This notice explains how Steve Tata trading as Sheen Stables Massage(“we”) collects and uses your personal information when you use this website and book with us. We are the data controller. You can contact us about your data at [email protected].
What we collect
- Contact details: your name, email address and phone number.
- Booking details: the services you book, dates, times, prices and any notes you add.
- Account details: your login email and a securely hashed password (we never see the password itself).
- Health information: your answers to our health questionnaire and any health notes you add, only if you give explicit consent (see below).
- Messages you send through our contact form.
Why we use it, and our lawful basis
- To take and manage your bookings and to contact you about them: performance of a contract.
- To keep financial records we are required to keep: legal obligation.
- To answer your enquiries and keep the website secure: legitimate interests.
Health information
Health information is “special category” data under the UK GDPR. We only store it with your explicit consent (Article 6(1)(a) and Article 9(2)(a)), which you give separately, in your account, before any health information is saved. We use it only to plan your sessions safely.
- It is encrypted when stored and can be seen only by the team at Sheen Stables Massage.
- It is never used for marketing and never shared, unless the law requires it.
- Health information is kept while you are a client and for 8 years after your last session, then deleted. Withdrawing consent deletes it straight away.
- You can withdraw consent at any time from your account. Your health information is then deleted. This does not affect anything we did with it before you withdrew.
Who we share it with
We do not sell your information. We use a small number of service providers who process it on our behalf:
- Our website and database hosting provider, based in the UK or EU.
- Our email delivery provider, to send booking confirmations and account emails.
How long we keep it
Booking and payment records are kept for 6 years to meet tax and accounting rules. Contact form messages are kept for up to 2 years. Account details are kept until you ask us to close your account.
Your rights
You have the right to access your information, to have it corrected or deleted, to restrict or object to how we use it, to data portability, and to withdraw consent. To use any of these rights, contact us at [email protected]. We will respond within one month.
If you are unhappy with how we handle your information you can complain to the Information Commissioner's Office at ico.org.uk.