Privacy and Cookie Policy

Jodie's Groom Room respects your privacy and is committed to handling personal data fairly, transparently and securely.

This policy explains how we use personal data when you visit jodiesgroomroom.com, contact us, make an appointment, enquire about or book a training course or accommodation, make a payment, participate in our student community, or otherwise use our services.

1. Who is responsible for your personal data?

The data controller is:

Jodie Prosser, trading as Jodie's Groom Room, a sole trader (autónoma) registered in Spain under NIE Y0198772C
Jodies Groom Room, Calle Francisco de Quevedo, Parc. C-1, Local 25, San Fulgencio, Alicante 03177, ES

Email: [email protected]
Telephone and WhatsApp: 0034 689 284 206

References in this policy to "Jodie's Groom Room", "we", "us" and "our" mean the data controller identified above.

2. Personal data we collect

Depending on how you interact with us, we may collect:

• Your first and last name.
• Your email address and telephone number.
• The contents of your enquiry and any correspondence with us.
• The grooming service, course, workshop or accommodation in which you are interested.
• Appointment, booking and attendance information.
• Information needed to provide a grooming service, such as your dog's name, breed, grooming history, temperament and relevant care instructions.
• Billing, invoice, deposit and payment-confirmation information. Payment-card details are collected directly by the payment provider shown on the payment page; we do not normally receive or store your complete card number.
• Information you provide when communicating by email, telephone, WhatsApp, Facebook or Instagram.
• Photographs, videos, testimonials or reviews where you have agreed that we may use them.
• Your name, telephone number, profile information and messages if you choose to join a student or former-student WhatsApp group.
• Technical and security information generated when you use the website, such as IP address, date and time of access, browser and device information, requested pages, referring page and server-security logs.
• Cookie choices and, where you consent to analytics, information about website visits and interactions.

Please do not include sensitive personal information in a website enquiry unless it is genuinely necessary. If accessibility, health or dietary information is needed in connection with a course or accommodation, we will use it only to make the requested arrangements and will ask for explicit consent where required by law.

3. How we use personal data and our legal bases

Enquiries

We use contact and course-enquiry information to answer questions and, where requested, take steps towards an appointment, course, workshop or accommodation booking.

Our legal basis is taking steps at your request before entering into a contract. For general correspondence that is not connected with a prospective contract, our legal basis is our legitimate interest in answering enquiries and operating the business.

Grooming appointments and services

We use customer, contact, appointment and dog-care information to arrange appointments, provide grooming services, manage changes or cancellations, take payment and communicate service-related information.

Our legal basis is performance of a contract or taking steps at your request before entering into one.

Courses, workshops and accommodation

We use contact, booking, attendance, payment and relevant support information to assess enquiries, arrange training or accommodation, provide the booked service, issue certificates or diplomas and maintain appropriate training records.

Our legal basis is performance of a contract or taking steps at your request before entering into one.

We may retain a limited record containing a student's name, completed course, completion date and certificate or diploma details so that we can verify an award in the future. Our legal basis is our legitimate interest in maintaining the integrity and verifiability of awards issued by Jodie's Groom Room.

Payments, accounting and legal compliance

We use transaction and invoice information to process payments, maintain accounts, meet tax and commercial-record obligations, and establish or defend legal claims.

Our legal bases are performance of a contract, compliance with legal obligations and, where applicable, our legitimate interest in protecting our legal rights.

Service communications

We may contact you about an enquiry, appointment, booking, payment, change to a service, course arrangements or another operational matter. These are service communications, not direct marketing.

Our legal basis is performance of a contract or taking steps at your request before entering into one.

Marketing

We will send promotional emails or WhatsApp messages only where you have separately opted in or where another lawful basis clearly permits it. Marketing consent is optional and is not a condition of receiving our services.

You can withdraw marketing consent at any time by contacting us or using an unsubscribe facility included in the message. Withdrawal does not affect processing that occurred before consent was withdrawn.

Photographs, videos and testimonials

Where an identifiable customer, student or member of staff appears in a photograph or video, or where a testimonial identifies an individual, we will obtain appropriate permission before publication.

Our legal basis is consent. Consent may be withdrawn for future use, although withdrawal cannot necessarily undo printed material or third-party sharing that took place lawfully before withdrawal.

Student WhatsApp groups

Former students may be invited to join an optional WhatsApp support group. Joining the group is voluntary. Other members will normally be able to see your telephone number, WhatsApp name, profile photograph and messages.

Our legal basis is your consent. You may leave the group at any time. WhatsApp is provided by Meta and its own privacy terms also apply.

Website security

We process limited technical data to operate, protect and troubleshoot the website, prevent spam and abuse, and investigate security incidents.

Our legal basis is our legitimate interest in maintaining a secure and reliable website.

Website analytics

With your consent, we use Google Analytics 4 to understand how visitors use the website—for example, which pages are visited and how visitors found the site.

Analytics is not required to use the website. The Google Analytics script itself is not requested by your browser until you select "Accept All" through the cookie banner or Cookie Settings.

Our legal basis is consent. You can withdraw consent at any time using the Cookie Settings link in the website footer. Withdrawal does not affect processing that occurred before consent was withdrawn.

