PRIVACY AND DATA PROTECTION POLICY
— Frere's Barberia i Massatges. In force since 1 September 2026. Last revised: 30 September 2026. The version published at this address prevails over any printed or stored copy. This English version is a courtesy translation; in the event of any discrepancy, the Spanish version shall prevail.
In short. This website does not collect personal data or use cookies, and while you browse it only connects to the server that hosts it (GitHub), with no trackers or resources from other companies. We only process the data you choose to give us when you message us on WhatsApp or Instagram or call us, and only to give you an appointment and look after you. Controllers: Matías Ezequiel Ferreira and Axel Gabriel Suárez (Frere's). For any question about your data, email us at Axelgabrielsuarez454@gmail.com; if you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD) or to the data protection authority of the EU country where you live. The full information is below.
1. Controllers.
Any personal data provided is processed by Matías Ezequiel Ferreira and Axel Gabriel Suárez, self-employed professionals trading as Frere’s Barbería i Massatges, at Raval de Robuster, 39, 43204 Reus (Tarragona), Spain, telephone +34 614 33 03 42, email Axelgabrielsuarez454@gmail.com, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). As they jointly determine the purposes and means of processing, they act as joint controllers under Article 26 GDPR. The essence of their arrangement is as follows: they share a single point of contact for data subjects, namely the email address above; the information in this policy is common to both; and both apply the security measures described in section 9. Regardless of that arrangement, you may exercise your rights against either of them. The controllers' full tax identification details are set out in the legal notice. No data protection officer is required under Article 37 GDPR, as none of the cases provided for therein applies.
2. Data processed and its source.
First of all, this website has no contact, registration, subscription, booking or other forms, does not ask you to create a user account and has no analytics, audience measurement, profiling or behavioural advertising tools; it therefore collects no personal data simply because you browse it. The automated assistant “Frankie” runs entirely in your browser: whatever you type is not sent to any server and disappears when you close or reload the page. We only process the data that you voluntarily decide to provide when you choose to contact the business, which as a rule is limited to the following: if you contact us via WhatsApp, your phone number, the name and profile picture shown by the app and the content of the messages exchanged; if you call us, your phone number and the data strictly necessary to manage the appointment, usually your name and preferred time slot; if you contact us via Instagram direct messages, your username and the content of the message; and, if you request an invoice, the identification and tax address details required by law. No special categories of data under Article 9 GDPR are processed, and we expressly ask you not to send information about your health or other sensitive data through the contact channels, without prejudice to any information that must strictly be given verbally at the premises before a massage, which will be used solely to provide that service.
3. Purposes and legal bases.
Data is processed for the following purposes and on the following legal bases: to handle appointment requests, manage the diary and provide the requested service, on the basis of the performance of a contract or of steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); to answer enquiries, suggestions or complaints sent through any of the channels provided, on the basis of the controllers' legitimate interest in responding to those who contact them (Article 6(1)(f) GDPR); to comply with applicable legal obligations, in particular tax, accounting and consumer protection obligations (Article 6(1)(c) GDPR); and to publish on the website images in which identifiable people appear, on the basis of their consent (Article 6(1)(a) GDPR), as described in section 10. The data is not used to send marketing communications, for profiling or for automated decisions producing legal effects or similarly significantly affecting data subjects.
4. Retention periods.
Data will be kept for as long as the relationship with you continues and you do not request its erasure, and thereafter for the limitation periods of any liability arising from the processing. Information relevant for tax and accounting purposes will be kept for the periods required by Spanish tax and commercial law, which are generally four years from the end of the filing period for the relevant tax return and six years for accounting records. Published images will be kept until consent is withdrawn. After those periods, data will be erased or anonymised.
5. Recipients and processors.
No data will be disclosed to third parties unless required by law, as in the case of the tax authorities, law enforcement agencies or the courts in the exercise of their functions. However, please note that contacting the business through WhatsApp or Instagram necessarily means that the content of that communication is processed by those platforms, operated in the European Economic Area by Meta Platforms Ireland Limited as independent controllers under their own privacy policies, over which the owners of this website have no control and which you are expressly advised to read. The same applies to the business profile and mapping services operated by Google Ireland Limited, which you only reach if you click the relevant links. Those communications may involve international transfers of data to third countries, which those companies state are covered by European Commission adequacy decisions, in particular the EU-US Data Privacy Framework, or by standard contractual clauses approved by the Commission.
6. Website hosting and external resources.
This website does not load any resources hosted by third parties: the fonts, images, video, style sheets and scripts are served from the website itself, and no maps, videos, social media buttons or other embedded elements from other companies are included. The website is hosted on GitHub Pages, a service of GitHub, Inc. (United States). To serve the pages, GitHub necessarily receives the IP address and technical data of each connection (date and time, requested page and browser), which it logs for the security and integrity of the service in accordance with its privacy statement. The owners of this website do not access those logs or use them to identify users or build profiles. This processing is based on the legitimate interest in providing the website securely (Article 6(1)(f) GDPR), and the transfer of this data to GitHub, established in the United States, is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework, in which GitHub participates.
7. Your rights.
You have the right to obtain confirmation as to whether personal data concerning you is being processed and, if so, to access it; to request the rectification of inaccurate data or, where appropriate, its erasure when, among other reasons, it is no longer necessary for the purposes for which it was collected; to request the restriction of processing, in which case the data will only be kept for the establishment, exercise or defence of legal claims; to object to processing, in which case the data will no longer be processed unless there are compelling legitimate grounds or it is needed for legal claims; to request data portability where processing is based on consent or a contract and is carried out by automated means; and to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You may exercise these rights free of charge by writing to Axelgabrielsuarez454@gmail.com or by post to Raval de Robuster, 39, 43204 Reus (Tarragona), Spain, stating which right you wish to exercise. Additional information to confirm your identity may be requested only where there are reasonable doubts about it, in accordance with Article 12(6) GDPR. Your request will be answered within one month of receipt, which may be extended by two further months depending on the complexity or number of requests. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the supervisory authority of the EU Member State in which you habitually reside, especially if you have not obtained satisfaction when exercising the rights above.
8. Minors.
Services at the premises may be provided to minors, in which case the appointment must always be requested, and the relevant data provided, by the person holding parental authority or guardianship, to whom any communication regarding the processing will also be addressed.
9. Security measures.
The controllers apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, in order to prevent the accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or the unauthorised disclosure of, or access to, such data.
10. Images published on the website.
The photographs and video on the website show the premises, their owners and, where applicable, people who have given their consent to appear in them, in accordance with the GDPR and Spanish Organic Law 1/1982 of 5 May on the civil protection of the right to honour, personal and family privacy and one's own image. That consent may be withdrawn at any time by writing to Axelgabrielsuarez454@gmail.com, in which case the image will be removed from the website without undue delay. If you appear in an image and have not given your consent, please let us know in the same way.
11. Changes to this policy.
This privacy policy may be amended to reflect changes in legislation, case law or the guidance of supervisory authorities, or changes in the processing actually carried out; the version in force at any time will be published at this same address.
← Back to Frere's · Legal notice · Privacy policy · Cookie policy