top of page

Privacy policy

Last updated: 17 October 2026

This policy explains how we handle your personal data when you visit www.aurora.fitness, buy a plan or pack, book a session or contact us. It follows the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

  • OUTERWORLDS ASSOCIATED, S.L. (trading as AURORA Biomodulation Center)

  • Tax ID (NIF): B16681108

  • Registered office: Ctra. T-232, km 15, 43440 L'Espluga de Francolí (Tarragona)

  • Studio: Carrer del Comerç 31, 08003 Barcelona

  • Privacy contact: bcn@aurora.fitness

2. What data we use, why, and on what legal basis

  • Name, email, phone, Members area password, plan bought, booking and payment history. Purpose: Run your account, purchases and bookings, and provide the service. Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

  • Billing details. Purpose: Issue invoices and meet tax and accounting duties. Legal basis: Legal obligation (Art. 6(1)(c) GDPR).

  • Messages by WhatsApp, email or phone. Purpose: Answer your questions, confirm or change bookings. Legal basis: Your request and performance of a contract (Art. 6(1)(b) GDPR).

  • *Health questionnaire* (before your first EMS session and, where relevant, red light): health conditions, medication, pregnancy and other possible contraindications. Purpose: Check the session is suitable for you and adapt it safely. Legal basis: Your explicit consent (Art. 9(2)(a) GDPR).

  • Technical browsing data (cookies). Purpose: Make the site work and, if you agree, measure its use. Legal basis: Legitimate interest (essential) and consent (analytics). See the Cookie policy.

  • Email or phone for news or offers. Purpose: Send you marketing messages. Legal basis: Only with your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time.

  • Photos or videos taken at the studio. Purpose: Publish them on the website or social media. Legal basis: Only with your express consent.

About the health questionnaire. This is special-category data. Only the AURORA team members who look after you ask for it and see it. We don't use it for anything else and don't share it. If you'd rather not fill it in, we can't offer you EMS sessions, because it is how we check the training is suitable for you. You can withdraw your consent at any time; this doesn't affect processing already carried out. The questionnaire is not a medical diagnosis.

We don't make automated decisions or build profiles that affect you.

3. How long we keep your data

  • Customer, purchase and booking data: while you are a customer, then for the period in which legal claims can be made.

  • Invoices and accounting records: 6 years (Spanish Commercial Code) and any period required by tax law.

  • Health questionnaire: while you are a client and for 3 years after your last session. It is then securely destroyed.

  • Messages and enquiries: as long as needed to deal with them, and at most 1 year after our last contact if you don't buy anything.

  • Marketing: until you unsubscribe.

  • Cookies: see the Cookie policy.

4. Who else sees your data

We never sell your data. Only service providers working for us can access it, under contract and following our instructions:

  • Wix.com (website hosting, Members area, bookings and checkout) and the payment provider used at checkout. We never see or store your full card details.

  • WhatsApp (Meta), if you message us there.

  • Our email and calendar provider.

  • Our accountants (gestoría), for invoices and bookkeeping.

  • Public authorities, courts and police, only where the law requires it.

Some of these providers may process data outside the European Economic Area (for example in the United States or Israel). Where they do, the transfer relies on a European Commission adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or on standard contractual clauses.

5. Your rights

You can ask us at any time to access, correct or delete your data, restrict or object to its use, receive it in a portable format, and withdraw your consent. Email bcn@aurora.fitness saying which right you want to use. If we are unsure of your identity, we may ask you to confirm it. We reply within one month.

If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).

6. Minors

Our services are for adults aged 18 and over. Minors can only use them with written consent from a parent or guardian. We don't knowingly collect data from children under 14 without that consent.

7. Security

We take reasonable technical and organisational measures to protect your data: access limited to the team members who need it, passwords, and secure storage of questionnaires (paper copies locked away, digital copies with restricted access).

8. Changes

If we change this policy, we'll post the new version here with its date. If the change is significant, we'll let you know.

bottom of page