Privacy PolicyPrivacy Policy

In accordance with the principles of lawfulness, good faith, and transparency, we provide you with this privacy policy.
‍(Last updated: June 2026)

‍‍

Who is responsible for processing your data?

The data controller is CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L., with tax identification number (NIF) B57676199 and registered office at Calle Camilo José Cela, núm. 20, Palma (07014), Illes Balears. Telephone: +34 971 10 20 08. Email: hola@clinicaescastell.es. You can reach our Data Protection Officer at lopd@clinicaescastell.es.

‍

For what purpose do we process your personal data?

At CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L., we process the information you provide for the following purposes, depending on the group of individuals concerned:

Prospective Clients: Management of the potential business and/or professional relationship, processing the submission of requested information and/or answering inquiries, presenting offers for our services and/or products that may be of interest to you.
Clients: Management of the business and/or professional relationship, presenting offers for our services and/or products that may be of interest to you.
Suppliers: Management of the business and/or professional relationship.
Prospective Patients:Potential Patients: Processing of information requests, answering inquiries submitted via the website, managing appointment requests, and providing information about the health services offered by the clinic.
Patients:Patients: Provision of the requested health services, the associated administrative management, medical aftercare, and the sending of information related to the clinic's services, provided there is a legal basis for this.
Applicants:Applicants: Conducting the recruitment process.
Website Users:Website Users: Analysis of your navigation data.

‍‍

What is the legal basis for processing your data?What is the legal basis for processing your data?

The legal basis for processing your personal data may vary depending on the group of data subjects:The legal basis for processing your personal data may vary depending on the data subject group:

Prospective Customers:Potential Customers:Potential customers: Art. 6(1)(b) GDPR (performance of pre-contractual measures at the request of the data subject: cost estimates, order forms, service offers...); Art. 6(1)(f) GDPR (legitimate interest: transmission of requested information, answering submitted inquiries...); Art. 6(1)(a) GDPR (consent of the data subject: submission of offers for our services and/or products).
Customers:Customers:Customers: Art. 6(1)(b) GDPR (performance of a contract to which the data subject is party).
Suppliers:Suppliers:Suppliers: Art. 6(1)(b) GDPR (performance of a contract to which the data subject is party).
Prospective Patients:Potential Patients:Potential patients: Art. 6(1)(b) GDPR (performance of pre-contractual measures at the request of the data subject: information requests, appointment requests, cost estimates, or treatment evaluations); Art. 9(2)(h) GDPR (processing necessary for the purposes of preventive healthcare, medical diagnosis, the provision of health or social care or treatment, and the management of health systems and services).
Patients:Patients:Patients: Art. 9(2)(h) GDPR (preventive healthcare, medical diagnosis, health care or treatment, and the management of health services); Art. 6(1)(c) GDPR (compliance with legal obligations applicable to healthcare institutions and health professionals); Art. 6(1)(b) GDPR (performance of the contractual relationship for the provision of health services).
Applicants:Applicants:Applicants: Art. 6(1)(a) GDPR (Consent of the data subject).
Website Users:Website Users:Website users: Art. 6(1)(a) GDPR (Consent of the data subject).

The data we request is adequate, relevant, and limited to what is necessary. You are in no way obliged to provide it to us; however, failure to provide it may affect the purpose of the service or make its provision impossible.The data we request is adequate, relevant, and limited to what is necessary. You are in no way obliged to provide it to us; however, failure to provide it may affect the purpose of the service or make its provision impossible.

‍‍

How long do we retain your personal data?How long do we retain your personal data?

Your data will be retained for the minimum period necessary for the proper provision of the offered service, as well as to fulfill the resulting responsibilities and any other legal requirement.Your data will be retained for the minimum period necessary for the proper provision of the offered service, as well as to fulfill the resulting responsibilities and any other legal requirement.

‍‍

To which recipients will your data be disclosed?To which recipients will your data be disclosed?

CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. may disclose your data to entities that provide legal services for the proper provision of services. Similarly, to the extent strictly necessary for the management of administrative tasks, the company may disclose your data to affiliated companies, namely Es Castell Invest Mallorca S.L., Clínica Boutique Es Castell, S.L.U., and Group Castell Medicina y Hospitalaria, S.L.CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. may disclose your data to entities that provide legal services for the proper provision of services. Similarly, to the extent strictly necessary for the management of administrative tasks, the company may disclose your data to affiliated companies, namely Es Castell Invest Mallorca S.L., Clínica Boutique Es Castell, S.L.U., and Group Castell Medicina y Hospitalaria, S.L.

Finally, subject to your prior consent, your data may be disclosed to cooperating entities for the provision of medical services and/or the performance of medical examinations.Finally, subject to your prior consent, your data may be disclosed to cooperating entities for the provision of medical services and/or the performance of medical examinations.

Furthermore, we would like to inform you that certain data may be disclosed, due to applicable regulations or the existing contractual relationship with CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L., to banks and financial institutions for the collection of agreed services and/or purchased products, as well as to public administrations with jurisdiction in the company's areas of activity, provided that applicable regulations stipulate this.Furthermore, we would like to inform you that certain data may be disclosed, due to applicable regulations or the existing contractual relationship with CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L., to banks and financial institutions for the collection of agreed services and/or purchased products, as well as to public administrations with jurisdiction in the company's areas of activity, provided that applicable regulations stipulate this.

‍‍

Are international data transfers taking place?Are international data transfers taking place?

CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. may carry out international data transfers insofar as it uses the services of Google LLC. and Meta Platforms Technologies, LLC, both of which have joined the Data Privacy Framework.CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. may carry out international data transfers insofar as it uses the services of Google LLC. and Meta Platforms Technologies, LLC, both of which have joined the Data Privacy Framework.

‍‍

What rights do you have when you provide us with your data?What rights do you have when you provide us with your data?

The data protection rights that data subjects may exercise are:The data protection rights that data subjects may exercise are:

Right of access:Right of access: to find out what personal data the controller processes. More information herehere.
Right to rectification:Right to rectification: to have the personal data processed by the controller rectified if it is inaccurate, incorrect, or incomplete. More information herehere.
Right to object:Right to object: to request that the controller does not process your personal data for certain purposes. More information herehere.
Right to erasure:Right to erasure: to request that the controller erases your personal data. More information herehere.
Right to restriction:Right to restriction: to request that the controller restricts the processing of your personal data. More information herehere.
Right to data portability:Right to data portability: provided that the processing is carried out by automated means, receive your personal data in a structured, commonly used, machine-readable and interoperable format and transmit them to another controller. More information herehere.
Right not to be subject to a decision based solely on automated processing:Right not to be subject to a decision based solely on automated processing: ensure that you are not subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you. More information herehere.
Right to lodge a complaint with the competent supervisory authority:Right to lodge a complaint with the competent supervisory authority: lodge a complaint against the controller with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) if the user believes that the processing of their personal data violates the applicable regulations.

Data subjects whose personal data has been collected can exercise their rights in writing at the registered office of CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. at Calle Camilo José Cela, núm. 20, Palma (07014), Illes Balears, or via the dedicated email address LOPD@CLINICAESCASTELL.ESLOPD@CLINICAESCASTELL.ES.Data subjects whose personal data has been collected can exercise their rights in writing at the registered office of CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. at Calle Camilo José Cela, núm. 20, Palma (07014), Illes Balears, or via the dedicated email address .

To exercise your rights, you can use the following templates:To exercise your rights, you can use the following templates:

More information on exercising your rights can be found on the official website of the Spanish Data Protection Agency (AEPD) at the following .More information on exercising your rights can be found on the official website of the Spanish Data Protection Agency (AEPD) at the following .

‍‍

Can I withdraw my consent?Can I withdraw my consent?

You have the option and the right to withdraw consent given for a specific purpose at any time, without affecting the lawfulness of processing based on that consent before its withdrawal.You have the option and the right to withdraw consent given for a specific purpose at any time, without affecting the lawfulness of processing based on that consent before its withdrawal.

‍‍

Where can I complain if I believe my data is not being processed correctly?Where can I complain if I believe my data is not being processed correctly?

If a data subject believes that their data is not being processed correctly by CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. or that requests to exercise rights have not been handled satisfactorily, they may lodge a complaint with the competent data protection authority; within the national territory, this is the Spanish Data Protection Agency (AEPD). More information can be found on their website: www.aepd.eswww.aepd.es.If a data subject believes that their data is not being processed correctly by CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. or that requests to exercise rights have not been handled satisfactorily, they may lodge a complaint with the competent data protection authority; within the national territory, this is the Spanish Data Protection Agency (AEPD). More information can be found on their website: .

‍‍

Security and Updating of Your Personal DataSecurity and Updating of Your Personal Data

To protect the security of your personal data, we inform you that all necessary technical and organizational measures have been taken to ensure the security of the personal data provided. This is to prevent its alteration, loss, and/or unauthorized processing or access, as required by regulations — even if absolute security does not exist.To protect the security of your personal data, we inform you that all necessary technical and organizational measures have been taken to ensure the security of the personal data provided. This is to prevent its alteration, loss, and/or unauthorized processing or access, as required by regulations — even if absolute security does not exist.

To ensure your personal data remains up-to-date, it is important that you inform us of any changes to this data.To ensure your personal data remains up-to-date, it is important that you inform us of any changes to this data.

‍‍

ConfidentialityConfidentiality

CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. informs you that your data will be handled with the utmost care and confidentiality by all individuals involved in any stage of processing. We will not disclose or transfer your data to any third party, except in cases provided by law or if the data subject has expressly authorized us to do so.CLINICA ES CASTELL SERVICIOS Y OPERACIONES, S.L. informs you that your data will be handled with the utmost care and confidentiality by all individuals involved in any stage of processing. We will not disclose or transfer your data to any third party, except in cases provided by law or if the data subject has expressly authorized us to do so.

All important legal information on data protection at a glance.
‍(Stand: Juni 2026)(As of: June 2026)

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and the respective applicable data protection regulations.

The data controller is:

CLÍNICA ES CASTELL SERVICIOS Y OPERACIONES, S.L.
Carrer Camilo José Cela, 20
07014 Palma de Mallorca
Spain

E-Mail: hola@clinicaescastell.es

Personal data is processed exclusively for lawful purposes, particularly for handling inquiries, managing appointments, implementing pre-contractual measures, fulfilling legal obligations, and administering existing treatment and contractual relationships.

Health data is processed exclusively in compliance with the legal requirements of the GDPR, Spanish data protection law, medical confidentiality, and relevant health regulations.

Data subjects have the right to access, rectification, erasure, restriction of processing, objection, data portability, and to withdraw consent.

Furthermore, you have the right to lodge a complaint with the Spanish data protection authority:

Agencia Española de Protección de Datos (AEPD)
www.aepd.es

Further information on the processing of personal data can be found in this website's separate privacy policy.