Privacy policy
Last updated: 21 October 2026
1. Who is the controller of your data?
| Controller | Zem Wellness Clinic, S.L. (hereinafter, “ZEM”) |
|---|---|
| Tax ID (CIF) | B54962618 |
| Registered office | Avda. Sorolla, 7, 29620 Torremolinos (Málaga), Spain |
| Place of business | C/ Suecia, s/n, Urb. Altea Hills, 03599 Altea (Alicante), Spain |
| Contact | (+34) 96 688 88 00 · info@zemaltea.com |
| Data Protection Officer | dpo@zemaltea.com |
2. What does this policy apply to?
This policy explains how ZEM processes the personal data you provide to us through zemaltea.com and its booking engine (reservations.zemaltea.com). It also applies to the data you provide to us by telephone, email, WhatsApp or social media, and to the data we process when providing our accommodation, food and beverage, wellness and healthcare services.
The careers portal (careers.zemaltea.com) and the Whistleblowing Channel have their own data protection information, which you can access from each of them. Cookies are governed by our Cookie Policy.
3. Why do we process your data, on what legal basis and for how long?
When each of the retention periods indicated ends, the data are blocked for as long as liabilities may arise from the processing. During that period they are only available to judges, courts and competent authorities. Once that time has elapsed, they are deleted.
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| 3.1Handling your requests for information and preparing personalised proposals (web forms, telephone, email, WhatsApp). | Identification and contact details, language, country, service or programme of interest and content of your enquiry. | Taking steps at your request prior to entering into a contract (art. 6.1.b GDPR). | Until your request is resolved and, if you do not go on to book, up to 18 months from the last interaction. |
| 3.2Advising you on the most suitable programme when, of your own choice, you share information about your health with us so that we can assess your needs and offer you guidance on the programme that may be suitable for you. | Health-related data that you voluntarily decide to provide to us. | Your explicit consent to the processing of your health data, in accordance with art. 9.2.a GDPR, in conjunction with the legal basis applicable to the processing of ordinary personal data. Where appropriate, the processing of personal data may be necessary to take steps requested by you prior to entering into a contract, in accordance with art. 6.1.b GDPR. | The data will be kept until your request for guidance has been resolved. If you book our services, the data necessary to provide the service will be incorporated into and kept in your medical record in accordance with the legally applicable periods (section 3.5). If you ultimately do not book, the health data provided exclusively for this purpose will be deleted within a maximum of 30 days from the resolution of your request, unless there is a legal obligation to retain them or it is necessary to keep them for the establishment, exercise or defence of possible legal claims. |
| 3.3Managing your booking and your stay: accommodation, food and beverage, spa and other contracted services, payment guarantee, invoicing and collection. | Identification and contact details, companions, dates and preferences for your stay, payment and billing data. | Performance of the contract (art. 6.1.b GDPR). Compliance with tax and accounting obligations (art. 6.1.c GDPR). | For the duration of the contractual relationship. Thereafter, 6 years for accounting records (art. 30 Spanish Commercial Code) and 4 years for tax records (art. 66 Spanish General Tax Law). |
| 3.4Guest document registration and information, and its communication to the Ministry of the Interior. | Identity data, ID document, dates of stay, contact and payment details required by law, including those of minors staying with us. | Legal obligation (art. 6.1.c GDPR): art. 25 of Organic Law 4/2015 on the protection of public safety, and Royal Decree 933/2021. | Three years, in accordance with Royal Decree 933/2021. |
| 3.5Providing you with healthcare as part of our programmes and treatments: prior health questionnaire, assessment, diagnostic tests, treatments and follow-up, and management of your medical record. | Identification data, health data, genetic data (genomic medicine), clinical images, habits and nutritional data. | Healthcare or treatment by professionals bound by professional secrecy (art. 9.2.h and 9.3 GDPR), in conjunction with the performance of the contract (art. 6.1.b) and the obligations under Law 41/2002 on patient autonomy and Law 10/2014 of 29 December on Health of the Valencian Community (art. 6.1.c). In emergencies, protection of vital interests (art. 9.2.c GDPR). | Medical record: at least 5 years from discharge for each care episode (art. 17.1 Law 41/2002). Genetic data: at least 5 years from when they were obtained (art. 52 Law 14/2007), where applicable. |
| 3.6Adapting our food offering to your allergies, intolerances or dietary needs. | Allergies, intolerances, dietary guidelines. | If it is part of a health programme: art. 9.2.h GDPR. If you are staying without a programme: your explicit consent (art. 9.2.a GDPR). | During your stay. They are only kept for future stays if you consent to it. |
| 3.7Sending you commercial communications (news, offers, events) by email, SMS or WhatsApp. | Name, contact details, language and commercial preferences. Never health data. | If you are not a customer: your consent (art. 6.1.a GDPR and art. 21.1 LSSI-CE). If you are a customer: legitimate interest in offering you our own products or services similar to those you have contracted (art. 6.1.f GDPR and art. 21.2 LSSI-CE). You can object in each communication. | Until you withdraw your consent or object or, failing that, after 18 months without interaction. |
| 3.8Creating a commercial profile to personalise our offers. | Services contracted, stated preferences and, if you have accepted the corresponding cookies, browsing data. Never health data. | Your consent (art. 6.1.a GDPR). No automated decisions with legal or similarly significant effects are taken (art. 22 GDPR). | Until you withdraw your consent. |
| 3.9Conducting quality and satisfaction surveys. | Contact details and opinions about our services. | Legitimate interest in improving our services (art. 6.1.f GDPR). You can object at any time. | 12 months from your response. |
| 3.10Handling complaints, claims and the exercise of your rights. | Identification and contact details and content of the complaint or request. | Legal obligation (art. 6.1.c GDPR): consumer and user protection legislation and the GDPR. | 5 years from the resolution or closure of the complaint, claim or request and, in any case, for as long as legal liabilities may arise. |
| 3.11Managing our social media profiles and interacting with you. | Username, profile picture and messages. | Your consent when you follow us or write to us (art. 6.1.a GDPR). | For as long as you follow our profile or as necessary to reply to you. |
| 3.12Analysing browsing and displaying advertising through cookies. | Online identifiers and browsing data. | Technical cookies: exempt from consent (art. 22.2 LSSI-CE). Others: your consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE). | As detailed in the Cookie Policy. |
