Privacy Policy

This Privacy Notice explains how The Urban Sauna collects, uses, retains and shares personal information in connection with its website, bookings, facilities, gift vouchers, customer communications and marketing.

1. Data controller

The Urban Sauna is a trading name of Seven Sauna Ltd, a company registered in England and Wales under company number 17196057, whose registered office is at Moffatt House, 14-20 Pall Mall, Liverpool L3 6AL. For the purposes of applicable UK data-protection legislation, Seven Sauna Ltd is the controller of the personal information described in this notice.

Questions concerning personal information may be sent to info@theurbansauna.co.uk.

2. Categories of personal information

The personal information we may collect includes:

• identity and contact details, including name, email address, telephone number and billing details;
• booking and attendance information, including booking dates, session times, party details and relevant customer-service records;
• transaction information, including amounts paid, refunds and voucher activity; full card details are processed by the relevant payment provider;
• health and safety information, including completion of a health declaration and any health, accessibility or emergency information which you choose or need to provide;
• marketing preferences and engagement information;
• technical information, including IP address, device and browser information, website activity and cookie identifiers; and
• correspondence, complaints, feedback and other communications with us.

3. Purposes and lawful bases

• Taking, administering and fulfilling bookings: performance of a contract.
• Processing payments, refunds and vouchers: performance of a contract and legal obligations.
• Customer communications and enquiries: performance of a contract and/or legitimate interests.
• Safety, incident management and legal claims: legitimate interests and, where applicable, an appropriate Article 9 condition.
• Accounting, tax and statutory records: legal obligation.
• Fraud prevention, security and misuse prevention: legitimate interests.
• Direct marketing: consent or another lawful basis available under applicable electronic-marketing rules.
• Website analytics and non-essential cookies: consent where required.

4. Health information

Information concerning a person's health may constitute special-category personal data. Where we process such information, we will do so only where an Article 6 lawful basis and an applicable Article 9 condition are available. We seek to minimise the health information we collect and do not require guests to provide a detailed medical history as part of the standard booking process.

The health declaration completed when booking records only your name, that you accepted the declaration, the date and time of acceptance and the version accepted. It does not ask you to tell us about any medical condition.

Where a guest voluntarily provides information about a medical condition, medication, allergy, accessibility requirement or incident, that information will be used only to the extent reasonably necessary for the relevant safety, operational, legal or emergency purpose.

5. Recipients and service providers

We may share personal information with service providers used to operate the business, including website and ecommerce providers, booking platforms, payment processors, communications and marketing providers, analytics providers, IT support providers, accountants, insurers and professional advisers. We may also disclose information where required by law, to emergency services, or where reasonably necessary to establish, exercise or defend legal rights.

The main providers we currently use are:

• Shopify, for our website, online store and checkout, with card payments processed through Shopify Payments;
• Sesami, for booking and scheduling sessions;
• Klaviyo, for booking confirmations, reminders and, where permitted, marketing emails; and
• Google, for the map shown on our website and, where you have consented, website analytics.

6. International transfers

Where a service provider processes personal information outside the United Kingdom, we will ensure that an appropriate lawful transfer mechanism is in place, which may include UK adequacy regulations or approved contractual safeguards.

7. Retention

We retain personal information as follows:

• booking, payment and accounting records will ordinarily be retained for up to six years where required for tax, accounting or legal purposes;
• health acknowledgements, incident records and related material will be retained only for so long as reasonably necessary having regard to safety, insurance and legal-claims requirements;
• marketing information will be retained until consent is withdrawn, an objection is made, or the information is removed in accordance with our retention procedures;
• routine enquiries and correspondence will ordinarily be retained for up to two years unless a longer period is reasonably required; and
• cookie and analytics information will be retained in accordance with the periods stated in our cookie settings and the relevant provider's configuration.

8. Your rights

Subject to the circumstances and applicable exemptions, individuals may have rights of access, rectification, erasure, restriction, objection and data portability, and may withdraw consent where processing is based on consent. Requests should be sent to info@theurbansauna.co.uk.

You also have the right to complain to the Information Commissioner's Office if you consider that your personal information has been handled unlawfully.

9. Security and changes

We use reasonable technical and organisational measures designed to protect personal information. This notice may be amended from time to time to reflect changes in law, systems or business practice. The version published at the relevant time will state its effective date.