Privacy Policy

Last updated: 23 October 2026

1. Data Controller

Owner: Nuria Zardoya Lasheras
Email: contacto@nuriazardoya.es
Website: https://nuriazardoya.es
Tax ID and address: see the Legal notice

2. What Data We Collect and For What Purpose

We collect the personal data you provide through the contact form, WhatsApp or email and, where applicable, through registration forms for specific activities or programmes (for example, the “Christmas Challenge 2025”).

The data processed may include: full name, email address, telephone number, the reason for your enquiry and any additional information you give us in your message.

Health data. If you choose a health-related reason for your enquiry in the form (for example, clinical nutrition or digestive conditions) or tell us something about your health in your message, we will be processing health data, which the General Data Protection Regulation (GDPR) treats as a special category (Art. 9). We only process the health information you decide to share with us, and only to reply to your enquiry. There is no need to go into medical details in the form: we go through them in the consultation.

We process this data for the following purposes:

  • To manage and respond to your enquiries or requests for information.
  • To manage the provision of the services I offer (consultations, challenges, programmes, etc.).
  • Where applicable, to process payments and invoicing associated with those services and to comply with accounting and tax obligations.

We will not use your data for marketing purposes, newsletters or any other purpose without your prior explicit consent.

3. Legal Basis for Data Processing

The legal basis for processing your data depends on the purpose:

  • Managing enquiries and contact: your consent (Art. 6(1)(a) GDPR). In the contact form you give it expressly by ticking the consent box before sending it. For any health data you decide to share with us, the legal basis is your explicit consent (Art. 9(2)(a) GDPR).
  • Provision of services and challenges (including payments): the performance of a contract or of pre-contractual measures.
  • Nutritional care and clinical records (if you are already a patient): the health data needed to care for you and keep your clinical record are processed to provide you with healthcare, given by a healthcare professional bound by professional secrecy (Art. 9(2)(h) GDPR; under Spanish Law 44/2003, dietitian-nutritionist is a healthcare profession), and in accordance with Spanish Law 41/2002 on patient autonomy, which governs clinical records.
  • Accounting and tax obligations: compliance with the applicable legal obligations.
  • Protecting the forms against spam (reCAPTCHA): our legitimate interest in preventing abuse.
  • Web analytics (Google Analytics): your consent, which you give or refuse in the cookie notice.

You may withdraw your consent at any time by writing to contacto@nuriazardoya.es. From then on we will stop processing your data for that purpose; withdrawing it does not affect the lawfulness of the processing carried out before. Your consent to web analytics can be changed from the Cookie Policy.

4. Data Sharing

Your data is confidential and will not be disclosed to third parties, except where there is a legal obligation or where it is necessary in order to provide the service you have requested.

In particular, we use providers that act as data processors or as independent services:

  • Netlify, Inc. (USA), as a data processor: it hosts the website and receives and stores the messages sent through the contact form (Netlify Forms).
  • Hostalia (Spain, EU), as a data processor: the provider of the domain's email (contacto@nuriazardoya.es), used to send the replies and to write to patients.
  • Google (Gmail), as the provider of the email service in which we receive the notification of each enquiry sent through the contact form. Google LLC is a US company, so this involves an international data transfer (see below). More information in Google's Privacy Policy.
  • Google, to protect the forms against spam (reCAPTCHA, see below) and for web analytics (Google Analytics 4), which is not loaded at all until you accept analytics in the cookie notice. More details in the Cookie Policy.
  • WhatsApp (Meta), when you choose to contact me via WhatsApp. Messages are carried by its service, subject to its own privacy policy. Conversations are kept on Nuria's phone (see section 5), and there is no need to share medical details on WhatsApp: we go through them in the consultation.
  • PayPal, as the payment platform when you pay for a challenge or a service. PayPal processes your payment data as an independent controller; you can consult its privacy policy on its own website.

To protect the forms against automated submissions we use Google reCAPTCHA (Google LLC). This service analyses interaction patterns for security purposes and may carry out technical processing of data (for example, IP address, browser agent and device fingerprint) on the basis of our legitimate interest in preventing abuse of the service. More information in Google's Privacy Policy.

International transfers. Netlify and Google are US companies, so some data (including the contact form messages stored by Netlify and the enquiry notifications that reach Gmail) may be processed outside the European Economic Area. These transfers rely on the safeguards provided for in the GDPR: for Netlify, the standard contractual clauses approved by the European Commission, which form part of the data processing agreement that Netlify applies under its terms of service; for Google (reCAPTCHA, Google Analytics and Gmail), the EU-US Data Privacy Framework, under which Google LLC is certified.

5. Data Retention

If you do not go on to become a patient, enquiries that reach us through the contact form or by email are kept for a maximum of 12 months from your last message and are then erased, including from the Netlify forms dashboard and from the mailboxes. If you withdraw your consent or ask us to erase them earlier, we erase them at that point.

If you go on to contract a service or take part in a programme (for example, the Christmas Challenge), we will keep your data for as long as the professional relationship lasts. Afterwards, invoicing data are kept for the periods required by accounting and tax legislation (normally up to 6 years).

If you are a patient, your clinical record is kept for at least five years from discharge at the end of each episode of care (Art. 17 of Spanish Law 41/2002), or for any longer period set by the applicable health regulations.

WhatsApp conversations are kept on Nuria's phone for as long as needed to arrange your appointment or follow-up, and are then deleted.

6. Your Rights

You have the right to access your data, rectify it, erase it, object to its processing or ask for it to be restricted, and to the portability of the data you have provided to us. You can also withdraw any consent you have given at any time (section 3). To exercise any of these rights, write to contacto@nuriazardoya.es.

If you believe your rights have not been respected, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), at www.aepd.es.

WhatsApp