{"id":3,"date":"2023-05-25T17:56:40","date_gmt":"2023-05-25T17:56:40","guid":{"rendered":"https:\/\/hestia.es\/?page_id=3"},"modified":"2026-11-08T19:33:04","modified_gmt":"2026-11-08T19:33:04","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/hestia.es\/en\/privacy-policy\/","title":{"rendered":"Privacy policy"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><em>Last updated: 8 November 2026<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At <strong>HESTIA \u2013 Home of European Systemic Therapy &amp; Interpersonal Arts<\/strong> (\u201cHESTIA\u201d) we know that trust is the foundation of any therapeutic process. That is why we treat your personal data with the utmost care and confidentiality, in accordance with Regulation (EU) 2016\/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3\/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This policy explains what data we collect, what we use it for, how long we keep it and how you can exercise your rights.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Data controller<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Controller:<\/strong> HESTIA \u2013 Home of European Systemic Therapy &amp; Interpersonal Arts<\/li>\n\n<li><strong>Address:<\/strong> Pg. de St. Joan, 97, 2\u00ba 4\u00aa, 08009 Barcelona (Spain)<\/li>\n\n<li><strong>Phone:<\/strong> <a href=\"tel:+34934592802\">+34 93 459 28 02<\/a><\/li>\n\n<li><strong>Email:<\/strong> <a href=\"mailto:info@hestia.es\">info@hestia.es<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">2. What data we process<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on your relationship with us, we may process the following categories of data:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Identification and contact data:<\/strong> name and surname, email address, phone number and any other data you give us when you write to us, call us or fill in a form.<\/li>\n\n<li><strong>Health data:<\/strong> the information you share during therapy (reason for consultation, background, progress, clinical notes), which forms part of your clinical record. These are special category data and receive enhanced protection.<\/li>\n\n<li><strong>Third-party data:<\/strong> in couples, family or child therapy, we may process data about other members of the couple or family. If you give us someone else\u2019s data, please inform them first.<\/li>\n\n<li><strong>Data about minors:<\/strong> in child therapy, the child\u2019s data is provided by their parents or legal guardians, in accordance with applicable health regulations.<\/li>\n\n<li><strong>Financial and billing data:<\/strong> what is needed to issue invoices and manage payments.<\/li>\n\n<li><strong>Academic and professional data:<\/strong> if you enrol in our Master\u2019s in Systemic Relational Therapy or in Interpersonal Arts Institute (IAI) programmes.<\/li>\n\n<li><strong>Browsing data:<\/strong> IP address, device and browser type, and information obtained through cookies, as described in our <a href=\"https:\/\/hestia.es\/en\/politica-de-cookies\/\">Cookie policy<\/a>.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why we use your data and on what legal basis<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">a) Answering your enquiries and appointment requests<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We reply to the messages you send through the contact form, email, phone or instant messaging. <strong>Legal basis:<\/strong> your consent and steps taken at your request before entering into a contract (Art. 6(1)(a) and 6(1)(b) GDPR).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">b) Providing psychotherapy services<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We organise sessions (in person or online), keep your clinical record and follow up on your therapy. <strong>Legal basis:<\/strong> performance of the service you contract (Art. 6(1)(b) GDPR) and, for health data, the provision of health care by professionals bound by professional secrecy (Art. 9(2)(h) and 9(3) GDPR). Keeping the clinical record is also a legal obligation (Art. 6(1)(c) GDPR).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">c) Billing and legal obligations<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We issue invoices and meet our accounting and tax obligations. <strong>Legal basis:<\/strong> compliance with legal obligations (Art. 6(1)(c) GDPR).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">d) Managing our training programmes<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We handle enrolment, teaching, supervised placements and accreditation for the Master\u2019s and IAI programmes. <strong>Legal basis:<\/strong> performance of the training contract (Art. 6(1)(b) GDPR).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">e) Recording Interpersonal Arts Training sessions<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Sessions in this programme are recorded solely for learning and review purposes. <strong>Legal basis:<\/strong> your explicit consent, which we collect in writing before starting and which you can withdraw at any time (Art. 6(1)(a) and 9(2)(a) GDPR).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">f) Sending our newsletter<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you subscribe, we will send you information about our activities, training and news. <strong>Legal basis:<\/strong> your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in each email or by writing to us.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">g) Improving and protecting the website<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We use analytics tools to understand, in aggregate, how the website is used, and an anti-spam system (Google reCAPTCHA) to protect our forms. <strong>Legal basis:<\/strong> your consent for analytics cookies (Art. 6(1)(a) GDPR) and our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We do not make automated decisions or create profiles that have legal effects on you.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. How long we keep your data<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Clinical records:<\/strong> at least 15 years from the end of each care process, as required by Catalan Law 21\/2000 of 29 December on patients\u2019 rights to health information and autonomy and on clinical documentation.<\/li>\n\n<li><strong>Billing data:<\/strong> for the periods required by tax and commercial law (generally between 4 and 6 years).<\/li>\n\n<li><strong>Training data:<\/strong> for the duration of the training and afterwards for as long as needed to issue certificates and deal with any liabilities.<\/li>\n\n<li><strong>Enquiries that do not lead to a further relationship:<\/strong> a maximum of 12 months.<\/li>\n\n<li><strong>Newsletter:<\/strong> until you unsubscribe.<\/li>\n\n<li><strong>Session recordings:<\/strong> for the period stated in the consent you sign, after which they are deleted.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Once these periods have passed, the data is blocked for as long as legal liabilities may arise and then securely deleted.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">5. Who we share your data with<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We do not sell or give your data to third parties. We only disclose it when the law requires us to (for example, to the tax authorities, courts or health authorities).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To operate, we rely on providers who may access some data on our behalf, always under a data processing agreement (Art. 28 GDPR) and with appropriate safeguards: web hosting and email, accounting and tax advisers, video-call platforms for online sessions, newsletter tools and Google services (Analytics, Maps, reCAPTCHA and Google Fonts), as well as our cookie consent tool (CookieYes).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. International transfers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Some of these providers, such as Google, may process data outside the European Economic Area. In those cases, transfers are made with appropriate safeguards, such as the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission. Health data from clinical records is not transferred outside the European Economic Area.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">7. Confidentiality and security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Our whole team is bound by professional secrecy and by the profession\u2019s Code of Ethics. We apply appropriate technical and organisational measures to protect your data against loss, unauthorised access or misuse, taking particular care with health data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">8. Your rights<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can exercise the following rights at any time:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Access:<\/strong> find out what data about you we process.<\/li>\n\n<li><strong>Rectification:<\/strong> correct inaccurate or incomplete data.<\/li>\n\n<li><strong>Erasure:<\/strong> ask us to delete your data when it is no longer needed, unless we are legally required to keep it (such as clinical records).<\/li>\n\n<li><strong>Objection<\/strong> and <strong>restriction<\/strong> of processing.<\/li>\n\n<li><strong>Portability:<\/strong> receive your data in a structured, commonly used format.<\/li>\n\n<li><strong>Withdraw your consent<\/strong> at any time, without affecting the lawfulness of processing carried out before.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To exercise them, write to <a href=\"mailto:info@hestia.es\">info@hestia.es<\/a> or by post to Pg. de St. Joan, 97, 2\u00ba 4\u00aa, 08009 Barcelona, stating which right you wish to exercise. If needed to verify your identity, we will ask you for an identity document. We will reply within one month at most.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you believe we have not handled your data correctly, you can file a complaint with the Spanish Data Protection Agency (<a href=\"https:\/\/www.aepd.es\" target=\"_blank\" rel=\"noopener\">www.aepd.es<\/a>).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Accuracy of data<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Please make sure the data you give us is true and up to date, and let us know of any changes. By sending us a form you confirm that you are at least 14 years old or are acting with the authorisation of your parent or legal guardian.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Changes to this policy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We may update this policy to reflect legal changes or changes in our services. We will always publish the current version on this page, with the date of its last update.<\/p>","protected":false},"excerpt":{"rendered":"<p>\u00daltima actualizaci\u00f3n: 8 de noviembre de 2026 En HESTIA \u2013 Home of European Systemic Therapy &amp; Interpersonal Arts (en adelante, \u00abHESTIA\u00bb) sabemos que la confianza es la base de cualquier proceso terap\u00e9utico. Por eso tratamos tus datos personales con el m\u00e1ximo cuidado y confidencialidad, de acuerdo con el Reglamento (UE) 2016\/679 General de Protecci\u00f3n de [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-3","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/hestia.es\/en\/wp-json\/wp\/v2\/pages\/3","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hestia.es\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/hestia.es\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/hestia.es\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hestia.es\/en\/wp-json\/wp\/v2\/comments?post=3"}],"version-history":[{"count":2,"href":"https:\/\/hestia.es\/en\/wp-json\/wp\/v2\/pages\/3\/revisions"}],"predecessor-version":[{"id":1574,"href":"https:\/\/hestia.es\/en\/wp-json\/wp\/v2\/pages\/3\/revisions\/1574"}],"wp:attachment":[{"href":"https:\/\/hestia.es\/en\/wp-json\/wp\/v2\/media?parent=3"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}