Privacy Policy
Last updated: 29 October 2026
1. Who we are
The Secret Spa NI respects your privacy and is committed to protecting the personal information you share with us. This policy explains what we collect when you visit thesecretspani.com, book a spa treatment or glamping stay, or contact us, and how we look after it.
The Secret Spa NI is owned and run by Glynis and David and is located at Killaloo, Derry~Londonderry, Northern Ireland. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller of your personal information.
Legal business name: The Secret Retreat & Spa (banking as The Secret Spa NI)
Postal address: 84 Kildoag Road, Ardground, Killaloo, Derry~Londonderry BT47 3TH
Email: thesecretspani@gmail.com
Telephone: 07835 057859
2. The information we collect
We only collect what we need to run your booking and look after you during your visit.
• Identity and contact details: your name, email address, telephone number and postal address.
• Booking details: the treatments, packages, glamping stays or gift vouchers you book, dates, times, number of guests and any special requests (for example, celebrations or dietary requirements).
• Payment information: payments are processed securely by our payment providers. We do not see or store your full card details.
• Health and wellbeing information: details you give us on a consultation or treatment form so that we can treat you safely (see section 4).
• Communications: messages you send us by email, telephone, our contact form or social media, and your marketing preferences.
• Technical information: your IP address, browser and device type, and how you use our website, collected through cookies (see our separate Cookie Policy).
• Reviews and feedback: comments, testimonials or survey responses you choose to give us.
Most of this comes directly from you. Some may come from our booking system, payment providers, or from social media platforms when you message or tag us.
3. How we use your information and our lawful basis
The law requires us to have a lawful basis for each way we use your information:
• Taking and managing bookings, gift vouchers and payments – performance of a contract.
• Sending booking confirmations, reminders and pre-arrival information – performance of a contract.
• Delivering treatments safely and checking suitability – performance of a contract, and explicit consent for health information.
• Answering enquiries from our contact form, email, phone or social media – legitimate interests.
• Sending newsletters, offers and promotions by email or text – consent (you can withdraw at any time).
• Improving our website and understanding how visitors use it – consent, through our cookie banner.
• Keeping accounting and tax records – legal obligation.
• Handling complaints, accidents or legal claims – legitimate interests and legal obligation.
• Keeping our premises, guests and staff safe – legitimate interests.
We will never sell your personal information. We will only send you marketing if you have opted in, and every message will include a simple way to unsubscribe.
4. Health and wellbeing information
Before some treatments we may ask about your health, including medical conditions, allergies, medication, pregnancy or skin sensitivities. This is classed as special category data under UK GDPR and receives extra protection.
• We collect it only so that we can deliver your treatment safely and adapt it where needed.
• We process it with your explicit consent, which you give when you complete and sign your consultation form.
• It is seen only by the therapist carrying out your treatment and the owners of the business.
• It is stored securely and never used for marketing.
You may withdraw your consent at any time. However, if we do not have the information we need, we may be unable to provide certain treatments safely.
5. Who we share your information with
We share your information only with trusted providers who help us run the business, and only as much as they need. Each acts under contract and must keep your data secure.
• Website host, platform and online bookings: Wix.com and Wix Bookings.
• Payment processors: Stripe, PayPal and Worldpay. We also accept bank transfer.
• Email and marketing: managed by us directly; a newsletter service may be added.
• Social media platforms: Meta Platforms (Facebook and Instagram), for messages you send us there.
We may also disclose information where the law requires it, for example to HM Revenue & Customs, the police or a court.
International transfers: some of our providers, such as Wix, may store data outside the UK, including in the United States. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or the UK–US data bridge.
6. How long we keep it, how we protect it, and children
We keep personal information only for as long as we need it:
• Booking and payment records: 6 years after the end of the financial year (tax rules).
• Consultation and treatment forms: 8 years after your last treatment.
• Enquiries that do not lead to a booking: up to 12 months.
• Marketing list: until you unsubscribe.
• Gift voucher records: until the voucher expires, then as booking records.
Security: we use password-protected systems, secure payment providers and an encrypted (HTTPS) website. Paper forms are kept in a locked cabinet, and access is limited to people who need it.
Children: bookings must be made by an adult aged 18 or over. Guests under 16 must be accompanied by a parent or guardian, who gives consent and provides any information on their behalf.
7. Your rights
Under UK data protection law you have the right to access a copy of the personal information we hold about you; have anything inaccurate corrected; have your information erased where we no longer have a reason to keep it; restrict or object to how we use it, including for direct marketing at any time; receive your information in a commonly used format; and withdraw your consent at any time, where we rely on consent.
To use any of these rights, please email thesecretspani@gmail.com. There is normally no charge, and we will reply within one month.
8. Complaints
If you are unhappy with how we have handled your information, please contact us first so we can put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
9. Cookies
Our website uses cookies. Please read our separate Cookie Policy for details of the cookies we use and how to manage them.
10. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated shown at the top.
11. Contact us
The Secret Spa NI, 84 Kildoag Road, Ardground, Killaloo, Derry~Londonderry BT47 3TH, Northern Ireland
Email: thesecretspani@gmail.com · Telephone: 07835 057859