Privacy Policy
Last updated: August 2026
In the sacred space of Natalia Urban, privacy and confidentiality are not merely regulatory requirements—they are the foundational pillars of our connection. Just as your emotional world is honored in each session, your personal data is protected with the utmost respect, transparency, and security.
This Privacy Policy explains how we collect, process, and protect your personal information in compliance with the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD 3/2018) and the European General Data Protection Regulation (GDPR).
1. Data Controller
The controller responsible for processing the personal data collected through this website is:
- Owner: Natalia Urban Chanes
- ID / Identity Document (Personalausweis-Nr.): L3G1FVHZ3
- Address: Calle Héroe de Sostoa 131, Málaga, Spain
- Contact Email: [email protected]
2. Data We Collect, Purposes and Legal Basis
| Data collected | When | Purpose | Legal basis |
|---|---|---|---|
| Name, email, message | Contact form | Answer inquiries and schedule the free 20-minute exploratory call | Consent (Art. 6.1.a GDPR) |
| Name, email, phone/WhatsApp number (payment itself is processed entirely off-site by PayPal; we do not collect or store raw payment details) | When you book a container | Manage the contractual relationship, receive payment confirmation, issue invoices, and provide WhatsApp support | Performance of a contract (Art. 6.1.b GDPR) and compliance with legal/tax obligations (Art. 6.1.c GDPR) |
| Content shared during sessions (which may include information about your emotional, psychological or mental health) | During coaching/hypnotherapy sessions | Deliver the coaching service, prepare personalized tools, and (only if separately and explicitly agreed in writing) create session recordings | Explicit consent for special category data (Art. 9.2.a GDPR) |
| Name, email | When subscribing to our newsletter | Send marketing emails and newsletters via MailerLite | Consent (Art. 6.1.a GDPR) |
| Browsing/analytics data (via Google Analytics) | While browsing the website | Measure website traffic and usage to improve our content and services | Consent (Art. 6.1.a GDPR), cookie storage governed by Art. 22.2 LSSI-CE |
We only collect the minimum personal data necessary to provide you with a safe, transformational coaching experience. Providing session-related data is voluntary but necessary for the service to be effective; special category data (health/emotional information) is only processed with your explicit, separate consent, obtained before or at the start of your container.
Consent for recording sessions is documented as a specific, separate opt-in distinct from general coaching consent. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
3. Data Retention
- Contact form inquiries: Kept only for as long as necessary to respond to your request, or until you ask for deletion — typically no longer than 12 months if no container is booked.
- Client and payment data: Kept for the duration of the contractual relationship and, afterwards, for the periods required by Spanish law — generally 4 years for tax purposes (Ley General Tributaria) and up to 6 years for commercial/accounting records (Código de Comercio).
- Session content and recordings: Kept only for as long as needed to deliver your container, and deleted no later than 3 months after the container ends unless the client requests otherwise. You may request deletion at any time, subject to any legal retention obligations.
4. Confidentiality and Data Sharing
Your stories, sessions, and personal data will never be sold, leased, or disclosed to third parties for marketing purposes. Data is only shared with essential service providers acting as data processors on our behalf ("encargados de tratamiento"), strictly to operate the website and deliver our services, such as:
- Website hosting and email service providers
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.), used strictly via off-site checkout link (we do not host the payment flow or store card details)
- WhatsApp (Meta Platforms, Inc.), used for client communication (optional and used primarily for logistics; clients are informed that alternative channels like email are available for sensitive content)
- Cal.com, Inc. (used for scheduling sessions)
- MailerLite Limited (based in Lithuania, EU, used for email marketing and newsletters)
- Zoom Video Communications, Inc. (used for hosting session video calls)
- Google Analytics (Google Ireland Ltd. / Google LLC), used for website traffic analytics
International transfers: Some of these providers (e.g., WhatsApp, Google Analytics, Zoom, Cal.com, and PayPal for certain processing operations) may process data outside the European Economic Area, including in the United States. Where this occurs, the transfer is safeguarded through mechanisms recognized by the GDPR, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. You may request further information about these safeguards, or a copy of the relevant safeguard documentation, by contacting us.
All processors are bound by data processing agreements (DPAs) requiring them to protect your data to the same standard as we do.
5. Security Measures
We apply appropriate technical and organizational measures — including encrypted transmission, restricted access, and confidential handling of session notes and recordings — to protect your personal data against unauthorized access, loss, or disclosure, consistent with the sensitive nature of the information shared during coaching work. In the event of a data breach affecting your rights, we will notify the supervisory authority and affected individuals as required by law.
6. Cookies
This website uses Google Analytics cookies to measure traffic and improve our content. These cookies are only activated after you give your consent through our cookie banner. For full details on the cookies used, their purpose, duration, and how to manage or withdraw your consent, please see our Cookie Policy.
7. Minors
Our services and this website are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors.
8. Your Rights
Under Spanish and European data protection laws, you hold full rights regarding your personal information, including:
- Access: The right to know whether and how your data is being processed.
- Rectification: The right to request the correction of inaccurate or incomplete information.
- Erasure (Right to be Forgotten): The right to request the deletion of your personal data, subject to legal retention obligations described in Section 3.
- Restriction & Objection: The right to limit or object to the processing of your data under certain circumstances.
- Portability: The right to receive your data in a structured, commonly used format.
- Withdraw consent: At any time, where processing is based on consent.
To exercise any of these rights, email your request to [email protected]. You also have the right to lodge a complaint with a supervisory authority, specifically the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) at www.aepd.es, or the supervisory authority in your country of residence within the European Union.
9. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Any changes will be published on this page with an updated "Last updated" date.