Privacy Policy
Last updated: 3 September 2026
This page is the English translation of the legally authoritative Política de Privacidad. In the event of any discrepancy, the Spanish version prevails.
This policy explains how CLIPIC SL processes personal data collected through this website. Information on data processing in the context of medical care is provided separately at the clinic, at the time of admission.
1. Data controller
- Controller: CLIPIC SL (trading name: Clínica Picasso)
- Tax identification number (CIF): B57141038
- Address: Avinguda de Picasso 57, 07014 Palma de Mallorca, Illes Balears, Spain
- Telephone: 971 220 666
- Email: [email protected]
2. Data Protection Officer (DPO)
CLIPIC SL has appointed a Data Protection Officer, notified to the Spanish Data Protection Agency:
- NEW PROJECT SERVICIOS EMPRESARIALES SRL
- Plaza del Duque de la Victoria 1, floor 3, 41002 Seville, Spain
You may contact the DPO on any matter relating to the processing of your personal data, or use the controller’s contact details given in section 1.
3. Purposes and legal bases of processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Handling and responding to appointment and information requests submitted through the contact forms | Consent — Art. 6(1)(a) |
| Processing health data that the user chooses to include voluntarily in a form’s free-text field | Explicit consent — Art. 9(2)(a) |
| Ensuring the security of the website and preventing fraudulent or abusive use of the forms | Legitimate interest — Art. 6(1)(f) |
| Complying with applicable legal obligations | Legal obligation — Art. 6(1)(c) |
| Use of non-essential cookies and similar technologies | Consent — Art. 6(1)(a) and Art. 22(2) LSSI-CE |
4. Categories of data processed
- Identification data: first name and surname.
- Contact data: email address and, where applicable, telephone number.
- Content of the communication: the text entered by the user in the form and, where the form provides for it, the preferred physician and date.
- Technical data: IP address, date and time of access, browser and operating system, recorded by the server.
Important notice: the forms on this website are intended solely for appointment requests and general enquiries. We recommend that you do not include detailed information about your health (symptoms, diagnoses, treatments or test results). Should you nevertheless choose to provide such information, it will be processed as a special category of personal data under Article 9 GDPR on the basis of your explicit consent, given by ticking the acceptance box on the form.
5. Retention periods
- Requests submitted through forms: retained while the request is being handled and thereafter for the limitation period applicable to any legal claims arising from the matter (as a general rule five years, under Article 1964 of the Spanish Civil Code).
- Server logs: retained for a maximum of twelve months for security and technical diagnostic purposes.
- Record of cookie consent: in accordance with the periods stated in the Cookie Policy.
Once these periods have elapsed, the data is deleted or anonymised.
6. Recipients and processors
No data is disclosed to third parties except where required by law. The following service providers are involved, acting either as processors or as independent controllers:
| Service | Purpose | Data processing |
|---|---|---|
| IONOS SE (Germany) | Web and email hosting | Storage of form data and server logs. EU. |
| Cloudflare, Inc. (USA) | Content delivery network and security | Processing of the IP address and technical security cookies. |
| Google Ireland Ltd. / Google LLC | reCAPTCHA v3, protecting the forms against automated submissions | Loaded only on pages containing a form. Processes the IP address and interaction data to calculate a trust score. |
| Google Ireland Ltd. / Google LLC (YouTube) | Playback of embedded videos | Videos are blocked by default and are loaded only after your consent to the “marketing” category. Until then no connection to YouTube is established. |
The typefaces used on this website are served from our own server. No connection to Google servers is made to load them.
7. International transfers
Cloudflare and Google are companies whose parent entities are established in the United States. Where processing involves a transfer outside the European Economic Area, it is based on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, additionally, on the Standard Contractual Clauses adopted by the European Commission.
8. Your rights
You may exercise the following rights at any time:
- Access to your personal data.
- Rectification of inaccurate data.
- Erasure of your data.
- Restriction of processing.
- Data portability.
- Objection to processing.
- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise them, write to [email protected] or to the postal address given in section 1, providing proof of identity.
You also have the right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), in particular if you consider that your request has not been satisfactorily addressed.
9. Cookies
This website uses its own cookies and third-party cookies. Cookies that are not strictly necessary are only set with your consent, which you may give, refuse or change at any time through the settings panel. Full details are set out in the Cookie Policy.
10. Security
CLIPIC SL applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. Data transmitted through this website is encrypted using TLS.
11. Changes to this policy
This policy may be updated to reflect regulatory changes or changes to the website’s services. The version in force is always the one published on this page, stating the date of the last update.