1. Who is responsible for your data?
Barcelona Wash SL, Spain, with registered address at Calle Marina 331, Barcelona, España, is the data controller for Barcelona Wash (barcelonawash.com) and Madrid Wash (madridwash.com). This policy covers visitors, customers and people contacting these services.
For privacy questions or rights requests, email orders@barcelonawash.com or write to the registered address above. The applicable framework is the EU General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 (LOPDGDD).
2. Information we collect
You provide your name, email, telephone/WhatsApp number, pickup and delivery address, hotel or accommodation details, collection time, order instructions and correspondence. Orders may include clothing manifests, bedding quantities, prices, discounts, payment references, order status and refund details. Please do not include sensitive information or unnecessary information about other people.
Technical processing may include IP address, browser/device information, request and security logs, cookies, local-storage identifiers, pages visited, referral sources, campaign parameters and advertising or analytics identifiers. Payment providers, address services and delivery personnel also provide payment, address and fulfilment information associated with your booking.
3. Purposes and legal bases
Booking, payment, collection, laundry, delivery, refunds and related customer support: steps you request before a contract and performance of the contract (Article 6(1)(b)). Required booking/contact/address information is necessary to arrange the service; without it we may be unable to accept or fulfil your booking.
Tax, accounting and legally required disclosures: compliance with legal obligations (Article 6(1)(c)). Security, fraud prevention, troubleshooting and establishing or defending legal claims: legitimate interests in protecting customers and our business (Article 6(1)(f)), subject to your rights and interests.
Non-essential analytics, advertising tracking and optional promotional communications require consent where applicable (Article 6(1)(a)). Service messages about an existing booking are operational, not a subscription to marketing. Consent must be freely given and may be withdrawn without affecting earlier lawful processing.
4. Who receives information?
Authorised staff, laundry partners and couriers receive the information needed to fulfil your order, such as contact and address details, instructions and item lists. Relevant accommodation staff may be involved when you arrange collection or delivery through reception. Authorities and professional advisers may receive information where legally required or necessary for legal claims.
Stripe processes checkout, payment and refund information; we do not store full card details. Resend handles transactional email. Green API and WhatsApp/Meta handle WhatsApp communications and number validation. Google Maps handles address searches and location information. Google Tag Manager, Google Analytics and Google Ads support measurement and advertising, and Meta Pixel/Conversions API support advertising measurement, including browser and server-side events.
Hosting, database and infrastructure suppliers store and operate the website and booking records. Some providers act as processors under our instructions; others, including payment and advertising providers for certain activities, determine their own purposes and apply their own privacy notices. You can request further information about recipients using the contact below.
5. Cookies, local storage and advertising
The site uses session/security technologies and Google and Meta measurement technologies. Browser storage can hold language preferences, analytics/session identifiers and campaign attribution. Advertising tools may associate visits or purchases with an advertising profile.
Important current limitation: the site’s tracking implementation is not yet verified to block all non-essential browser and server-side tracking before consent or to provide effective withdrawal controls. This policy is not consent and continuing to browse does not constitute consent. A policy alone does not resolve this implementation issue.
You can manage cookies and site storage in your browser, although blocking them may affect functionality and does not undo data already transmitted or necessarily stop server-side processing. Contact us to object to processing or withdraw any consent you have given. Vendor settings and cookie lifetimes vary; a verified, detailed cookie inventory remains to be completed.
6. International transfers
Some service providers may process data outside the European Economic Area. Where this occurs, GDPR requires an appropriate legal transfer mechanism, such as an applicable adequacy decision or standard contractual clauses with any necessary supplementary measures.
Provider processing locations and the transfer arrangements applicable to this service still require confirmation. We do not represent that every provider or transfer has been assessed or approved. Contact us to request details of destinations and any applicable safeguards or a copy of them.
7. How long we keep data
Our existing service Terms state a retention period of five years after your last transaction, or as required by applicable tax and accounting law. Records needed for legal obligations or disputes may need to be retained longer; data should otherwise be deleted or anonymised when no longer necessary.
Retention depends on the purpose, statutory obligations, unresolved claims and backup/provider schedules. A verified category-by-category retention schedule and automated deletion of customer records are not yet confirmed. This notice does not mean records are automatically deleted after five years. You can ask about retention of your specific information or request erasure, subject to lawful exceptions.
8. Your rights and how to exercise them
Subject to GDPR conditions, you can request access and a copy, correction, erasure, restriction, and portability of data processed automatically on the basis of consent or a contract. You can object to processing based on legitimate interests, and you have an unconditional right to object to direct marketing. You can withdraw consent at any time without affecting processing that was lawful before withdrawal.
Email orders@barcelonawash.com, describe your request and include enough information to identify the relevant booking. Do not send identity documents unless requested through an appropriate channel. If reasonably necessary, we may request proportionate information to verify your identity.
GDPR normally requires a response within one month of receipt. Where permitted, this may be extended by up to two further months for complex or numerous requests, with notice and reasons within the first month. Requests are normally free; statutory exceptions may apply to manifestly unfounded or excessive requests.
You may complain to the AEPD at www.aepd.es, or to a supervisory authority in the EU country where you live, work or consider an infringement occurred. You do not have to contact us first.
9. Security
Access to booking and operational information should be limited to authorised people and service providers who need it. No internet transmission or storage system is completely secure. Avoid sending payment-card details or sensitive data in booking notes, email or WhatsApp. Contact us promptly if you suspect misuse of your booking or personal information.
10. Children and automated decisions
This service is not directed at children and does not intentionally request children’s personal information. If you believe a child has supplied personal data, contact us so it can be reviewed and handled appropriately.
The booking service is not designed to make solely automated decisions producing legal or similarly significant effects on you. Advertising providers may carry out profiling as described above; their own notices explain their processing.
11. Changes and third-party services
We may update this policy when services, providers or legal requirements change. The latest version and date appear here; material changes will be communicated as required by law. Third-party websites and services have their own privacy policies. A change to this notice does not replace any new consent that may be required.