Each document opens with a short, honest summary in plain English; the full formal version sits behind the link.
The summaries below are written to be read, not to be hidden behind. Where a summary and the formal document ever diverge, the formal text governs — so read the summary, follow the link for the binding text, and ask our DPO directly if anything is unclear.
Every card is the plain-English version; the link beneath it opens the document that actually governs.
Updated April 2026
We process the operational data your spa needs to run — guest names, treatment bookings, contact details where the booking requires them, and nothing more. We are the processor; your hotel is the controller. Each property's data lives on its own database, resident in your region — EU/EEA by default, Doha or Dammam for GCC properties — encrypted at rest, never co-mingled. We don't sell it, share it with advertisers, or use it to train any model.
Updated April 2026
A flat monthly subscription buys the platform with a 99.5% monthly uptime target — no commissions, no per-booking fees, no surprise charges. Your data stays yours throughout: we claim no ownership, licence, or training right. On termination we hand it back in standard formats and destroy our copy with a signed certificate.
Updated April 2026 · matches Order Form Annex A
The formal Data Processing Agreement under Article 28 GDPR, incorporated by reference into every Order Form. We process personal data only on your written instructions, with the security measures documented in the agreement. We notify you of any breach without undue delay — within 24 hours of detection — so you can meet your own 72-hour duty to the supervisory authority, give 30 days' notice before changing a sub-processor, and assist with data-subject requests through built-in dashboard tooling.
Updated April 2026
The marketing site sets no analytics or advertising cookies — no third-party trackers, no Google Analytics, no Facebook Pixel. The white-labelled guest booking surface on your domain uses only the strictly-necessary cookies needed to hold the booking session. Cookie handling is covered in full within the Privacy Policy.
Our Data Protection Officer answers every legal-and-privacy enquiry personally — no ticket queue, no gatekeeper.