Privacy Policy

1. What Personal Data We Collect

We collect the following categories of personal data:

• Identity and contact data: name, email address, phone number, postal address.
• Booking and transaction data: session or membership bookings, dates and times attended, payment amounts, refund history.
• Payment data: we do not store full card details ourselves. Payments are processed securely by our payment provider(s), who handle and store card data in accordance with their own privacy and security standards.
• Health declaration and waiver data: information you provide in our Health Declaration and Waiver form, which you complete before your first visit, relating to your suitability for sauna and cold plunge use.
• Website usage data: IP address, browser type, device information, and pages visited, collected via cookies and analytics tools (see Section 6).
• Communications: records of correspondence if you contact us, including emails, forms, or messages.

We do not knowingly collect any special category data beyond what you voluntarily disclose in the health declaration referred to above, which we treat with additional care as described in Section 4.

2. How We Collect Your Data

We collect data:

• directly from you, when you make a Booking, sign up for Membership, complete a health declaration/waiver, or contact us;
• automatically, through your use of our website and booking platform (cookies and similar technologies);
• from our booking platform provider, Periode, which processes bookings, payments, and waivers on our behalf.

3. Why We Use Your Data and Our Legal Basis

Purpose	Legal basis
Taking and managing your bookings and payments	Performance of a contract with you
Confirming your suitability to use sauna/cold plunge facilities safely	Performance of a contract with you / vital interests where relevant to health and safety
Sending booking confirmations, reminders, and essential service updates	Performance of a contract with you
Sending marketing communications (e.g. offers, newsletters)	Consent — you can opt out at any time
Improving our website and services through analytics	Legitimate interests
Complying with legal and tax obligations	Legal obligation
Handling complaints or disputes	Legitimate interests

4. Health Declaration and Waiver Data

Given the nature of our services, we ask you to disclose relevant health information (such as cardiovascular conditions, pregnancy, or other contraindications) before your first use of our facilities. This is special category health data under UK GDPR, and we only collect it:

• with your explicit consent, given when you complete the health declaration/waiver; and
• to the extent necessary to protect your health and safety and that of other customers.

This data is stored securely on our booking platform, Periode, and access is limited to staff who need it to manage bookings and respond to safety concerns.

5. Who We Share Your Data With

We share personal data with the following categories of third party, only as needed to provide our services:

• Periode — our booking and membership platform provider, which processes bookings, waivers, and related data on our behalf.
• Payment processors — to process payments securely. We do not see or store your full card details.
• Analytics and marketing tools (e.g. Google Analytics, Meta Pixel) — where used, to understand website usage and measure the effectiveness of any advertising, as described in Section 6.
• Professional advisers and regulators — where necessary for legal, accounting, or insurance purposes.

We do not sell your personal data to third parties.

6. Cookies and Website Analytics

Our website may use cookies and similar technologies to:

• remember your preferences;
• understand how visitors use our website (analytics);
• measure the performance of any advertising campaigns.

You can control or disable cookies through your browser settings. Disabling cookies may affect some website functionality.

7. International Data Transfers

Where any of our service providers store or process data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Addendum or equivalent standard contractual clauses, in accordance with UK GDPR requirements.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes described in this policy:

• Booking and transaction records: retained for 6 years to meet accounting and tax obligations.
• Health declaration/waiver data: retained for 6 years after your last visit, to support any safety or insurance-related queries.
• Marketing consent: retained until you withdraw consent or unsubscribe.

After these periods, we securely delete or anonymise your data.

9. Your Rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data in certain circumstances ("right to be forgotten");
• restrict or object to certain processing, including direct marketing;
• data portability, where technically feasible;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at hello@saunaflow.co.uk. We will respond within one month, as required by law.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data appropriately.

10. Data Security

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including relying on our booking platform provider's security measures for stored booking and waiver data.

11. Children's Data

Our services are intended for use by adults, or by children accompanied by a supervising adult in line with our site rules. We do not knowingly collect personal data directly from children without appropriate parental or guardian involvement.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version will always be available on our website with its last-updated date.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

hello@saunaflow.co.uk
9 The Firs, Eaton Rise, Ealing, W5 2HG
Tel: 07947 561382