1. Who we are
Spa Cafe ("Spa Cafe", "we", "us", "our") is a day spa located at Horizon Shadwell, Pine Garden, Basseterre, St. Kitts & Nevis. We are the data controller for the personal information described in this policy. Contact: contact@spacafe.co, +1 (869) 662-2300.
2. Information we collect
Information you give us. When you book, send us a message or visit us, we may collect: your name; your phone number and/or email address; the treatment, date and time you request; your booking reference; any promo code you use; the occasion or notes you choose to add; the content of the messages you send us; and, in person, any health information you choose to share with your therapist so that a treatment can be given safely.
Information collected automatically. When you use our website or booking page, our systems record technical information needed to run the service securely, such as your IP address, browser type and the pages you visit.
Information from other sources. We do not buy or obtain personal information about you from third parties.
3. How we use your information
We use personal information to:
- take, confirm, remind you about, change and cancel your bookings;
- apply any discount or promo code you are entitled to;
- respond to your questions and messages;
- ask you how your visit went and invite you to leave a review;
- send you offers and news, only where you have opted in;
- provide treatments safely, using health information you give your therapist;
- keep our website, booking system and contact form secure, prevent abuse and diagnose faults;
- keep the business records we are required to keep.
We use your information on the basis that it is necessary to provide the service you asked for, that you have consented (for marketing), or that we have a legitimate interest in running and protecting our business. We follow the principles of the St. Kitts & Nevis Data Protection Act, 2018.
4. Who we share it with
We do not sell personal information. We share it only with service providers who help us run the business, each of which acts on our instructions:
- our technology provider, which operates the website, booking calendar and contact form for us on servers in Germany;
- email and messaging providers that deliver confirmations, reminders and replies;
- professional advisers and authorities where the law requires it.
If online payment is introduced, card payments will be processed by a payment provider on its own secure page and this policy will be updated before that happens.
5. International transfers
Our website, booking calendar and contact form are hosted on servers in the European Union (Germany). If you message us on WhatsApp, your messages are also processed by WhatsApp under its own terms.
6. How long we keep it
- Bookings and messages: 24 months after your last visit or message, then deleted.
- Marketing opt-ins: until you opt out.
- Records we must keep for accounting or legal reasons: for the period the law requires.
- Technical logs: up to 90 days.
7. Security
We use encrypted connections (HTTPS), access controls, and limited, role-based access to your information. Card details are never entered on our website. No method of transmission or storage is completely secure; if a breach affecting you occurs we will tell you and, where required, the relevant authority.
8. Your rights
You can ask us to:
- tell you what personal information we hold about you and provide a copy;
- correct information that is wrong or incomplete;
- delete your information, unless we need to keep it for a legal reason;
- stop using your information for marketing;
- restrict or object to certain processing.
To use any of these rights, email contact@spacafe.co or speak to us in the spa. We will respond within 30 days. You also have the right to complain to the relevant data protection authority in St. Kitts & Nevis.
9. Children
Our website is intended for adults. We do not knowingly collect personal information from children under 18 without a parent or guardian. Please contact the spa before booking for anyone under 18.
10. Cookies and similar technologies
This website sets no advertising or marketing cookies. We count visits anonymously with Umami, a self-hosted analytics tool. It uses no cookies and stores no personal data. The booking calendar is loaded from our technology provider's booking system and uses only what it needs to show available times and take your booking.
11. Marketing messages
Booking confirmations, reminders and a single request for feedback after your visit are part of the service. We send offers or news only if you have opted in when booking or in the spa. You can opt out at any time by replying STOP, emailing contact@spacafe.co, or telling us in person.
12. Health information
Health information is sensitive. Please do not send it through the contact form or the booking form. Tell your therapist in person before your treatment; it is used only to provide the treatment safely. If you do send health information to us, you can ask us to delete it by emailing contact@spacafe.co.
13. Changes to this policy
We may update this policy from time to time. The effective date at the top shows the current version. Significant changes will be highlighted on this page.
14. Contact us
Spa Cafe, Horizon Shadwell, Pine Garden, Basseterre, St. Kitts & Nevis. Email contact@spacafe.co. Phone +1 (869) 662-2300.