Privacy Policy
Artisa Spa Limited (“Artisa Spa”, “we”, “us”) respects your privacy and is committed to protecting your personal data. This notice explains what personal data we collect when you use our website (artisaspa.co.uk), book or receive a treatment, buy a gift voucher or course, join our rewards programme, apply for a job or contact us; why we collect it; who we share it with; how long we keep it; and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
1.1. Artisa Spa Limited (company number 10749964, registered in England and Wales) is the data controller for all the personal data described in this notice, including data collected when you book with, or buy from, its sister company Artisa Spa & Beauty Ltd (company number 13381972), which operates from the same premises. Artisa Spa & Beauty Ltd does not hold or process client data separately. Our registered office is 359 High Road, Leyton, London E10 5NA. We are registered with the Information Commissioner’s Office (ICO), registration reference ZA604487.
1.2. If you have any questions about this notice or how we handle your data, email info@artisaspa.co.uk, call 020 8558 8268, or write to us at the address above.
2. The information we collect
2.1. Identity and contact details: your name, email address, phone number and, if you give it, your date of birth (used only for the birthday reward in our rewards programme).
2.2. Booking details: the treatments, dates, times and therapists you book, your appointment history, notes about your preferences (for example pressure or oil choice), and any cancellation or no-show records.
2.3. Health information: before your first treatment, and whenever your circumstances change, we ask you to complete a health declaration covering medical conditions, medicines, allergies, injuries, pregnancy and other things that may affect whether a treatment is safe or how it should be adapted. Our therapists may also make brief treatment notes. This is special category data and we treat it with particular care (see section 3.2).
2.4. Payment information: the amount, date and method of payment, and the card type and last four digits of any card used. We never see or store full card numbers; they are handled by our payment processor, Stripe. If you pay by card over the phone, we also record that we have checked your photo ID matches the card name.
2.5. Gift voucher and course details: the buyer’s and recipient’s name and email address, any gift message, voucher codes, balances and expiry dates; course start and expiry dates, and the person you nominate to share or receive a course.
2.6. Rewards and referral details: your points balance and history, tier, referral code, and the fact that a referral has taken place (the referrer is told a reward has been earned, but not who booked or what they had).
2.7. Discount eligibility: if you apply for an NHS, emergency services, student or teacher discount, the evidence you show us and the date we checked it.
2.8. Job applications: if you apply to work with us, the details you give in the application form and any CV you upload.
2.9. Correspondence: emails, contact form messages, phone messages and any complaints.
2.10. Website usage data: your IP address, browser type and version, device type, pages visited, and the cookies described in our Cookie Policy.
2.11. Account details: if you have an online account, your sign-in email, your encrypted password and your account settings.
2.12. Phone calls: when you call us, our AI receptionist answers. We keep the number you call from, the time and length of the call, what was arranged (for example a booking held or a message taken), and a written transcript of the conversation. Calls to our main number may also be recorded as audio by our phone provider, BT, and our receptionist tells you so at the start of the call.
2.13. Conversations with James: if you use “Ask James” on our website or in your account, we keep the conversation so James can answer follow-up questions and so we can check the answers he gives.
2.14. Text messages: your mobile number, the texts we send you about your bookings, and any replies you send, including STOP and START.
2.15. Parking: if you ask us to arrange parking, your vehicle registration, the time it is needed, and the permit we bought for it.
2.16. Waiting list: if you join a waiting list for a day or time, the treatment, the day and part of the day you asked for and, if you give it, your email address.
3. Why we use your information, and our legal basis
3.1. To take, manage and deliver your bookings, including confirmations, reminders, changes, cancellations and payment. Legal basis: performance of a contract with you (UK GDPR Article 6(1)(b)).
3.2. To keep you safe and tailor your treatment, by reviewing your health declaration and treatment notes. Legal basis for the personal data: performance of a contract and our legitimate interest in providing treatments safely (Article 6(1)(b) and (f)). Legal basis for the health data itself: your explicit consent (Article 9(2)(a)). You can decline to give health information, but we may then be unable to provide some or all treatments safely.
3.3. To keep records for legal and insurance purposes, including health declarations, consultation and treatment notes, and records of payments, refunds and disputes. Legal basis: compliance with our legal obligations and our legitimate interest in defending legal claims (Article 6(1)(c) and (f); Article 9(2)(f) for health data in connection with legal claims).
3.4. To run our rewards and referral programmes and discounts you have chosen to use. Legal basis: performance of a contract (the programme terms) and, for birthday rewards, your consent to give your date of birth.
3.5. To send you service messages such as booking confirmations, reminders, receipts, cancellation notices, tier and points reminders, and important changes to our terms. These are not marketing, and you can’t opt out of them while you have a booking or account with us. Legal basis: performance of a contract and legitimate interests.
