Privacy Policy
1. General Information
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform users of this website of the processing of their personal data.
Data Controller
Company name: Shanti Som Health Retreat, S.L.
Registered address: Llanos de Purla km 22, A-355 Marbella–Cártama, 29110 Monda, Málaga, Spain
Tax ID (CIF): B92586155
Email: reception@shantisom.com
Shanti Som Health Retreat, S.L. is the owner of this website and responsible for the processing of personal data collected through it.
2. Purpose of the Processing of Personal Data
Personal data provided by users through this website, email communications or booking forms will be processed for the following purposes:
- To manage reservations, enquiries and contractual relationships.
- To provide the services requested by the user.
- To respond to contact requests or information enquiries.
- To send commercial or promotional communications related to our services only where explicit consent has been given.
- To manage recruitment processes when CVs or job applications are submitted.
Personal data will not be processed for purposes incompatible with those described above.
3. Lawfulness of Processing
The legal basis for processing personal data is one or more of the following:
- The execution of a contract or the application of pre-contractual measures requested by the user.
- The explicit consent given by the user for one or more specific purposes.
- Compliance with legal obligations applicable to Shanti Som Health Retreat, S.L.
- Legitimate interest, where applicable, provided that such interest does not override the fundamental rights and freedoms of the data subject.
4. Data Retention Periods
Personal data will be retained:
- For the duration of the contractual relationship.
- For as long as necessary to comply with legal obligations.
- Until the user requests deletion, where applicable.
- During legally established periods for the exercise or defence of legal claims.
In the case of recruitment data, CVs and candidate information will be stored for a maximum period of 24 months, after which they will be securely deleted unless the candidate has provided renewed consent.
5. Data Transfers and Recipients
Personal data may be communicated to third parties only where necessary for the fulfilment of the purposes described above, including:
- Public authorities and judicial bodies, when legally required.
- IT service providers, including cloud-based services, acting as data processors under appropriate data processing agreements.
No international data transfers are carried out outside the European Economic Area unless adequate safeguards are in place.
6. Rights of Data Subjects
Users may exercise the following rights at any time:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to objection
- Right to data portability
- Right not to be subject to automated individual decision-making
Users may also withdraw their consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
Requests may be submitted by email to reception@shantisom.com or by post to the registered address indicated above.
Users also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es
7. Children’s Data
This website and our services are not directed at children under the age of 16.
We do not knowingly collect or process personal data from minors under 16 years of age without verifiable consent from parents or legal guardians.
8. Personal Data of Third Parties
If the user provides personal data relating to third parties, the user guarantees that they have informed such third parties of this Privacy Policy and obtained their explicit consent. The user also guarantees that the data provided are accurate and up to date and assumes responsibility for any damages arising from failure to comply with this obligation.
9. Recruitment and “Work With Us”
When candidates submit their CV or personal data for recruitment purposes, such data will be processed exclusively to manage the recruitment and selection process.
Personal data may be shared with recruitment or temporary employment agencies where necessary to facilitate selection processes. Consent is provided through a clear affirmative action by the candidate.
Candidates may exercise their data protection rights at any time using the contact details provided above.
10. Website Content and Intellectual Property
Shanti Som Health Retreat, S.L. is not responsible for infringements of intellectual or industrial property rights of third parties arising from content provided by such third parties on this website.
Users agree not to:
- Use website content for unlawful purposes.
- Reproduce, distribute or modify content without authorisation.
- Use website content for unsolicited commercial communications.
11. Applicable Law and Jurisdiction
In the event of a dispute, the parties shall attempt to resolve it amicably. Where this is not possible, Spanish law shall apply, and the competent courts shall be those determined in accordance with applicable consumer and jurisdiction regulations.
12. Acceptance of the Privacy Policy
Users who do not agree with this Privacy Policy must refrain from providing personal data through this website.
By accessing this website and providing personal data, the user acknowledges having read and accepted this Privacy Policy.
© 2026 Shanti Som Health Retreat, S.L. All rights reserved