Hot Haus Sauna Limited customer privacy notice
This privacy notice tells you what to expect us to do with your personal information.
- Contact details
- What information we collect, use, and why
- Lawful bases and data protection rights
- Where we get personal information from
- How long we keep information
- Who we share information with
- How to complain
Contact details
Phone: 07723362838
Email: hot.haus.sauna@gmail.com
Registered office address:
61 BRIDGE STREET
KINGTON
UNITED KINGDOM HR5 3DJ
Company Number: 16477915
What information we collect, use, and why
We collect or use the following information to provide services and goods, including delivery:
- Names and contact details
- Addresses
- Date of birth
- Purchase or account history
- Payment details (including card or bank information for transfers and direct debits)
- Health information (including dietary requirements, allergies and health conditions)
- Health and safety information
- Account information
- Information relating to loyalty programmes
- Website user information (including user journeys and cookie tracking)
- Photographs or video recordings
Our Condition for Processing Sensitive Health Data
Because health data is classified as "Special Category Data," we process it under Article 9(2)(a) of the UK GDPR (Explicit Consent). You provide this explicit consent by actively ticking the health data consent box on our pre-session intake form and liability waiver.
- Consequence of Refusal: Providing this data is voluntary; however, because your safety inside our heat environments is our absolute priority, if you choose not to consent to us processing your health information, we will be unable to fulfill your booking or permit you to use the sauna facilities.
- Withdrawing Your Consent: You have the right to withdraw your consent at any time by emailing us at hot.haus.sauna@gmail.com.
- Note on Insurance & Liability: If you choose to withdraw your consent, we will immediately remove your health data from our active scheduling and day-to-day business systems. However, to comply with our commercial insurance requirements and protect our business against civil liability under the Limitation Act 1980, your signed digital waiver will be securely archived and restricted from view until our flat 5-year retention period expires, at which point it will be permanently deleted.
We collect or use the following information for the operation of customer accounts and guarantees:
- Names and contact details
- Addresses
- Payment details (including card or bank information for transfers and direct debits)
- Account information, including registration details
- Marketing preferences
We collect or use the following information for service updates or marketing purposes:
- Names and contact details
- Marketing preferences
- Recorded images, such as photos or videos
- Website and app user journey information
- Records of consent, where appropriate
We collect or use the following information for cookies:
This website and our booking system use cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app.
- Functional & Required Cookies: These are always used to allow Squarespace (our hosting platform) and Acuity Scheduling (our booking platform) to securely serve this website to you and process your appointment selections.
- Analytics & Performance Cookies: Any non-essential analytical or performance cookies are used on this website only when you actively acknowledge and accept our cookie banner.
- We use cookies as required by the acuity scheduling system
Lawful bases and data protection rights
Under UK data protection law, we must have a lawful basis
for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.
Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:
- Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
- Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
- Your right to erasure - You have the right to ask us to delete your personal information.
- Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
- Your right to object to processing - You have the right to object to the processing of your personal data.
- Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
- Your right to withdraw consent - When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide services and goods are:
- Contract: We have to collect or use this information (such as your name, contact details, and payment information) so we can enter into or carry out our booking contract with you.
Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:
- Contract: We process this data to maintain your account registry and fulfill any service guarantees associated with your purchases.
Our lawful bases for collecting or using personal information for service updates or marketing purposes are:
- Consent: We rely on your clear, affirmative consent to send you promotional newsletters, offers, or marketing emails, and to use any promotional photographs or videos taken at our venue. You have the absolute right to withdraw this consent at any time by clicking "unsubscribe" or emailing us.
- Legitimate Interests: We may rely on legitimate interests to send you administrative service updates (such as sudden maintenance closures or weather warnings) or to send occasional, relevant updates to existing customers who have previously booked with us, provided you are always given a clear, immediate opportunity to opt out.
Where we get personal information from
We collect personal information directly from you when you register an account, book a session via our platform, fill out a health waiver, or interact with us via email.
How long we keep information
We do not retain your personal data, booking history, or signed liability waivers indefinitely. Under data protection laws (UK and EU GDPR), we only store your information for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, insurance, or operational requirements.
To protect our business against potential civil liability and negligence claims under the Limitation Act 1980, and to ensure absolute administrative accuracy regarding minor guests (ages 16 and 17) who retain the right to bring a claim until their 21st birthday, we apply a uniform retention window across our entire client database:
All Client Records & Waivers: We securely retain your client profile, booking history, health intake information, and signed liability waivers for a flat period of five (5) years following your last completed appointment or interaction with our sauna.
Removal: After five consecutive years of inactivity, your data - including your contact details and signed digital waivers - is permanently deleted from our scheduling systems.
Marketing Data: If you have given explicit consent to receive our marketing emails, we will retain your email address until you opt out or unsubscribe. Unsubscribing from marketing will not delete waivers or booking records that we are legally required to hold under our 5-year security window.
Who we share information with
Others we share personal information with
- Emergency services
- Publicly on our website, social media or other marketing and information media
- Our third-party data processors, including our online booking platform and digital waiver software provider - Acuity Scheduling
Third Party Links
Our Website may contain hyperlinks to third party websites. These third party websites operate independently from us, and we cannot accept any responsibility or liability for the privacy practices of such third parties nor the availability of these external sites or resources. The appearance of such links on our Website is not an endorsement. Should you use any of these websites, such use is at your own risk and we would advise that you review their respective privacy policies.
How to complain
If you have any concerns about our use of your personal information, you can make a data protection complaint to us:
Email: hot.haus.sauna@gmail.com
If you remain unhappy with how weve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO's address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint