Privacy policy

Visiting the website and keeping the system secure

• Data: IP address, date and time, the address of the page visited and technical information about the browser (server logs); when you sign in or take other actions, also your email address and the number of attempts to sign in, register, book, send messages and change your password.
• Purpose: running the website, protecting accounts from takeover, limiting abuse and spam, finding and fixing errors.
• Legal basis: Article 6(1)(f) GDPR – our legitimate interest in keeping the service secure and working.

Contact form

• Data: first name and surname, email address, optionally phone number and company name, the message, and which language version of the website it was sent from.
• Purpose: replying to your enquiry and preparing an offer.
• Legal basis: Article 6(1)(f) GDPR (our legitimate interest in answering enquiries) and, where the enquiry concerns entering into a contract, Article 6(1)(b) GDPR.
• The message is not stored in the system’s database – it reaches our mailbox by email.

Booking system account

The booking system is used by employees of companies that have ordered massages from us as an employee benefit. You create an account with the invitation code you receive from your employer.

• Data: first name and surname, work email address, the company you work for, your chosen language, a hash of your password (we never store the password itself), the date the account was created and the email address confirmed.
• Purpose: creating and running your account, confirming that the email address belongs to you and your company, signing in, changing your password and recovering access to your account.
• Legal basis: Article 6(1)(f) GDPR – our legitimate interest in performing the contract with your employer, who provides you with massages as an employee benefit.

Bookings, attendance and ratings

• Data: the time and station, the massage therapist, the date of booking and of any cancellation and its reason (including a recorded missed appointment) and, if you choose to give them, a rating and comment after the appointment.
• Purpose: handling bookings, sharing a limited number of appointments fairly, settling the service with your employer, maintaining the quality of the massages.
• Legal basis: Article 6(1)(f) GDPR – performing the contract with your employer and maintaining the quality of the service. Giving a rating is voluntary.
• The massage therapist does not see your data: their schedule only shows which appointments are taken.
• For settling the service, and at your employer’s request, we may give them a summary of the appointments of their company’s employees: first name and surname, email address, the time and the status of each appointment (e.g. completed, cancelled, missed). We share ratings and comments only in aggregate, without showing who gave them.

Emails

• Data: first name, email address, account language, booking details.
• Purpose: the emails you need to use the service: booking confirmations (with a calendar file), notices of a cancelled appointment, a reminder on the morning of your massage, a request to rate the appointment (at most once every 7 days), links to confirm your email address and to set a password, and notices of a password change, of an attempt to register with your address and of your account being deactivated or your data deleted.
• Legal basis: Article 6(1)(f) GDPR – providing the service you use.
• We do not send advertising or newsletters, and our emails contain nothing that tracks whether you open them or click links.

Administrator activity log

• Data: a record of actions taken in the administrator panel (e.g. data exports, cancelled appointments, deactivated or deleted accounts): who took them and when, from which IP address, and the identifiers of the accounts and companies concerned.
• Purpose: accountability – being able to show who changed or downloaded data, when and why.
• Legal basis: Article 6(1)(f) GDPR in conjunction with Article 5(2) GDPR.

Contracts and invoicing with companies

• Data: details of the companies that order our services and of the people who represent them or contact us on their behalf (first name and surname, position, work contact details), as contained in contracts, invoices and correspondence.
• Purpose: entering into and performing contracts, issuing invoices, bookkeeping.
• Legal basis: Article 6(1)(b) and (f) GDPR (the contract with the company and contact with its representatives) and Article 6(1)(c) GDPR – obligations under tax and accounting law.