3.6. To send you marketing (news, offers and wellness tips by email or SMS) only where you have opted in, or where you are an existing customer, we are telling you about similar treatments and services, and you have not opted out (the “soft opt-in” under the Privacy and Electronic Communications Regulations 2003). Every marketing message includes an unsubscribe link, and you can opt out at any time by emailing info@artisaspa.co.uk. Legal basis: consent, or our legitimate interest in telling existing customers about our services.
3.7. To consider job applications. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in recruiting, with your agreement to us keeping your application for up to 12 months.
3.8. To respond to enquiries and complaints and improve our services. Legal basis: legitimate interests.
3.9. To run and secure our website, prevent fraud and misuse, and understand how the site is used. Legal basis: legitimate interests, and consent where non-essential cookies are used.
3.10. To comply with the law, for example tax and accounting rules or lawful requests from authorities. Legal basis: legal obligation.
3.11. To recognise our team for the reviews you leave. If you leave a public Google review of Artisa Spa, we may match it to your visits (the treatment and the therapist) so that the therapist you name can be thanked and recognised. We use only the review as published and our own booking records. Legal basis: legitimate interests.
3.12. To answer your calls at any hour, book and change appointments by phone, take messages and pass urgent calls to the team. Our receptionist is an AI system; it can only do what our booking rules allow, it checks who you are before discussing a booking, and anything it cannot do is passed to a person. It does not make decisions with legal or similarly significant effects. Legal basis: performance of a contract, and our legitimate interest in answering every call.
3.13. To help you choose and book through James, our website assistant. James answers from our own website and live prices and never assesses health, injury or pregnancy. Legal basis: legitimate interests, and performance of a contract when he helps you book.
3.14. To send you service texts (confirmations, reminders, changes, payment links and parking details) from our own spa phone. These are not marketing. Legal basis: performance of a contract. Reply STOP to stop them.
3.15. To arrange a visitor parking permit when you ask for one. Legal basis: performance of a contract.
3.16. To offer you a freed appointment from the waiting list. Legal basis: your request (performance of a contract), and you can stop it with the link in any waiting-list email.
We do not use your personal data for automated decision-making that has legal or similarly significant effects on you.
4. Who we share your information with
4.1. We never sell your personal data. We share it only with service providers who process it for us under written contracts, and only as needed for the purposes above:
- Hostinger hosts our website, booking system, customer database and health declaration records on servers in the UK/EU.
- Stripe Payments UK Ltd processes card payments. Stripe is an independent controller for the payment data it collects; see Stripe’s privacy policy.
- Google (Google Workspace) hosts our business email and calendars, and sends many of our service emails.
- Amazon Web Services (Amazon SES) delivers some of our emails.
- Google Maps serves the map on our contact page and may set cookies (see our Cookie Policy).
- Google Analytics measures how our website is used, with analytics cookies only if you accept them in our cookie banner (see our Cookie Policy). Advertising features are switched off.
- OpenAI (the voice and language models of our phone receptionist) and Telnyx (our phone line) process calls for us. Our phone software runs on our own server at Hostinger in the UK.
- Anthropic (Claude) powers James and the assistant that helps our managers with complaints, through our own gateway; names and contact details are removed from complaint text before it is sent (see Complaints and concerns).
- BT (our phone provider) may record calls to our main number and stores any recordings for us.
- SMSGate carries the texts we send from our own spa phone.
- MiPermit and the London Borough of Waltham Forest receive your vehicle registration and the permit times when we buy a visitor permit for you.
- Our therapists and staff see only the information they need for your treatment, and are bound by confidentiality.
- Professional advisers, insurers and regulators, where necessary to get advice, deal with claims or comply with the law.
4.2. If Artisa Spa Limited is sold or merges with another business, your data may be transferred to the new owner so they can continue to provide services to you. We will tell you if this happens.
5. International transfers
5.1. Your data is stored in the United Kingdom and the European Economic Area. Some of our providers (for example Stripe, Amazon, Google, OpenAI, Anthropic and Telnyx) may process data in other countries, including the United States. Where that happens we rely on the UK’s adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the provider’s own safeguards, so your data is protected to a standard equivalent to the UK’s.
6. How long we keep your information
6.1. Health declarations and treatment notes: 7 years from your last treatment (or, for clients under 18, until their 25th birthday if later), in line with insurance requirements and time limits for personal injury claims. If you withdraw consent, we stop using the data for treatments and keep it archived, unused, for the rest of this period only.
6.2. Booking, payment, voucher and course records: 6 years after the end of the financial year they relate to, for tax and accounting purposes.
6.3. Account, rewards and referral data: while your account is active. Accounts with no activity for 3 years are deleted after we have given notice.
