Privacy policy
Last updated: 20 October 2026
1. Who processes your data
- Controller
- The Lab Room Urban Spa, S.L., tax ID (CIF) B82616053
- Trade name
- The Lab Room
- Address
- Claudio Coello 13, 28001 Madrid (Spain)
- Phone
- +34 914 312 198
- Email for privacy matters
- info@thelabroom.com
2. What data we process, why and on what basis
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Handling your orders: payment, shipping, invoices, returns and customer care | Name, address, phone, email, products bought, payment details (your card is handled by the payment provider, not by us) | Performance of the purchase contract | While the relationship lasts and then for the periods the law requires (tax and commercial, up to 6 years) |
| Your customer account, if you create one | Name, email, encrypted password, addresses, order history | Your consent when you create it, and the contract | Until you delete it or ask us to delete it |
| Sending you the newsletter, if you sign up | Email and, if you give it, name | Your consent (checkbox) | Until you unsubscribe, from the link in every email |
| Answering what you send us through the contact form | Name, email, phone if you give it, your message | Your consent when you send it | As long as needed to reply and, at most, 1 year |
| Publishing your product review, if you leave one | The name you enter, rating, text and, if you upload one, photo | Your consent | While the review is published |
| Spa bookings | Booking data is collected and processed by the Shortcuts booking platform on behalf of The Lab Room | Performance of the service you book | Whatever Shortcuts sets in its privacy policy |
| Protecting the website and payments against fraud and automated use | IP address, technical browser data | Legitimate interest in the security of the shop | The minimum necessary |
| Measuring use of the website and showing advertising | See the Cookie policy | Your consent in the cookie notice | See the Cookie policy |
We do not make automated decisions or build profiles that have effects on you. The data we ask for with an asterisk is needed for the order or the form; without it we cannot complete it.
3. Who else sees it
We do not sell your data. These providers, working on behalf of The Lab Room, see it only for what they do:
- Website hosting: GreenGeeks, with the server in the Netherlands (European Union).
- Website backups: Backblaze, with the data stored in the European Union.
- Payments: Redsys and our bank, Stripe (card, Apple Pay and Google Pay) and PayPal. They handle your card details; we do not see them.
- Shipping: Nacex.
- Newsletter: Mailchimp (Intuit Inc.).
- Spa bookings: Shortcuts.
- Measurement and advertising, only if you accept them: Google (Analytics) and Meta (Facebook and Instagram).
- Form protection: Google reCAPTCHA and hCaptcha.
- Accountants and advisers, and public authorities when the law requires it.
Some of these providers (Stripe, PayPal, Mailchimp, Google, Meta) may process data outside the European Economic Area, in the United States. They do so under the EU-US Data Privacy Framework or under standard contractual clauses approved by the European Commission.
4. Your rights
You can ask us to access your data, correct it, delete it, object to a processing, restrict it or take it elsewhere, and withdraw your consent whenever you want without affecting what was done before. Write to us at info@thelabroom.com saying what you are asking for. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
5. Minors
The shop is intended for people aged 14 and over. If you are under that age, do not give us your data without permission from your parents or guardians.
6. Changes
If we change this policy, we will publish the new version here with its date. Last updated: 20 October 2026.
