Privacy Policy

Last updated: September 2026

1. Data controller

The controller responsible for the personal data collected through this website is:

Dr Adriana Rodríguez García
Trading name: ARFACIAL
Spanish tax identification number (NIF): 51745456X
Professional address: Avda. Imperio Argentina 1, 29004 Málaga
Telephone number: +34 639 352 207
Email: contacto@arfacial.com
Website: arfacial.com

ARFACIAL is the trading name under which Dr Adriana Rodríguez García carries out her professional practice.

2. Personal data we may process

Through the forms and contact channels available on this website, we may process the following data, among others:

• First name and surname.
• Email address.
• Telephone number.
• Procedure or service about which information is requested.
• Content of the message sent by the user.
• Any other information voluntarily provided by the user.

Given the healthcare nature of the practice, users may voluntarily include information about their health. Health data is classified as a special category of personal data under the General Data Protection Regulation (GDPR).

For this reason, we recommend that you do not include sensitive medical information in forms unless it is necessary to request information, make contact or seek an assessment.

3. Purposes of processing

Personal data provided through this website may be processed for the following purposes:

• To handle and respond to enquiries submitted by users.
• To manage requests for information or an assessment.
• To contact users in connection with their requests.
• To undertake the steps required before providing a service requested by the user.
• To manage, where applicable, the professional or healthcare relationship arising from the request.
• To comply with applicable legal and regulatory obligations.

Data submitted through contact forms will not be used to send unsolicited marketing communications.

If marketing communications, newsletters or other promotional activities are introduced in the future, the relevant consent will be obtained in advance where required.

4. Lawful basis for processing

The lawful basis for processing personal data will depend on the specific purpose.

When users voluntarily contact us through a form, email, telephone or another available channel, processing may be based on their consent and, where applicable, on taking pre-contractual steps at their request.

Where a professional or healthcare relationship exists, processing may be carried out to the extent necessary to manage that relationship and comply with the relevant legal obligations.

Where the processing of health data is necessary, it will take place only where permitted under applicable legislation and subject to the confidentiality safeguards associated with healthcare. The GDPR establishes specific requirements for processing this category of data.

5. Data Retention

Personal data provided through the website will be retained for as long as necessary to manage and respond to the enquiry or request submitted.

Afterwards, the data may be retained in a restricted form for the periods necessary to address potential legal liabilities.

Where an enquiry leads to a healthcare relationship and certain data become part of the patient’s clinical records, their retention will be governed by the applicable healthcare and medical records legislation.

6. Recipients of personal data

Personal data will not be sold or disclosed to third parties for commercial purposes.

Certain providers may have access to data where their services are necessary for the website to function or for the provision of professional services, including providers of:

• web hosting;
• email services;
• online forms;
• technology maintenance and support;
• security services;
• analytics or other technical tools necessary for the operation of the website.

Where such providers process personal data on behalf of the controller, they must comply with the corresponding contractual and legal data protection obligations.

Data may also be disclosed to public authorities, government bodies, judicial authorities or other recipients where legally required.

7. International data transfers

Some technology providers used by this website may provide certain services from countries outside the European Economic Area.

Where the use of those services involves an international transfer of personal data, the transfer will be made subject to the safeguards provided for under applicable law, such as European Commission adequacy decisions, standard contractual clauses or other legally recognised mechanisms.

The GDPR requires information to be provided about international transfers and the applicable safeguards where such transfers take place.

8. Your rights

Users may exercise the rights granted under data protection legislation, including:

• The right of access to their personal data.
• The right to rectification of inaccurate data.
• The right to erasure.
• The right to object to processing.
• The right to request restriction of processing.
• The right to data portability, where applicable.
• The right to withdraw consent at any time where processing is based on consent.
• To exercise these rights, you may send a request to: contacto@arfacial.com

The controller may request the information necessary to verify the identity of the person exercising the right.

If you believe that the processing of your personal data does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).

9. Security and confidentiality

Dr Adriana Rodríguez García implements technical and organisational measures designed to protect personal data against loss, alteration, unauthorised access, disclosure or improper processing.

Access to personal data will be limited to those who need it for the purposes described and who are subject to the relevant confidentiality obligations.

Nevertheless, no system connected to the internet can guarantee absolute security. The measures in place will therefore be reviewed and adapted when necessary.

10. Health-related data

Health-related information is afforded particular protection under data protection legislation.

Where users voluntarily provide this type of information through a form or a communication addressed to Dr Adriana Rodríguez García, it will be processed only to the extent necessary to respond to their request and, where applicable, to provide healthcare.

We recommend that users do not send medical documents, reports, clinical photographs or other sensitive information through general forms unless it is necessary and an appropriate channel has been provided.

11. Contact forms

The forms available on this website are intended to enable users to request information, contact or an assessment.

Submitting a form involves processing the data provided in order to respond to that request.

Where processing is based on consent, that consent must be given through an affirmative action by the user.

Essential information about processing may be displayed in summary form alongside the form itself, with a link to this Privacy Policy for the full information.

12. Cookies

This website uses cookies and similar technologies.

Detailed information about the types of cookies used, their purposes, duration, providers and configuration options is available in the website’s Cookie Policy.

Cookies requiring consent will only be placed once consent has been obtained in accordance with applicable legislation.

13. Third-party links and services

This website may contain links to, or use services provided by, third parties.

Dr Adriana Rodríguez García does not control the privacy policies of external websites. Users are therefore advised to consult those policies before providing personal data to those websites.

Where an external provider processes personal data on behalf of the controller of this website, the necessary steps will be taken to regulate that relationship in accordance with applicable legislation.

14. Changes to this Privacy Policy

This Privacy Policy may be updated when necessary to reflect legislative or technical changes or changes to the personal data processing carried out through the website.

The current version will be the one published on this page, with its last updated date shown at the beginning of the document.

15. Contact

For any questions about this Privacy Policy or the processing of personal data, please contact:

Dr Adriana Rodríguez García
contacto@arfacial.com
+34 639 352 207