketing category. Reuses the GA4 script already loaded to attribute conversions (phone or WhatsApp clicks) to advertising campaigns. The integration is currently prepared in code; the cookies _gcl_au and _gcl_aw are generated only when an advertising campaign is active and the user has accepted marketing.

Customer ID: AW-17431914603 · Cookies (when active): _gcl_au, _gcl_aw (90 days) · Controller: Google LLC, USA (Data Privacy Framework)

Google Maps (contact page)

The interactive map of the clinic is loaded only if you accept the Marketing category. Until then, the contact page shows a placeholder that requires an explicit click. Once accepted, Google Maps may set its own cookies for user preferences and fraud prevention.

Google cookies set when the map loads: NID (6 months), 1P_JAR (1 month), CONSENT (2 years), SOCS · Controller: Google LLC, USA (Data Privacy Framework)

Cloudflare (CDN, security and network error reporting)

Service required to deliver the site, mitigate bot abuse and report network errors to the CDN. Does not require consent because its processing is based on legitimate interest (GDPR art. 6.1.f) for service availability and security.

Cookies: __cf_bm (30 minutes, anti-bot) · Network Error Reporting (NEL): no cookies, via HTTP headers · Controller: Cloudflare Inc., USA (Data Privacy Framework) · Privacy policy: cloudflare.com/privacypolicy

External Google images (review avatars)

On the home page, the public profile pictures of review authors are served from Google (lh3.googleusercontent.com). These images are loaded as <img> without setting cookies. Their download means your IP address is known to Google when the image loads, and is based on legitimate interest to display public content tied to the author's Google profile.

Cookies: none · Controller: Google LLC, USA (Data Privacy Framework)

Own technical storage (cookie consent)

To remember your decision about cookies between visits, the site stores a value in the browser's local storage (localStorage). It is strictly necessary for this policy to function and is not transferred to any third party.

Key: gbp-cookie-consent (localStorage) · Duration: until the user clears it or resets their consent · Controller: Gabinete Blanca SL (Spain)

6. Data Recipients

Your personal data may be disclosed to:

  • Service providers who assist us in our operations (under appropriate contractual guarantees), including:
    • Netlify, Inc. — website hosting (USA, Data Privacy Framework)
    • Cloudflare, Inc. — content delivery network, security and network error reporting (USA, Data Privacy Framework)
    • Google LLC — web analytics (Google Analytics 4), advertising attribution (Google Ads, when active) and interactive map on the contact page (Google Maps), all subject to your consent (USA, Data Privacy Framework)
  • Health authorities and public bodies where required by law
  • Other entities where necessary for the provision of the requested services (always with your prior consent)

International transfers: Google and Cloudflare may process data on servers located in the United States. Such transfers are covered by the European Commission's adequacy decision regarding the EU-US Data Privacy Framework. Where this does not apply, the European Commission's standard contractual clauses are used.

7. Data Retention

We will retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, accounting, or reporting obligations. Specific retention periods are:

  • Client data: for the duration of the contractual relationship and thereafter for the applicable statutory periods
  • Browsing data: up to 24 months from the last interaction
  • Marketing contact data: until you request to unsubscribe or withdraw your consent

8. Your Data Protection Rights

You may exercise the following rights at any time:

  • Access: to find out what data we are processing
  • Rectification: to correct inaccurate or incomplete data
  • Erasure: to request deletion of your data when it is no longer necessary
  • Restriction of processing: to restrict the processing of your data in certain circumstances
  • Portability: to receive your data in a structured format and transmit it to another controller
  • Objection: to object to the processing of your data for marketing purposes or on legitimate grounds
  • Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise these rights, please send a written request to enclosing a copy of your national identity document or equivalent identification.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you consider that the processing of your data does not comply with applicable legislation.

9. Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

  • Protection of communications using secure protocols (TLS/SSL)
  • Access control through authentication and authorisation mechanisms
  • Regular backups
  • Access logs for personal data
  • Procedures for notifying security breaches where required

Despite our security measures, the transmission of information over the internet is never completely secure, so we cannot guarantee the security of data transmitted to our website.

10. Minors

Our services are not directed at children under 14 years of age. If you become aware that a minor has provided personal data without parental or guardian consent, please contact us so that we can arrange for its deletion.

11. Links to Other Websites

Our website may contain links to third-party websites. This privacy policy applies only to our website, and we recommend that you read the privacy policies of any third-party websites you visit.

12. Cookie Settings

We use cookies and similar technologies to improve your experience on our website. You can manage your cookie preferences through:

  • Our cookie settings panel
  • Your web browser settings
  • Opt-out tools provided by third parties (such as the Google Analytics opt-out browser add-on)

For more information, please see our Cookie Policy.

13. Changes to the Privacy Policy

We reserve the right to modify this privacy policy at any time to reflect legislative or jurisprudential developments or industry best practices. Where changes are made, we will publish them on this page with reasonable advance notice before they take effect.

Last updated: 27 April 2026

14. Contact

If you have any questions about this privacy policy or about the processing of your personal data, you may contact us via:

Need more information about data protection?

We are at your disposal to answer any questions about how we protect your privacy and manage your personal data.