6.4. Discount eligibility checks: while the discount is in use, and for no longer than 12 months after the last check.
6.5. Job applications: up to 12 months from the date you apply, unless you join the team.
6.6. Marketing preferences: until you unsubscribe; we keep a record that you unsubscribed so we don’t contact you again.
6.7. Enquiries and correspondence: 2 years, unless they relate to a complaint or claim.
6.8. Website logs and analytics: up to 14 months.
6.9. Phone calls: the written transcript for 30 days; the record of the call (number, time, what was arranged) for 12 months; any audio recording, held by BT, for up to 5 years.
6.10. Conversations with James and other AI requests: 30 days.
6.11. Text messages and replies: about 13 months.
6.12. Waiting-list entries: deleted a week after the day you asked for.
6.13. Parking: your vehicle registration and permit details are kept with the booking and payment records, for 6 years (see 6.2).
When data is no longer needed it is securely deleted or anonymised.
7. How we protect your information
7.1. Our website and booking system are served over HTTPS (TLS encryption). Data is stored on secure, access-controlled servers, and access to health information is limited to the therapists and managers who need it. Passwords are stored in hashed form. Card payments are processed by Stripe, which is certified to PCI DSS Level 1, so card numbers never touch our systems.
7.2. No transmission over the internet or method of storage is completely secure. If a data breach is likely to result in a risk to you, we will tell you and the ICO, as the law requires.
8. Your rights
8.1. Under UK GDPR you have the right to:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate or incomplete data.
- Erasure: ask us to delete your data where we no longer have a lawful reason to keep it (we may need to keep some data for the periods in section 6).
- Restriction: ask us to limit how we use your data in certain circumstances.
- Portability: receive the data you gave us in a machine-readable format, where we process it by automated means on the basis of consent or contract.
- Objection: object to processing based on legitimate interests, and at any time to direct marketing.
- Withdraw consent: where we rely on consent (for example health information or marketing), at any time, without affecting processing that took place before.
8.2. To use any of these rights, email info@artisaspa.co.uk. We will reply within one month, free of charge in most cases. We may ask you to confirm your identity first.
8.3. If you’re unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
9. Children
9.1. Our website, online booking, gift vouchers, courses bought online and rewards programme are for adults aged 18 or over. Treatments for clients under 18 can be arranged at the spa with a parent or guardian, who provides the health information and consent on the young person’s behalf. We do not knowingly collect personal data from children online; if you believe a child has given us data, please contact us and we will delete it.
10. Links to other websites
10.1. Our website links to third-party websites and services (for example Google Maps, Google reviews, Instagram and Facebook). We are not responsible for their privacy practices; please read their own privacy notices.
11. Changes to this notice
11.1. We may update this notice from time to time. The latest version is always on this page, with the date it was last updated. We will email account holders about significant changes.
12. Contact
Artisa Spa Limited, 359 High Road, Leyton, London E10 5NA
Tel: 020 8558 8268 · Email: info@artisaspa.co.uk
Data controller: Artisa Spa Limited (10749964) · ICO registration: ZA604487
Last updated: 9 November 2026
Complaints and concerns
When you make a complaint we keep what you tell us (the category, your words, any photos you add with their hidden location data removed, the visit it concerns and the outcome) together with your name and contact details if you gave them, so that a manager can look into it and reply. We keep closed complaints for three years, because that is how long a claim about an injury can be brought; an anonymous complaint is kept for twelve months. Internal concerns raised by our team are kept for three years.
Anonymous means anonymous. If you choose Anonymous we record no name, email address, phone number, account, IP address or device details with your complaint, and we cannot find out who you are afterwards. The code you are given is stored only as a one-way hash.
Confidential means our managers know who you are but the therapist concerned is not told. If a manager shares a summary with a therapist to hear their side, anything that could identify you is removed first.
How we use AI with complaints. Our managers are helped by an AI assistant (Anthropic’s Claude, through our own gateway) that summarises each complaint, suggests questions to ask, points out related cases and patterns, and proposes next steps from a fixed list. Before anything reaches the AI, names, email addresses, phone numbers and booking numbers are removed and people are replaced by placeholders such as “C1” or “T2”; health detail goes only as far as “a skin reaction after waxing”. The AI takes no decision and no action: every reply, refund, apology or other outcome is decided and carried out by a manager, who is recorded as having done so (UK GDPR Article 22). Anonymous complaints reach the AI without anything that could identify the writer and it is instructed never to guess who wrote one; any attempt is removed. Our data protection impact assessment for this processing is available on request.
Your rights are as set out above, and your account’s “Download your information” includes your own named complaints and our replies. Our lawful basis is our legitimate interest in running a safe, fair spa and answering the people who use it. Where a complaint includes health information, such as a reaction or an injury, we keep it to deal with the complaint and with any claim that may follow (UK GDPR Article 9(2)(f)) and, where someone may be at risk, to keep them safe. An anonymous complaint holds nothing about the person who made it.