4. Are you obliged to provide us with your data?
Fields marked with an asterisk are required to handle your request or provide you with the service; if you do not provide them, we will not be able to do so. Guest registration data are mandatory by law. Providing the rest of the data and giving the optional consents is voluntary and does not affect the provision of the service.
5. Who do we share your data with?
We do not sell your personal data. We only share them when there is a legal basis that allows it and when the disclosure is necessary to comply with a legal obligation, provide the services requested or manage our business.
In particular, your data may be disclosed to the following recipients:
- Public administrations and competent authorities, when there is a legal obligation or when necessary for the performance of their duties. This includes, among others, the Ministry of the Interior, in relation to guest registration obligations; the Spanish Tax Agency (AEAT); health authorities; and courts and tribunals, in the cases provided for by law.
- Insurance companies, when you request that a healthcare service be covered by your policy.
- Healthcare centres and professionals involved in your care, when necessary to provide, coordinate or manage the healthcare services requested. For example, IMED Hospitales, for carrying out the tests included in the Signature Health Check-up programme, as well as clinical and genetic analysis laboratories when they are involved in performing or analysing the corresponding tests.
- Financial institutions and payment gateways, to process payments and guarantees.
- SANDOS Group companies: only identification and billing data, for internal administrative purposes. Health data are never disclosed.
In addition, providers of the following services access your data on behalf of ZEM and under a data processing agreement (art. 28 GDPR): web hosting and cloud services; form management and customer relationship management (HubSpot); booking engine; hotel and clinic management software; cookie consent management; messaging (WhatsApp Business); sending of commercial communications; and management of the Whistleblowing Channel.
6. Are your data transferred outside the European Economic Area?
Some of our providers may be established outside the European Economic Area (EEA) or allow access to or processing of personal data from countries outside the EEA. In particular, these providers may include HubSpot, Inc., Google LLC and Meta Platforms, Inc., depending on the services used and their configuration.
Where an international data transfer takes place, it will be carried out in accordance with the requirements set out in Chapter V of the GDPR and will be covered by one of the mechanisms provided for by law, in particular:
- The European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, where the recipient in the United States is certified under that Framework and the transfer can rely on this adequacy decision.
- The standard contractual clauses approved by the European Commission, currently those established by Implementing Decision (EU) 2021/914, together with any supplementary measures that may be necessary.
Likewise, where applicable, the other safeguards and requirements laid down in the GDPR for international transfers will apply.
Health data are processed exclusively within the European Economic Area and are not subject to international transfers outside the EEA.
7. Minors
Our website is not aimed at minors. The data of children under 14 may only be provided by their parents or guardians (art. 7 LOPDGDD). When a minor stays at ZEM, their data are processed to manage the stay and comply with guest registration requirements. If they receive healthcare, the rules on consent by representation of Law 41/2002 apply.
8. Data of third parties
If you provide us with data of other people (for example, companions), you must have previously informed them of the provisions of this policy.
9. What are your rights and how can you exercise them?
You have the right to:
- Access your personal data.
- Rectify inaccurate data.
- Request the erasure of your data.
- Object to their processing.
- Request the restriction of processing.
- Request the portability of your data.
- Not be subject to decisions based solely on automated processing.
Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing. To stop receiving commercial communications, simply use the unsubscribe link included in each message.
You can exercise your rights by writing to dpo@zemaltea.com or by post to Zem Wellness Clinic, S.L., C/ Suecia, s/n, Urb. Altea Hills, 03599 Altea (Alicante), Spain, with the reference “Data Protection”. We may ask you for additional information to verify your identity if there are reasonable doubts about it. We will reply within one month, which may be extended by two further months where necessary given the complexity or number of requests (art. 12.3 GDPR).
Some rights have legal limits. For example, medical records cannot be erased while the legal obligation to keep them remains in force. Furthermore, the right of access to medical records does not extend to third-party data or to the subjective notes of professionals where they reserve that right (art. 18 Law 41/2002).
If you consider that we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es). Before doing so, if you wish, you can contact our Data Protection Officer.
10. Security and confidentiality
ZEM applies technical and organisational measures appropriate to the risk of the processing (art. 32 GDPR). Only authorised healthcare staff access clinical information. All our staff are subject to a duty of confidentiality, and healthcare professionals are also bound by professional secrecy. Should a security breach occur that is likely to result in a high risk to your rights, we would notify you without undue delay (art. 34 GDPR).
11. Changes to this policy
We will update this policy when the processing activities or the regulations change. The date of the last update appears at the beginning of the document.
