Privacy policy

1. Controller

Sanitas, S.A. de Seguros (tax ID A-28037042), C/ Ribera del Loira 52, 28042 Madrid, Spain. Sanitas Data Protection Officer: dpo@sanitas.es.

Sanitas is the controller because the data is collected while distributing its insurance, as set out in my agency contract with Sanitas.

2. Who processes your data on Sanitas's behalf

Tomás Schwaighofer Pérez, exclusive insurance agent («agente de seguros exclusivo») of Sanitas, S.A. de Seguros (DGSFP no. C032043207680H), tax ID (NIF) 43207680H, address Av. del Gran i General Consell, 6, 07004 Palma (Illes Balears), email hola@saludbalear.com. Trading as Salud Balear.

I process your data as a processor: on Sanitas's behalf, following its instructions and only for what this policy explains (art. 28 GDPR).

3. What data is processed, why, and on what legal basis

The quote form does not ask for health data. As proof of your consent, the text you accepted, the date, the IP address and the browser are also kept.

4. Providers that process data on Sanitas's behalf

Four providers are involved in running this website. They process the data on Sanitas's behalf and only for their service:

• Vercel, which hosts the website and the form.
• Neon (Databricks group), the database where your request is stored, on servers in Frankfurt (Germany).
• Telegram, which delivers me a notice of each new request. The notice does not include your name or your contact details: only general information about the request (for example, the product, how many of you there are or the language) and a link to your record, which only opens with my user account. It never contains health data. Only if the database failed to save your request would the notice include your name and contact method, because it would be the only copy.
• Resend, which sends the website's automatic emails: for group schemes, the link to finish your enrolment with the terms of the offer, and the confirmation when you submit it. It receives your name, your email address and the content of those emails. They carry no open or click tracking.

The database is in the European Union. Vercel and Resend are United States companies and may process data there (Resend sends the emails from Ireland, but its main operations are in the United States); those transfers use the safeguards the GDPR requires: the European Commission's standard contractual clauses and, for Resend, also the EU-U.S. Data Privacy Framework. Telegram stores the data of EU accounts in data centres in the Netherlands.

If you write to me on WhatsApp or by email, or choose Telegram to talk to me, the conversation also goes through that service.

5. Who else receives your data

Sanitas, as the controller, to issue and manage your policy if you decide to go ahead. Your data is not passed on to anyone else or used for third-party advertising, unless the law requires it.

6. How long it is kept

If you don't take out a policy, your contact details are deleted 12 months after our last conversation, or sooner if you ask. If you do, Sanitas keeps them for as long as the policy lasts and then for the legal periods during which liability can be claimed.

7. Your rights

You can access your data, correct it, delete it, object to or restrict its use, ask for its portability and withdraw your consent at any time, as easily as you gave it (for example, by replying STOP on WhatsApp).

As Sanitas is the controller, you can exercise them with Sanitas: at lopd@sanitas.es, by post to C/ Ribera del Loira 52, 28042 Madrid, Spain, or at sanitas.es/RGPD. You can also write to me (hola@saludbalear.com): I will help you and pass your request on to Sanitas. If you think your data has not been handled properly, you can complain to the Spanish Data Protection Agency («Agencia Española de Protección de Datos», aepd.es).

8. Cookies

This website does not set analytics or advertising cookies. I measure visits with my own system, which uses no cookies and does not identify people. If cookies of that kind are ever added, you will be asked for permission first with a banner, where rejecting them is as easy as accepting them.

There is one technical exception: in the sign-up forms of group schemes (such as the Grupo Cursach one), when you press «Sign me up» a cookie of our own called sb_alta is saved in your browser with the link to your enrolment. It only takes you back to it and stops you seeing an empty form if you reload the page or come back later. Nobody else receives it, it is not used for analytics or advertising, it is only set because of that action of yours and it is strictly necessary to provide the service you asked for, so it needs neither your consent nor a banner. It expires at the latest one month after the scheme's sign-up closes (31 January 2027 for Cursach) and is deleted when you submit your enrolment. You can also delete it at any time in your browser settings.

In those same forms, while you fill them in, what you type is also kept in your browser's local storage (localStorage) until it reaches our server: if the page closes or the connection drops, you don't have to type it again when you come back. It is deleted as soon as the server confirms it or when you submit your enrolment, and at the latest one month later. It never leaves your device, nobody receives it and it is not used to measure anything; for the same reason as the cookie, it needs no consent. The consent tick box is never stored. If you share the device, you can delete it in your browser settings (clear site data).

More on how I work in the transparency policy. This English version is provided for convenience; if it differs from the Spanish version, the Spanish version prevails.