PRIVACY POLICY
Last updated: 24 August 2026
1. Data Controller
In accordance with Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation — “GDPR”) and applicable Spanish data protection legislation, we inform you that personal data provided through www.tabularasabcn.com, Tabula Rasa communication channels, booking platforms or services provided by the Centre will be processed by:
Legal name: Tabula Rasa Barcelona, S.L. Tax ID: B75879908 Registered office: Carrer Mozart, 2, 08012 Barcelona, Spain Email: hola@tabularasabcn.com Telephone: +34 644 33 42 62
Hereinafter, “Tabula Rasa”, “the Centre”, “we”, “us” or “the Company”.
Tabula Rasa does not currently have a Data Protection Officer (DPO).
This Privacy Policy explains how Tabula Rasa collects, uses, stores and protects the personal data of users, customers, participants and other individuals who interact with the Centre.
2. Personal data we may collect
Depending on your relationship with Tabula Rasa and the services you use, we may process different categories of personal data, including:
a) Identification and contact data
Name and surname.
Email address.
Telephone number.
Other contact details voluntarily provided.
b) Booking, purchase and service-related data
Information relating to classes, activities, workshops, therapies, events, coworking, space rental and other services booked or purchased.
Booking, cancellation and attendance history.
Information relating to packs, passes, subscriptions, memberships and credits.
Information required to manage purchases and payments.
Information relating to participation in Centre activities.
c) Communications data
We may retain communications with users through email, forms, contact channels, social media, messaging applications or other official Tabula Rasa channels where necessary to manage a query, booking, incident, complaint or relationship with the Centre.
d) Activity and participation data
We may process information relating to participation in activities, workshops, events, competitions, games, promotional activities and other initiatives organised or promoted by Tabula Rasa.
e) Health or physical condition data
In certain circumstances, a user may voluntarily provide information relating to injuries, pregnancy, illnesses, physical limitations or other circumstances relevant to their participation in an activity.
This information may be communicated directly to an instructor, therapist or other professional at the Centre, usually informally, for the purpose of appropriately managing or adapting the person's participation in the activity.
Tabula Rasa will process this information only where necessary for the appropriate and safe provision of the service and in accordance with the applicable rules governing special categories of personal data.
f) Browsing and technical data
When a person browses the website, certain technical information may be collected, such as information relating to the device, browser, IP address, browsing data or information generated through cookies and similar technologies.
Such data will be processed in accordance with this Privacy Policy and the Cookie Policy.
3. Purposes of processing
Personal data may be processed for the following purposes:
a) Booking and service management
Managing class and activity bookings.
Managing attendance.
Managing cancellations and credit returns.
Managing packs, passes, subscriptions and memberships.
Managing therapies, coworking, space rental and other services.
Managing workshops, events and special activities.
b) Purchase and payment management
Managing purchases and contracts.
Processing payments.
Managing invoicing and accounting obligations.
Managing payment-related incidents.
Tabula Rasa does not retain or store complete bank card details used to make payments.
Payments may be processed through specialised external platforms and payment providers. These platforms may process the data required to process payments in accordance with their own policies and terms.
c) User relationship management
Responding to queries and requests.
Managing incidents and complaints.
Providing information relating to services.
Sending operational communications relating to bookings, activities, changes, cancellations or contracted services.
d) Internal organisation and management
Managing the Centre's activities.
Organising classes and activities.
Managing space availability.
Managing professionals and activities.
Improving the organisation and operation of services.
e) Commercial communications and newsletters
Where applicable and in accordance with applicable law, Tabula Rasa may send commercial communications, newsletters, information about activities, news, promotions, events and other content relating to the Centre.
Tabula Rasa currently uses Mindbody to send and manage newsletters and commercial communications. In the future, the Centre may use other specialised platforms or providers for this purpose.
Users may object to receiving commercial communications or unsubscribe by following the instructions included in the relevant communication or by contacting Tabula Rasa.
f) Activities, competitions, games and promotional activities
Personal data may be used to manage participation in competitions, games, prize draws, promotions, Centre activities, campaigns and other initiatives organised by Tabula Rasa.