4. Information you must provide

Fields marked as required on a form are needed so that we can understand and respond to the enquiry. If you do not provide them, we may be unable to respond or provide the requested service.

Telephone numbers and unmarked message fields are optional unless we explain that they are necessary for a particular booking or service.

5. Who receives personal data?

We do not sell or rent personal data.

Where necessary, data may be processed by:

• Cloudflare, which provides website hosting, delivery, security and the server function that receives website forms.
• Resend/Plus Five Five, Inc., which transmits website-form messages by email.
• Google, which provides the email service used to receive enquiries and, where you consent, Google Analytics.
• The payment provider identified on a payment page or payment link.
• Professional advisers, such as accountants, legal advisers and insurers, where necessary.
• IT, website or administrative service providers acting under our instructions.
• Public authorities, courts, regulators or law-enforcement bodies where disclosure is required by law.
• Meta companies when you choose to contact us through WhatsApp, Facebook or Instagram. Those services also process information under their own privacy policies.
• Other WhatsApp-group members if you voluntarily join a student or former-student group.

Service providers may act as our data processors or, in some situations, as independent controllers. Processors are permitted to use personal data only to provide the contracted service and must protect it appropriately.

6. International transfers

Some technology providers, including Cloudflare, Resend, Google and Meta, operate internationally and may process data outside the European Economic Area.

Where a transfer is subject to GDPR, it must be protected by an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework where the recipient is certified, or by approved safeguards such as the European Commission's Standard Contractual Clauses and supplementary security measures where appropriate.

Further information about relevant safeguards is available in the providers' notices:

• Cloudflare Privacy Policy
• Cloudflare Data Processing Addendum
• Resend Data Processing Addendum
• Google Privacy Policy
• Meta Privacy Policy

You may contact us if you would like further information about the safeguards applying to a particular transfer.

7. How long we keep personal data

We keep data only for as long as reasonably necessary for the purpose for which it was collected, subject to legal recordkeeping requirements:

• Enquiries that do not lead to a booking are normally deleted within 12 months of the last meaningful communication.
• Appointment, customer, course, accommodation and payment-administration records are kept while the service or customer relationship remains active and then, where relevant, for up to six years to meet Spanish commercial-record requirements and deal with possible claims.
• Invoices, accounting records and supporting transaction documents are retained for the periods required by Spanish tax and commercial law, normally up to six years, and longer if a legal hold or unresolved proceeding applies.
• Limited certificate or diploma-verification records may be retained for as long as Jodie's Groom Room continues to offer verification of the award.
• Marketing details are kept until consent is withdrawn or the marketing activity ends. A minimal suppression record may then be retained to ensure that an opt-out is respected.
• Published photographs, videos and testimonials are reviewed periodically and removed when they are no longer needed or when valid consent is withdrawn, subject to the limitations explained above.
• Website security logs are retained for a limited period appropriate to security and troubleshooting, unless they are needed to investigate an incident.
• Google Analytics user-level and event data are retained for no more than 14 months. Aggregated statistics that no longer identify a visitor may be retained for longer.
• Cookie preferences are renewed after 12 months, or sooner if the website's use of cookies changes materially.

When data is no longer needed, it will be deleted, anonymised or securely blocked where Spanish law requires it to be preserved against possible legal or regulatory claims.

8. Cookies and browser storage

The website uses strictly necessary browser storage to remember your privacy choice. With consent, it also uses Google Analytics cookies.

Analytics cookies are not placed unless you consent. You can accept, reject or later change your choice using the cookie banner or Cookie Settings link.

You can also delete cookies and local-storage information through your browser. Blocking necessary storage may cause the website to ask for your cookie choice again.

9. External websites and social-media services

The website links to WhatsApp, Facebook, Instagram, Google Maps and other external services. If you follow one of these links, that provider may collect information under its own privacy and cookie policies. We do not control the privacy practices of external websites.

10. Your rights

Subject to the conditions in data-protection law, you may:

• Ask whether we process your personal data and obtain a copy.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete personal data.
• Ask us to restrict how data is used.
• Object to processing based on legitimate interests.
• Receive certain data in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.
• Withdraw consent at any time where processing is based on consent.
• Object to direct marketing at any time.
• Make a complaint to a data-protection authority.

To exercise a right, email [email protected] or write to the postal address in section 1. Please describe your request clearly. We may request information reasonably necessary to verify your identity.

You also have the right to complain to the Agencia Española de Protección de Datos (AEPD) through www.aepd.es.

11. Automated decisions

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects.

12. Children

The website is not intended for children under 14 to submit personal data independently. A parent or legal guardian should contact us on behalf of a child.

Anyone under 18 wishing to book a course, workshop or accommodation may be asked to provide appropriate parent or guardian authorisation.

13. Security

We use reasonable technical and organisational measures intended to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. No internet or email system can be guaranteed to be completely secure, so please avoid sending unnecessary sensitive information through an ordinary enquiry form.

14. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The current version will be published on this page with its latest revision date. If a change materially affects processing based on consent, we will request consent again where required.

See also our Legal Notice for the site's legal-ownership and registration details required under Spanish law (LSSI).