Privacy Policy

Data Controller: The Skin Lounge 012, S.L.
Tax Identification Number (CIF): B86670643
Registered address: C/ Bruc 49, Principal, 08009 Barcelona, Spain
Contact email: privacy@tsl012.com
Website: www.ondo-beauty.com

The Skin Lounge 012, S.L. is responsible for processing personal data collected through this website, in accordance with applicable data protection legislation, including Regulation (EU) 2016/679 (General Data Protection Regulation, or GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).

​

​For any questions regarding the processing of your personal data, you may contact us at privacy@tsl012.com.

Depending on how you interact with this website, we may process the following categories of personal data:

• Contact details: such as your name, email address and any other information you voluntarily provide when contacting us.

• Professional information: where relevant, information relating to your company, professional role or business enquiry.

• Communications: the content of messages, enquiries and any information you provide when communicating with us.

• Website usage and technical data: information relating to your visit to the website, device, browser and online interactions, where collected through technical tools or cookies.

​

We process personal data for the following purposes, where applicable:

​

• To receive, manage and respond to enquiries submitted through the website.

• To communicate with individuals and businesses interested in our brands, products or professional activities.

• To manage requests for commercial or professional information.

• To send commercial communications where we have a valid legal basis to do so.

• To maintain the security and proper functioning of the website.

• To analyse website performance and improve our content and user experience, where the relevant technologies are used and any required consent has been obtained.

• To comply with applicable legal obligations and establish, exercise or defend legal claims.

We will only process personal data for purposes that are relevant to the interaction in question.
 

The legal basis depends on the purpose of the processing:

• Enquiries and requests: our legitimate interest in managing and responding to communications, or taking steps at your request before entering into a contract, where applicable.

• Professional or contractual relationships: the performance of a contract or the implementation of pre-contractual measures at your request, where applicable.

• Commercial communications: your consent or another legal basis expressly permitted under applicable legislation.

• Website analytics and non-essential cookies: your consent, where required by applicable law.

• Security and legal compliance: compliance with legal obligations and, where appropriate, our legitimate interests in protecting the website and our business.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.

Retention periods depend on the type of data and the relevant purpose. For example, enquiry records may be retained for the time needed to manage the enquiry and any subsequent relationship. Data may be retained for longer where required by law or where necessary to establish, exercise or defend legal claims.

Where processing is based on consent, we will stop the relevant processing when consent is withdrawn, subject to any applicable legal obligations or other lawful grounds for retention.

Specific retention periods or criteria will be determined according to the processing activities carried out through this website.

Access to personal data is restricted to authorised persons and service providers who need it for the purposes described in this policy.
Depending on the services used on this website, recipients may include:

​

• Website hosting and technical service providers, including Wix.

• Providers of website maintenance and development services.

• Providers of communication and email services.

• Providers of analytics, consent-management or other digital services, where applicable.

• Professional advisers and public authorities where disclosure is required by law.

​

Service providers process personal data in accordance with the applicable contractual arrangements and data protection requirements.
We do not sell your personal data.

Some service providers may process personal data outside the European Economic Area (EEA).

Where an international transfer takes place, we will ensure that it is carried out in accordance with applicable data protection legislation, using an appropriate transfer mechanism where required. This may include an applicable adequacy decision, approved standard contractual clauses or another lawful safeguard.

Information about relevant transfers and safeguards can be requested using the contact details provided in this policy.

Subject to the conditions established by applicable law, you may exercise the following rights:

​

• Right of access: to obtain confirmation as to whether your personal data are being processed and access those data.

• Right to rectification: to request correction of inaccurate or incomplete data.

• Right to erasure: to request deletion of your personal data where the legal requirements are met.

• Right to restriction: to request restriction of processing in certain circumstances.

• Right to object: to object to certain processing activities, where applicable.

• Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format and transmit them to another controller, where the legal requirements are met.

• Right to withdraw consent: where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

​

To exercise your rights, contact privacy@tsl012.com. We may request additional information to verify your identity where reasonably necessary and proportionate.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es, particularly if you consider that the processing of your personal data does not comply with applicable law.

This website may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those external websites. When you leave our website, we recommend reviewing the privacy policies applicable to the services you access.

We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss or disclosure, taking into account the nature of the data and the risks associated with processing.

We may update this Privacy Policy to reflect changes in our processing activities, the website or applicable legislation. The latest version will be published on this page, together with its applicable update date.

Last updated: 21.10.26