Where a specific activity requires particular data-processing conditions, these will be communicated at the time of participation.
g) Compliance with legal obligations
Personal data may be processed to comply with legal, tax, accounting, administrative or other obligations applicable to Tabula Rasa.
h) Fraud prevention and security
Personal data may be processed to prevent fraudulent or improper use of services, security incidents or activities contrary to the Centre's terms of use.
i) Defence of rights and claims
Personal data may be processed where necessary to exercise, defend or manage claims, actions or rights of Tabula Rasa or third parties.
4. Legal basis for processing
The legal bases that may legitimise the processing described above include, depending on the circumstances:
Performance of a contract: where processing is necessary to manage a booking, purchase, membership, pack, subscription or contracted service.
Compliance with a legal obligation: where processing is necessary to comply with tax, accounting, administrative or other legal obligations.
Consent: where consent is required under applicable law, particularly for certain commercial communications, cookies or specific processing activities.
Legitimate interests: where processing is necessary to manage, protect and improve Tabula Rasa's activities, provided that the interests or rights of the individual do not override those interests.
Protection of vital interests: where applicable under the law.
Exercise or defence of legal claims: where necessary to exercise or defend rights in connection with claims or proceedings.
5. Health data and special categories of personal data
Some Tabula Rasa services may involve users voluntarily providing information relating to their health or physical condition, particularly in relation to injuries, pregnancy, illnesses, limitations or other circumstances that may affect their participation.
This information may be communicated directly to the professional responsible for the activity, including an instructor or therapist, and may be provided informally during the user's relationship with the Centre.
Tabula Rasa does not systematically request medical reports or detailed clinical information in order to participate in activities.
Where health data or other special categories of personal data are processed, Tabula Rasa will apply the safeguards and requirements established by applicable data protection legislation.
Users should provide only the information they consider necessary and appropriate to participate safely in the activity.
6. Recipients of personal data
Personal data may be accessible to:
Tabula Rasa personnel who need access to perform their duties.
Professionals, instructors, therapists and collaborators involved in providing services.
Technology and service providers acting on behalf of Tabula Rasa.
Payment service providers.
Accounting, tax, legal or other professional advisers where necessary.
Public authorities, courts, tribunals or other bodies where legally required.
Certain services may be managed through external platforms, such as Mindbody, ClassPass, Urban Sports Club, Wellhub, Spacent and Croissant, among others.
The use of these platforms may involve the processing of personal data by these providers in accordance with their own privacy policies and terms.
7. External platforms
Certain Tabula Rasa services may require the use of external platforms to manage bookings, payments, memberships, communications or other functionalities.
These platforms may include:
Mindbody
ClassPass
Urban Sports Club
Wellhub
Spacent
Croissant
Other platforms that Tabula Rasa may introduce in the future.
Each platform may act as a data controller in relation to certain processing activities it carries out directly and will have its own privacy policies and terms of use.
Tabula Rasa does not control processing carried out directly by these platforms and is not responsible for their policies, privacy practices, security measures or use of data in accordance with their own terms.
When using an external platform, users are advised to review the relevant privacy policy before providing personal data.
8. Payments and card data
Tabula Rasa does not retain complete bank card details used by users.
Payment data may be processed directly by the relevant platforms or payment providers in accordance with their own privacy policies and security measures.
External platforms used by Tabula Rasa may include Mindbody, ClassPass, Urban Sports Club, Wellhub, Spacent, Croissant and other providers that may be introduced in the future.
Tabula Rasa is not responsible for the use, processing, storage or protection of card data carried out by these platforms in their capacity as data controllers or payment service providers, without prejudice to any responsibilities legally attributable to Tabula Rasa.
9. International data transfers
Some technology providers or external platforms used by Tabula Rasa may be established outside the European Economic Area or may use subcontractors located in third countries.
In such cases, personal data may be transferred internationally where necessary for the provision of the relevant services.
Where required by applicable law, such transfers will be carried out on the basis of legally recognised mechanisms, such as European Commission adequacy decisions, Standard Contractual Clauses or other safeguards provided for under data protection legislation.
10. Data retention
Personal data will be retained for as long as necessary to fulfil the purposes for which it was collected.
