Privacy Policy

1. Who we are

Spa Cafe ("Spa Cafe", "we", "us", "our") is a day spa located at Horizon Shadwell, Pine Garden, Basseterre, St. Kitts & Nevis. We are the data controller for the personal information described in this policy. Contact: Spacafeskn@gmail.com, +1 (869) 662-2300.

2. Information we collect

Information you give us. When you book, enquire, chat with our assistant or visit us, we may collect: your name; your phone number and/or email address; the treatment, date and time you request; your booking reference; any promo code you use; the occasion or notes you choose to add; the content of the messages you send us; and, in person, any health information you choose to share with your therapist so that a treatment can be given safely.Information collected automatically. When you use our website or assistant, our systems record technical information needed to run the service securely, such as your IP address, browser type, the pages you visit, and a temporary session identifier.Information from other sources. We do not buy or obtain personal information about you from third parties.

3. How we use your information

We use personal information to:

• take, confirm, remind you about, change and cancel your bookings;
• apply any discount or promo code you are entitled to;
• respond to your questions and messages;
• ask you how your visit went and invite you to leave a review;
• send you offers and news, only where you have opted in;
• provide treatments safely, using health information you give your therapist;
• keep our website, booking system and messaging secure, prevent abuse and diagnose faults;
• keep the business records we are required to keep.

We use your information on the basis that it is necessary to provide the service you asked for, that you have consented (for marketing), or that we have a legitimate interest in running and protecting our business. We follow the principles of the St. Kitts & Nevis Data Protection Act, 2018.

4. Who we share it with

We do not sell personal information. We share it only with service providers who help us run the business, each of which acts on our instructions:

• our technology and hosting provider, which operates the website, booking system and messaging assistant for us;
• a language-model provider, used only to understand and phrase messages sent to the assistant, and which does not receive payment details;
• email and messaging providers that deliver confirmations, reminders and replies;
• professional advisers and authorities where the law requires it.

If online payment is introduced, card payments will be processed by a payment provider on its own secure page and this policy will be updated before that happens.

5. International transfers

Our website, booking system and assistant run on servers located in the European Union (Germany). Messages you send by WhatsApp are also processed by WhatsApp under its own terms. Where information leaves St. Kitts & Nevis, we choose providers that apply recognised security and privacy safeguards.

6. How long we keep it

• Bookings, booking messages and chat records: 24 months after your last visit, then deleted.
• Marketing opt-ins: until you opt out.
• Records we must keep for accounting or legal reasons: for the period the law requires.
• Technical logs: up to 90 days.

7. Security

We use encrypted connections (HTTPS), access controls, and limited, role-based access to your information. Card details are never entered on our website. No method of transmission or storage is completely secure; if a breach affecting you occurs we will tell you and, where required, the relevant authority.

8. Your rights

You can ask us to:

• tell you what personal information we hold about you and provide a copy;
• correct information that is wrong or incomplete;
• delete your information, unless we need to keep it for a legal reason;
• stop using your information for marketing;
• restrict or object to certain processing.

To use any of these rights, email Spacafeskn@gmail.com or speak to us in the spa. We will respond within 30 days. You also have the right to complain to the relevant data protection authority in St. Kitts & Nevis.

9. Children

Our website and assistant are intended for adults. We do not knowingly collect personal information from children under 18 without a parent or guardian. Please contact the spa before booking for anyone under 18.

10. Cookies and similar technologies

This website sets no advertising or marketing cookies. The messaging assistant uses a temporary session identifier for the open page only; it is not stored after the page is closed. We count visits anonymously with Umami, a self-hosted analytics tool. It uses no cookies and stores no personal data.

11. Marketing messages

Booking confirmations, reminders and a single request for feedback after your visit are part of the service. We send offers or news only if you have opted in when booking or in the spa. You can opt out at any time by replying STOP, emailing Spacafeskn@gmail.com, or telling us in person.

12. Health information

Health information is sensitive. Please do not send it through the assistant or the booking form. Tell your therapist in person before your treatment; it is used only to provide the treatment safely and is not stored in our online systems.

13. Changes to this policy

We may update this policy from time to time. The effective date at the top shows the current version. Significant changes will be highlighted on this page.

14. Contact us

Spa Cafe, Horizon Shadwell, Pine Garden, Basseterre, St. Kitts & Nevis. Email Spacafeskn@gmail.com. Phone +1 (869) 662-2300.