Privacy Policy

Last updated: 2 July 2026

Effective date: 2 July 2026

1. Introduction

Welcome to WellQuest. This Privacy Policy explains how WellQuest S.r.l. (“WellQuest,” “we,” “us,” or “our”) collects, uses, and protects personal data when you visit our website, subscribe to our communications, apply to join our practitioner network, act as a referrer (“ambassador”), or otherwise interact with us.

We are committed to protecting your privacy and to being transparent about how we handle personal data, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Italian data protection law. Please read this policy carefully.

This policy replaces any previous privacy policy published by WellQuest and covers all of our current activities.

2. Who We Are (Data Controller)

Data Controller: WellQuest S.r.l.

Registered office: Via Fedele Lampertico 6, 00191 Rome (RM), Italy

Contact for privacy matters: hello@wellquestgroup.com

We have not appointed a Data Protection Officer (DPO), as we are not required to do so under Article 37 GDPR. You may direct any data protection question to the contact above.

3. Who This Policy Applies To

This policy applies to the following groups of people whose data we process:

  • Website visitors and subscribers - people who browse our website, join our waiting list, or subscribe to our newsletter.

  • Practitioners who apply directly - wellness practitioners who complete our onboarding form to be considered for the WellQuest network.

  • Practitioners referred by ambassadors - practitioners whose contact details are shared with us by a third party, before we have contacted them.

  • Ambassadors - trusted individuals who refer practitioners to us.

  • Hospitality and business partners - contacts at venues, resorts, and organizations we work with.

4. What We Collect, Why, and Our Legal Basis

We only process personal data where we have a lawful basis under Article 6 GDPR. Below we set out, for each activity, the data involved, the purpose, our legal basis, and how long we keep the data.

Newsletter and waiting list

  • Data: your name and email address.

  • Purpose: to send you newsletters, updates, and information about our services.

  • Legal basis & retention: consent (Art. 6(1)(a)). We keep this data until you unsubscribe or withdraw consent, after which we delete or anonymise it.

Practitioner applications (submitted directly)

  • Data: your name, contact details, location, professional background, description of the services you offer, availability, pricing, links, and any video you submit.

  • Purpose: to assess your application and take steps toward a possible collaboration at your request.

  • Legal basis & retention: pre-contractual measures taken at your request (Art. 6(1)(b)). We keep this data for 24 months from our last contact if no collaboration begins, or for the duration of any collaboration plus 24 months thereafter.

Practitioners referred by ambassadors

  • Data: your name, contact details, and the professional information provided by the ambassador who referred you.

  • Purpose: to evaluate whether to contact you about a possible collaboration.

  • Legal basis & retention: our legitimate interest in building a curated network (Art. 6(1)(f)). We provide you with the information required by Article 14 GDPR at the latest when we first contact you (see Section 6). We keep this data for 24 months from our last contact if no collaboration begins.

Ambassadors

  • Data: your name, contact details, and the referrals you submit.

  • Purpose: to manage the referral relationship and follow up on the practitioners you introduce.

  • Legal basis & retention: pre-contractual measures or legitimate interest (Art. 6(1)(b)/(f)), depending on our relationship with you. We keep this data for the duration of the relationship plus 24 months.

Website usage and analytics

  • Data: your IP address, browser type, pages visited, time spent on pages, and similar information.

  • Purpose: to understand how our website is used and to improve it.

  • Legal basis & retention: consent for non-essential cookies (Art. 6(1)(a)); legitimate interest for essential, aggregated statistics (Art. 6(1)(f)). See Section 7.

Direct communications

  • Data: the messages you send us by email or WhatsApp, and our replies.

  • Purpose: to respond to you and manage our relationship.

  • Legal basis & retention: legitimate interest (Art. 6(1)(f)) or pre-contractual measures (Art. 6(1)(b)). We keep this data for as long as needed to handle your request and for a reasonable period afterward.

Accounting and tax records (if a paid engagement arises)

  • Data: the data needed to issue invoices and meet our bookkeeping obligations.

  • Purpose: to meet our legal accounting and tax obligations.

  • Legal basis & retention: legal obligation (Art. 6(1)(c)). We keep this data for 10 years, as required by Italian law.

5. A Note on Practitioner Profiles

The information practitioners provide describes their professional services and background. It is not information about the health of their clients or patients. We do not collect or store health data, data revealing sexual orientation, or religious or philosophical beliefs of practitioners’ clients. If you are a practitioner, please do not include personal data about your clients when completing our form.

6. Where We Obtain Data About Referred Practitioners

If you are a practitioner who did not contact us directly, we received your name and contact details from an ambassador who recommended you. Ambassadors are asked to share your details only where they believe it is in your interest and to let you know they are doing so; however, the responsibility to inform you rests with us as the data controller.

When we first contact you, we will tell you who referred you and give you access to this policy. You may object to our processing at any time and ask us to delete your details — see Sections 9 and 10. If you ask us to stop, we will.

7. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. We use:

  • Essential cookies — necessary for the website to function.

  • Performance / analytics cookies — to understand how visitors use the site.

  • Targeting / advertising cookies — to show relevant content and measure campaigns.

Non-essential cookies are only set with your consent, which you give through our cookie banner and can withdraw at any time via your browser settings or the banner controls. Blocking some cookies may affect how the website works.

8. Service Providers, Sharing, and International Transfers

Service providers

We use Google Workspace (Google Ireland Limited / Google LLC) to collect, store, and manage the data described in this policy, and in some cases WhatsApp (Meta) for direct contact. These providers act as our data processors under agreements that meet GDPR requirements. Where we use analytics, advertising, or newsletter tools, they are listed with their own privacy terms.

When we share data

We do not sell your personal data. We share it only:

  • with your consent;

  • with trusted service providers who process data on our behalf and under our instructions;

  • where required to comply with a legal obligation;

  • to protect our rights, safety, or property; and

  • in connection with a business transfer such as a merger or acquisition.

International transfers

Some of our providers, including Google, may process data on servers located outside the European Economic Area (EEA), including in the United States. Where this happens, the transfer is protected by appropriate safeguards under Chapter V GDPR — in particular the European Commission’s Standard Contractual Clauses and, where applicable, the provider’s certification under the EU–U.S. Data Privacy Framework. You may request more information about these safeguards using the contact details in Section 2.

9. Your Rights

Under the GDPR you have the right to:

  • Access — obtain a copy of the personal data we hold about you.

  • Rectification — have inaccurate or incomplete data corrected.

  • Erasure — ask us to delete your data in certain circumstances.

  • Restriction — ask us to limit our processing in certain circumstances.

  • Data portability — receive your data in a structured, commonly used, machine-readable format.

  • Object — object to processing based on our legitimate interests, including any referral-based processing.

  • Withdraw consent — withdraw consent at any time where we rely on it, without affecting prior processing.

To exercise any of these rights, contact us at hello@wellquestgroup.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

10. Data Relating to Minors

Our services are directed to adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with data, contact us at hello@wellquestgroup.com and we will delete it.

11. Data Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this policy from time to time. We will post the updated version on this page and revise the “Last updated” date. Please review it periodically.

13. Contact Us

Email: hello@wellquestgroup.com

Address: WellQuest S.r.l., Via Fedele Lampertico 6, 00191 Rome (RM), Italy