In general, Tabula Rasa will retain data while it remains necessary and relevant for the operation and management of the business, always within the periods and limits established by applicable law.
When data is no longer necessary for the relevant purposes, it may be deleted, anonymised or retained only where a legal obligation requires its retention.
In particular, certain data may need to be retained for the periods established by tax, accounting, commercial or other applicable legislation.
11. Rights of individuals
Individuals may exercise, where applicable, the following rights:
Right of access.
Right to rectification.
Right to erasure.
Right to object.
Right to restriction of processing.
Right to data portability.
Right to withdraw consent, where processing is based on consent.
To exercise these rights, you may contact:
hola@tabularasabcn.com
Requests must include sufficient information, where necessary, to identify the requesting individual and properly process the request.
The exercise of these rights is free of charge, except in cases provided for by applicable law.
12. Right to lodge a complaint
If an individual considers that the processing of their personal data infringes applicable law, they may contact Tabula Rasa in an attempt to resolve the matter.
Individuals also have the right to lodge a complaint with the competent data protection supervisory authority.
In Spain, the competent supervisory authority is the Spanish Data Protection Agency (AEPD).
13. Data security
Tabula Rasa adopts reasonable and appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or improper disclosure.
However, no system for transmitting or storing information over the internet can guarantee absolute security.
If a personal data breach occurs that poses a risk to the rights and freedoms of individuals, Tabula Rasa will act in accordance with the obligations established by applicable law.
14. Children and minors
Tabula Rasa's services are primarily intended for adults.
Where an activity is intended or available for minors, their personal data will be processed in accordance with applicable law and, where necessary, with the involvement or authorisation of the person(s) exercising parental responsibility or legal guardianship.
15. Commercial communications
Tabula Rasa may send commercial communications regarding its services, activities, classes, memberships, events, promotions, competitions, games and other initiatives.
These communications may be sent by email or through other authorised communication channels.
Tabula Rasa currently uses Mindbody to manage certain commercial communications and newsletters, but may introduce other tools or platforms in the future.
Users may unsubscribe from commercial communications at any time using the unsubscribe mechanism included in the relevant communication or by contacting Tabula Rasa.
16. Social media
Tabula Rasa may maintain profiles or a presence on different social networks and digital platforms.
Interaction with these profiles may involve the processing of personal data by the platform itself, in accordance with its privacy policies.
Tabula Rasa does not control processing carried out directly by these platforms.
Users are advised to review the privacy policies of each social network before interacting with it or providing personal information.
17. Photographs and recordings
During certain classes, activities, workshops, events or communication activities, Tabula Rasa may take photographs or audiovisual recordings.
The processing of users' images will be carried out in accordance with applicable law and with the information or consent mechanisms required in each case.
Where consent is required, it will be obtained through the relevant mechanism.
Individuals who do not wish to appear in photographs or recordings may inform the Tabula Rasa team.
18. Links and third-party services
The Tabula Rasa website and digital channels may contain links or integrations with third-party websites, applications or services.
Tabula Rasa is not responsible for the privacy policies, cookies or data processing carried out by such third parties.
Users should review the relevant privacy policies before using these services or providing personal data.
19. Cookies
The Tabula Rasa website may use cookies and similar technologies.
These technologies may be used to ensure the operation of the website, remember certain preferences, analyse website usage, improve the browsing experience or provide certain functionalities.
Detailed information about the cookies used, their purposes and configuration options is available in Tabula Rasa's Cookie Policy.
20. Updates to this Privacy Policy
Tabula Rasa may modify or update this Privacy Policy where necessary to reflect legislative, regulatory, technical, organisational or service-related changes.
The current version will be the version published on the Tabula Rasa website at any given time.
The date shown at the beginning of this document identifies the current version of the Privacy Policy.
Users are advised to review this Privacy Policy periodically to be aware of any changes.
21. Contact
For any questions relating to this Privacy Policy or the processing of personal data, you may contact Tabula Rasa at:
Tabula Rasa Barcelona, S.L. Carrer Mozart, 2 08012 Barcelona, Spain
Email: hola@tabularasabcn.com Telephone: +34 644 33 42 62