Privacy policy

1. Who is responsible for your data

SpaTreats is a brand of Abel Santos Correia Unipessoal, Lda., Portuguese company/tax number 516891472, registered at Rua dos Ramos, Urbanização Água Plaza, Lote 13, 3.º Dto., Olhos de Água, 8200-647 Albufeira, Portugal. This company is the controller of the data used to handle your enquiries and provide our services.

Privacy contact: info@spatreats.me. Telephone: +351 961 297 167. This policy covers spatreats.me, purchases, vouchers, bookings, accommodation and spa enquiries, and communications with SpaTreats.

2. Information we receive and its sources

We receive information you provide through purchases, forms, bookings, enquiries and subscriptions: name, email, telephone, billing details, request details, dates, selected spa, service preferences, voucher codes and payment references. Booking platforms and partners involved in the service may give us information needed to provide it.

Browsing may involve processing IP addresses, device identifiers, pages viewed, website interactions and cookie choices. See our Cookie Policy. Do not send full card numbers, identity documents or clinical information through general enquiry forms, chat or messages.

When requesting services for someone else, provide only necessary information and inform them about this processing. Prefer the number of children and, where needed for a quotation, their ages, without additional identifying details.

3. Purposes and legal grounds

Enquiries, quotations, purchases, vouchers and bookings

Contact and service information to handle your request and perform a contract, or take steps at your request before a contract. Without essential information we cannot respond or arrange the booking.

Invoicing and legal duties

Tax information, transactions and documents needed to comply with legal obligations.

Customer support, security and complaints

Relevant enquiry, order and contact records; performance of a contract, legal obligations or legitimate interests in protecting our services, preventing misuse and establishing or defending rights, as appropriate.

Newsletters and campaigns

Contact details, language and preferences, with consent where required. Subscription is optional; a purchase or booking is not, by itself, permission for marketing.

Usage analysis and personalised advertising

Browsing and interaction data in accordance with your consent choices for non-essential technologies. Consent is separate from acceptance of purchase terms.

Necessary booking confirmations and reminders are service communications, separate from promotional campaigns. Withdraw marketing consent using the unsubscribe link or contact info@spatreats.me, without affecting existing bookings or the lawfulness of earlier processing.

4. Shopify, Fresha and other recipients

Shopify: hosts our store and supports purchases, accounts, security and communication tools. It processes data on our behalf and, for certain services, for its own purposes. Shopify Network Intelligence is enabled: visits, purchases and interactions may support enhanced services combining information from other merchants and Shopify, including personalisation and advertising, subject to applicable choices. See Shopify’s Consumer Privacy Policy and Shopify’s privacy portal to exercise rights, withdraw consent or object to this processing.

Fresha: supports bookings, client records, service communications and loyalty. It acts as our processor for records managed on our behalf; for your Fresha account and certain platform purposes it may be an independent controller. See Fresha’s Privacy Policy. SpaTreats and Fresha marketing choices are separate.

Partners and providers: authorised professionals and the relevant spa or hotel receive only information needed for the requested service or quotation. Providers may also include payment and invoicing, hosting and email services; Google for measurement and advertising; Meta/WhatsApp for messages and advertising through applicable integrations; Judge.me for reviews; and Chatbase for the website assistant. Use depends on your chosen service, active tools and applicable consent choices. Authorities, advisers or insurers receive information only where justified and necessary.

If you use the automated assistant, what you type may be processed by its provider to answer and handle your enquiry. Do not share clinical or payment information there. Reviews intended for publication may be publicly visible; do not include sensitive information or other people’s data.

5. Health information and treatment safety

General purchase, quotation, booking, chat and marketing channels are not intended for diagnoses, medication or medical histories. Speak directly with our team before treatment about any relevant safety concern.

If collecting or recording health information is necessary, its purpose, minimum required details, permitted access, retention and applicable legal ground must be explained beforehand, including explicit consent where required. This must be separate from marketing consent. This policy does not constitute consent to collect health data.

Use of clinical forms in Fresha requires prior clarification of the platform’s applicable terms. Please do not submit health information through these forms until the procedure has been validated.

6. International transfers

Shopify, Fresha and other providers may process data outside the European Economic Area. Locations depend on each provider and its subprocessors; we do not guarantee that all processing takes place in Portugal or the European Union. Transfers requiring safeguards must rely on an adequacy decision or another GDPR mechanism, such as standard contractual clauses, with supplementary measures where necessary.

Contact info@spatreats.me for details of recipients and safeguards relevant to your situation. You can also consult the privacy documentation of the providers listed in this policy.

7. How long information is kept

We keep information only as long as needed for its purpose and applicable obligations. The criteria are:

• Enquiries and quotations: time needed to respond, follow up and resolve related matters; enquiries that do not lead to a booking should not be kept indefinitely.
• Purchases and bookings: provision and follow-up of the service, complaints and applicable legal periods.
• Invoices: the archive period required by tax and accounting law.
• Marketing: while valid permission and a need remain; after unsubscribing, minimal objection records and consent evidence may be retained to respect your choice and meet obligations.
• Cookies: the session or technology-specific lifetime, as described in the Cookie Policy and provider documentation.

Information must be deleted or anonymised when no retention ground remains. Erasure requests do not remove documents that must legally be retained. You may ask us about the retention period for your record.

8. Your rights and how to use them

Where applicable, you may request access, correction, erasure, restriction and portability; object to processing based on legitimate interests; and withdraw consent at any time. You may object to direct marketing at any time.

Email info@spatreats.me with your request and enough information to locate the record. Additional identity information will be requested only when necessary. We normally respond within one month; any legally permitted extension will be explained to you.

You may complain to the Portuguese Data Protection Authority (CNPD) or another competent supervisory authority. For data controlled directly by Shopify or Fresha, also use the contacts and mechanisms in their policies.

9. Security, choices and updates

Data requires technical and organisational measures appropriate to risk, access limited to authorised people and confidentiality duties. No online service can guarantee absolute security. Contact us if you suspect a problem involving your data.

Review cookie choices using “Cookie preferences” in the footer or our Cookie Policy. We may update this policy to reflect changes in law or services; its version and review date appear on this page.