Privacy Policy

Who we are

This Privacy Policy applies to Chatchaya Spa Limited, a holistic therapy spa located at 1 Station Approach, Penarth, CF64 3EE, Wales. We are part of the Beauty Box Group.

This policy explains how we collect, use, and protect any information about you when you visit our website at chatchayaspa.co.uk or contact us directly.

What information we collect

We may collect the following types of information:

• Usage data: Pages you visit, how long you spend on each page, the browser and device you use, and how you arrived at our site (e.g. via a search engine or social media). This data is collected via Google Analytics and is anonymised.
• Contact information: If you call us, email us, or fill in a contact form, we may collect your name, phone number, or email address.
• Booking information: Appointments booked through our Fresha booking system are processed by Fresha. Please refer to Fresha's own privacy policy for details of how they handle your data.

Cookies and analytics

Our website uses Google Analytics 4 (GA4) to understand how visitors use our site. This helps us improve the experience for future visitors. Google Analytics uses cookies — small text files stored on your device — to collect anonymised data about your visit.

We use Google Consent Mode v2, which means analytics cookies are only activated if you choose to "Accept All" on our cookie banner. If you select "Essential Only," no analytics data is collected.

The cookies used by Google Analytics include:

• _ga — Distinguishes unique users. Expires after 2 years.
• _ga_<ID> — Maintains session state. Expires after 2 years.

We also use localStorage (browser storage) to remember your cookie preference so you are not asked again on future visits. This is an essential function and does not track you.

To opt out of Google Analytics tracking across all websites, you can install the Google Analytics Opt-out Browser Add-on.

How we use your information

We use the information we collect for the following purposes:

• To understand how visitors use our website and improve it over time
• To respond to enquiries or booking requests made directly to us
• To manage appointments and communicate with clients regarding their treatments

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Legal basis for processing (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases for processing your data:

• Consent — For analytics cookies, which we only enable when you explicitly agree via our cookie banner.
• Legitimate interests — For basic website functionality and responding to direct enquiries.
• Contract — For processing appointment bookings and providing treatments.

How long we keep your data

Google Analytics data is retained for 14 months by default, after which it is automatically deleted. Direct enquiry records (e.g. emails or call logs) are kept for as long as is reasonably necessary to fulfil the purpose for which they were collected, and are then securely deleted.

Third-party services

Our website and business may involve the following third-party services, each with their own privacy policies:

• Google Analytics — Website analytics. Google Privacy Policy
• Fresha — Online booking and appointment management. Fresha Privacy Policy
• Google Business Profile — Business listing and reviews managed through Google.

Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — You can ask us what personal data we hold about you.
• Right to rectification — You can ask us to correct inaccurate data.
• Right to erasure — You can ask us to delete your personal data.
• Right to restrict processing — You can ask us to limit how we use your data.
• Right to object — You can object to us processing your data in certain circumstances.
• Right to withdraw consent — If processing is based on consent, you can withdraw it at any time by clicking "Essential Only" in the cookie banner (which reappears if you clear your browser storage), or by contacting us directly.

To exercise any of these rights, please contact us by phone or in person at the address below. We aim to respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Data security

We take reasonable steps to protect any personal information we hold. Our website is served over HTTPS. We do not store payment card data — all transactions are handled by Fresha's secure payment system.

Children's privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or UK law. The date at the top of this page will always show when it was last updated. We encourage you to review this page periodically.

Contact us

If you have any questions about this Privacy Policy or how we handle your data, please get in touch: