Privacy Policy

Important: This is an AI-generated template. Please review with a qualified legal professional before relying on it.

Your Spa Garden Privacy Policy

Last Updated: 17 October 2026

Welcome to Your Spa Garden, your private sanctuary of wellness. We are committed to safeguarding the sanctity of your personal information with the utmost diligence and transparency. This Privacy Policy delineates our practices concerning the collection, use, and protection of your data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller Identity

Your Spa Garden is the controller and responsible for your personal data. For any enquiries regarding your data, please contact us at:

  • Full Name of Legal Entity: [Insert Your Company Trading Name]
  • Email Address: [Insert Your Contact Email]
  • Postal Address: [Insert Your Registered Business Address]

2. Lawful Basis for Processing Your Data

We process your personal data only when we have a lawful basis to do so. This includes:

  • Consent: Where you have explicitly given us permission to process your data for a specific purpose, such as subscribing to our exclusive journal or marketing communications.
  • Contract: When processing is necessary for the performance of a contract with you, such as fulfilling your order and delivering the sanctuary of wellness you have procured.
  • Legitimate Interest: Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. This includes enhancing our services, preventing fraud, and for administrative purposes.

3. Your Data Subject Rights

Under the UK GDPR, you are endowed with distinguished rights concerning your personal data. You have the right to:

  • Access: Request access to the personal data we hold about you.
  • Erasure: Request the deletion of your personal data where there is no compelling reason for its continued processing.
  • Portability: Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.
  • Rectification: Request the correction of inaccurate or incomplete personal data.
  • Object: Object to the processing of your personal data where we are relying on a legitimate interest.

To exercise these rights, please contact our Data Protection Officer at the details provided above.

4. Data Retention Periods

We shall retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Typically, order information is retained for six years for tax and legal purposes.

5. Cookie Usage

Our website uses cookies to distinguish you from other users, providing a bespoke and seamless browsing experience. We use the following categories of cookies:

  • Essential Cookies: Necessary for the website to function and cannot be switched off.
  • Analytics Cookies: Allow us to recognise and count the number of visitors and see how they move around our website.
  • Marketing Cookies: Used to track visitors across websites, with the intention to display ads that are relevant and engaging.

For a more detailed explanation, please consult our dedicated Cookie Policy.

6. Third-Party Data Sharing

We do not sell your personal data. We may, however, share your data with a curated selection of trusted third-party service providers to facilitate our business operations, including:

  • Payment processors such as Shopify Payments and PayPal.
  • Esteemed delivery couriers like Royal Mail, DPD, and Evri.
  • Marketing and analytics partners who assist us in refining your experience.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

7. International Data Transfers

Should we transfer your data outside of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented: the transfer is to a country that has been deemed to provide an adequate level of protection for personal data by the UK, or we use specific contracts approved by the UK which give personal data the same protection it has in the UK (Standard Contractual Clauses).

8. Making a Complaint

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.