privacy policy

Privacy Policy

Effective Date: June 2026

Last Updated: July 2026

---

Privacy at Kaiya

At Kaiya Spa Ltd, privacy extends beyond the experience we create within our spa. It also guides how we collect, use, and protect your personal information.

This Privacy Policy explains what information we collect, why we collect it, how it is used, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using www.kaiyaspa.com, making a booking, purchasing a gift voucher, creating an account, or contacting us, you agree to the practices described below.

---

Who We Are

Kaiya Spa Ltd is the data controller responsible for your personal information.

Website: www.kaiyaspa.com

Email: info@kaiyaspa.com

If you have any questions about this Privacy Policy or how your information is handled, please contact us using the details above.

---

What Information We Collect

Depending on how you interact with Kaiya, we may collect:

• Name
• Date of birth, where required
• Email address
• Telephone number
• Postal address, where applicable
• Booking dates and times
• Services booked
• Guest information
• Gift voucher information
• Booking history
• Special requests
• Account details

Payments are processed securely through Stripe. Kaiya Spa does not store your full payment card details.

---

Health Information

To help us provide a safe experience, we may ask you to provide relevant health information before or during your visit.

This may include pregnancy, allergies, medical conditions, current medications, injuries, heat or cold sensitivity, or other information relevant to your suitability for thermal facilities.

This information is classified as special category personal data under UK GDPR. We only collect information that is necessary to assess whether our facilities and services are suitable for you.

Health information is treated confidentially and is only accessed by authorised members of our team where necessary.

---

How We Use Your Information

We use your information to:

• Manage bookings
• Process payments
• Deliver our services
• Assess suitability for treatments and thermal facilities
• Respond to enquiries
• Send booking confirmations and reminders
• Manage gift vouchers
• Improve our website and customer experience
• Comply with legal obligations
• Prevent fraud and protect our business

Where you have given permission, we may also use your information to send occasional updates, news, and offers. You can unsubscribe from marketing communications at any time.

---

Lawful Basis for Processing

We process your information under one or more of the following lawful bases:

• Performance of a contract
• Compliance with legal obligations
• Legitimate interests
• Consent, where required
• Protection of vital interests in relation to health and safety

Special category health information is processed only where necessary to provide our services safely and responsibly.

---

Bookings

Online bookings are managed using Amelia Booking. Information entered during the booking process is used to manage your reservation, communicate with you, and prepare for your visit.

---

Payments

Payments are securely processed by Stripe. Stripe manages payment information in accordance with its own Privacy Policy and industry security standards.

Kaiya Spa does not have access to your full payment card details.

---

Gift Vouchers

If you purchase a gift voucher, we collect the information required to issue and manage the voucher.

Where you provide details of the recipient, we ask that you ensure you have permission to share their information. Recipient information is used only for administering the gift voucher.

---

Marketing

If you choose to join our mailing list, your email address will be managed using Mailchimp.

We may occasionally send news, seasonal experiences, special events, offers, and product updates.

Every marketing email includes an unsubscribe link. You may unsubscribe at any time.

---

Website Analytics

To understand how visitors use our website and improve their experience, we use services including Google Analytics 4, Google Search Console, Google Ads Conversion Tracking, Meta Pixel, and Microsoft Clarity.

These services may collect information such as device type, browser, pages viewed, time spent on pages, general geographic location, referral source, and website interactions.

This information is used to improve our website, marketing, and services.

---

Cookies

Our website uses cookies to remember preferences, improve performance, analyse visitor behaviour, support website functionality, and measure marketing performance.

You can manage cookie preferences through your browser settings. Some website features may not function correctly if cookies are disabled.

---

User Accounts

Visitors may choose to create an account when using our website. Account information allows you to view bookings, manage bookings, and update personal details.

You are responsible for keeping your login credentials secure.

---

Contact Forms

When you complete a contact form, we collect the information you provide in order to respond to your enquiry.

We will only use this information for the purpose of managing your enquiry unless you have also opted into marketing communications.

---

Embedded Content

Pages on our website may include embedded content such as Google Maps, YouTube videos, Instagram content, or other third party media.

Embedded content behaves in the same way as visiting the third party website directly. Those providers may collect information, use cookies, and monitor your interaction according to their own privacy policies.

---

CCTV

For the safety and security of our guests, team members, and premises, CCTV operates in selected public areas of Kaiya Spa.

CCTV is not installed within private spa suites, changing areas, or other spaces where guests would reasonably expect complete privacy.

Footage is retained only for as long as reasonably necessary and may be shared with law enforcement where legally required.

---

Photography

Guest privacy is central to the Kaiya experience.

We will never photograph or film guests for marketing purposes without their explicit consent.

Where photography has been agreed, consent may be withdrawn at any time unless the material has already been published or distributed.

---

Who We Share Your Information With

We may share your information with trusted third party providers where necessary to operate our business.

• Amelia Booking
• Stripe
• Mailchimp
• Website hosting providers
• Website developers
• Analytics providers

We never sell your personal information.

---

International Transfers

Some of the service providers we use may process information outside the United Kingdom.

Where this occurs, appropriate safeguards are in place to ensure your information remains protected in accordance with UK GDPR.

---

Data Security

We take appropriate technical and organisational measures to protect your personal information.

• Secure website encryption
• Restricted staff access
• Secure payment processing
• Password protected systems
• Regular software updates
• Appropriate data security procedures

While every reasonable effort is made to protect your information, no online transmission can be guaranteed to be completely secure.

---

How Long We Keep Your Information

We only retain personal information for as long as necessary.

Retention periods depend on the nature of the information and our legal obligations.

Health information is retained only where necessary for operational, legal, insurance, or safety purposes.

Where information is no longer required, it is securely deleted or anonymised.

---

Your Rights

Under UK GDPR you have the right to:

• Request access to your personal information
• Request correction of inaccurate information
• Request deletion of your information where appropriate
• Restrict certain processing
• Object to processing based on legitimate interests
• Withdraw consent where processing relies on consent
• Request transfer of your information where applicable
• Lodge a complaint with the Information Commissioner's Office

---

Children's Privacy

Our services are intended for individuals who meet our booking requirements.

We do not knowingly collect personal information from children except where necessary to manage bookings that involve younger guests in accordance with our policies.

---

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or business practices.

The latest version will always be published on our website.

---

Contact Us

If you have any questions about this Privacy Policy or how your information is handled, please contact:

Kaiya Spa Ltd

Website: www.kaiyaspa.com

Email: info@kaiyaspa.com

If you remain dissatisfied with how your information has been handled, you have the right to contact the Information Commissioner's Office at www.ico.org.uk.