Introduction
This Privacy Policy explains how Masado Sarl, Spa Escape (“we”, “us”, “our”) collects, uses, discloses, and protects your personal information in compliance with the General Data Protection Regulation (GDPR) and other applicable laws. By using our services, you agree to the collection and use of information in accordance with this policy.
Table of Contents
- Data Controller
- Contact Information
- Legal Basis for Processing Personal Data
- Data Collection
- Purpose of Data Processing
- Data Sharing and Disclosure
- International Data Transfers
- Data Security
- Data Retention
- Your Rights Under GDPR
- Children’s Privacy
- Cookies and Similar Technologies
- Third-Party Links
- Policy Updates
- Complaints
Data Controller
Masado Sarl, Spa Escape is the data controller responsible for your personal data.
Contact Information
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:
- Email: [email protected]
- Phone: +352 621 647 637
- Address: 16 Rue des Franciscaines, 1539 Luxembourg
Legal Basis for Processing Personal Data
We process your personal data based on the following legal grounds:
- Consent: When you have given clear consent for us to process your personal data for specific purposes (e.g., marketing communications).
- Contractual Necessity: Processing is necessary for the performance of a contract with you or to take steps to enter into a contract (e.g., booking appointments).
- Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject.
- Legitimate Interests: Processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests.
Data Collection
We collect and process personal data when you:
- Book Appointments: Through our website or via our local partner, Salonkee.
- Contact Us: Via email, phone, or through our website contact forms.
- Use Our Services: Such as purchasing gift cards, subscriptions, or vouchers.
- Visit Our Website: Through cookies and similar technologies (see Cookies and Similar Technologies).
The types of personal data we may collect include:
- Contact Information: Name, phone number, email address, and postal address.
- Payment Information: Credit/debit card details and billing information, processed securely via Stripe.
- Booking Information: Appointment dates, services requested, and any preferences or notes you provide.
- Technical Data: IP address, browser type, and browsing behavior collected via Google Analytics 4.
Purpose of Data Processing
We use your personal data for the following purposes:
- Service Delivery: To manage and facilitate bookings, appointments, and the provision of our spa services.
- Payment Processing: To process payments securely via our WooCommerce Stripe Gateway.
- Communication: To send booking confirmations, reminders, and respond to your inquiries via Microsoft 365 and Mailgun.
- Marketing: To send you promotional offers and updates via Mailchimp, only if you have opted in.
- Analytics: To analyze website traffic and improve our services using Google Analytics 4.
- Legal Compliance: To comply with legal obligations, such as accounting and tax requirements.
Data Sharing and Disclosure
We do not sell or rent your personal data. We may share your information with:
- Service Providers: Trusted third parties who assist us in operating our website, conducting our business, or servicing you, under strict confidentiality agreements.
- Legal Obligations: Authorities or regulatory bodies when required by law or to protect our rights.
International Data Transfers
Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). In such cases, we ensure adequate protection is provided by using standard contractual clauses approved by the European Commission or by ensuring the recipient adheres to GDPR requirements.
Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption: Secure Sockets Layer (SSL) technology to encrypt data transmitted over the internet.
- Access Controls: Restricted access to personal data on a need-to-know basis.
- Security Tools: Use of secure services like Cloudflare for website security.
Data Retention
We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. Retention periods are determined based on:
- Legal Requirements: Compliance with Luxembourg laws and regulations.
- Business Needs: Operational considerations for providing services.
Your Rights Under GDPR
You have the following rights regarding your personal data:
- Right of Access: Obtain confirmation as to whether or not your personal data is being processed and access to your personal data.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data under certain conditions.
- Right to Restrict Processing: Request restriction of processing your personal data under specific circumstances.
- Right to Data Portability: Receive your personal data in a structured, commonly used format.
- Right to Object: Object to processing of your personal data for direct marketing purposes or on grounds relating to your particular situation.
- Right to Withdraw Consent: Withdraw your consent at any time where we are relying on consent to process your personal data.
To exercise any of these rights, please contact us at [email protected].
Children’s Privacy
Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us to delete it.
Cookies and Similar Technologies
We use cookies and similar tracking technologies to enhance your experience on our website. Cookies are small data files stored on your device. For detailed information on the cookies we use and your choices regarding cookies, please visit our Cookie Policy page.
Third-Party Links
Our website may contain links to external websites. We are not responsible for the privacy practices of these websites. We encourage you to review their privacy policies.
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Changes will be posted on this page with an updated effective date. You are encouraged to review this policy periodically.
Complaints
If you have any concerns about our use of your personal data, you have the right to lodge a complaint with the National Commission for Data Protection (CNPD) in Luxembourg:
- Website: https://cnpd.public.lu
- Address: 1, avenue du Rock’n’Roll, L-4361 Esch-sur-Alzette, Luxembourg
If you have any questions or need further clarification about this Privacy Policy, please do not hesitate to contact us.
