Privacy Policy

Last updated: 29 September 2025

This Privacy Policy explains how Phuket Thai Massage (“we”, “us”, “our”) collects, uses, discloses, and safeguards personal data when you visit phuketthaimassage.mt (the “Website”), contact us, or use our services. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Malta’s applicable data protection laws.

1) Data Controller

  • Controller: Phuket Thai Massage

  • Registered address: Shop 2 Stella Maris Building High Street, Sliema, Malta

  • Phone: +356 2739 4587

  • Email: bookings@phuketthaimassage.mt

If you have questions about this Policy or how we handle personal data, contact us using the details above.

2) What Data We Collect

We may collect and process the following categories of personal data:

  • Identity Data: first and last name.

  • Contact Data: email address, phone number, billing address.

  • Booking Data: selected service, date/time preferences, staff preference, notes you provide.

  • Communication Data: messages sent via contact forms, email, phone, WhatsApp or social media.

  • Transaction Data: appointment records, amounts, currency, payment status. (We do not store full card details; these are processed by our payment provider when applicable.)

  • Technical & Usage Data: IP address, device and browser information, pages viewed, referring pages, session duration, and interactions on the Website.

  • Cookie & Analytics Data: information collected via cookies and similar technologies (see Cookies section).

We do not intentionally collect special categories of data (e.g., health data) via the Website. Please do not share sensitive information in free‑text fields. Any wellness or massage preferences you choose to share are processed solely to provide the requested service.

3) How We Use Your Data (Purposes & Legal Bases)

We process personal data only when a GDPR legal basis applies:

  1. To provide and manage bookings and services (e.g., confirm, reschedule, or cancel appointments; send reminders).
    Legal basis: Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) to run our business efficiently.

  2. To respond to enquiries and provide customer support.
    Legal basis: Legitimate interests in responding to queries and improving service quality.

  3. To process payments where applicable (through third‑party payment processors).
    Legal basis: Performance of a contract and legal obligations (accounting/tax).

  4. To send appointment reminders and important service messages (e.g., time changes, closures).
    Legal basis: Performance of a contract and legitimate interests.

  5. To send marketing communications (news, offers, updates) when you opt in.
    Legal basis: Consent (Art. 6(1)(a)). You may withdraw consent at any time.

  6. To maintain Website functionality, security, and analytics (e.g., load balancing, preventing abuse, measuring performance).
    Legal basis: Legitimate interests (secure and useful Website) and consent for non‑essential cookies where required.

  7. To comply with legal obligations (e.g., tax, accounting, regulatory compliance).
    Legal basis: Legal obligation (Art. 6(1)(c)).

4) How We Share Data

We share personal data only as necessary and with safeguards:

  • Service providers / processors: hosting and IT support, appointment/booking software, email/SMS providers, payment processors, analytics and cookie providers, security tools, and website platforms (e.g., WordPress plugins). They act under our instructions and appropriate contracts.

  • Professional advisors: accountants, auditors, legal counsel (where necessary).

  • Authorities: where required by law or to protect our rights, users, or the public.
    We do not sell personal data.

5) International Transfers

If personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards (e.g., adequacy decisions, Standard Contractual Clauses, supplementary measures) in accordance with GDPR.

6) Data Retention

We keep personal data only as long as necessary for the purposes described above:

  • Bookings & service records: typically up to 24 months after your last appointment, unless longer is required for legal claims.

  • Invoices & transaction data: retained for the period required by tax/accounting law.

  • Marketing data: until you unsubscribe or withdraw consent.

  • Technical logs & analytics: retained for a limited period necessary for security and performance analysis.
    When retention periods expire, we delete or anonymise data securely.

7) Your Rights Under GDPR

You have the right to:

  • Access your personal data and obtain a copy.

  • Rectify inaccurate or incomplete data.

  • Erase data in certain circumstances (“right to be forgotten”).

  • Restrict processing in certain cases.

  • Object to processing based on legitimate interests or to direct marketing.

  • Portability of data you provided to us, where processing is based on consent or contract and carried out by automated means.

  • Withdraw consent at any time, where processing is based on consent (withdrawal does not affect prior lawful processing).
    To exercise your rights, contact us at [Privacy/Support Email]. You also have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC), Malta or your local supervisory authority.

8) Cookies & Similar Technologies

We use cookies and similar technologies to run the Website, enhance functionality, and measure performance. Categories may include:

  • Strictly necessary cookies (essential for core functions such as security and session management).

  • Functional cookies (remembering preferences like language or location).

  • Analytics cookies (understanding how visitors use the Website).

  • Marketing/advertising cookies (only if we run ads or social media pixels).

Where required, we use a cookie banner/manager so you can accept or reject non‑essential cookies and adjust your preferences at any time. For more details, see our Cookie Notice (or the cookie settings panel) for a current list of cookies and providers.

9) Third‑Party Services We May Use

Depending on the features enabled on the Website, we may integrate services such as:

  • Website platform & hosting (e.g., WordPress and hosting providers)

  • Booking software (to schedule and manage appointments)

  • Email/SMS providers (for confirmations and reminders)

  • Payment processors (e.g., Stripe/PayPal — we do not store card details)

  • Analytics (e.g., Google Analytics with IP anonymisation where feasible)

  • Security & performance (e.g., firewalls, DDoS protection, caching/CDN)

  • Maps & fonts (e.g., Google Maps embeds, web fonts)

  • Social media widgets or messaging links (e.g., Facebook/Instagram, WhatsApp)
    Each provider processes data under its own terms and privacy notices. We take steps to minimise data sharing and enable privacy‑protective settings where possible.

10) Children’s Privacy

Our services are intended for adults. We do not knowingly collect personal data from children under the age of 16 without parental/guardian consent. If you believe a child has provided personal data to us, please contact us and we will take appropriate steps to delete such data.

11) Data Security

We implement technical and organisational measures to protect personal data from unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure.

12) Links to Other Websites

Our Website may contain links to third‑party websites. We are not responsible for their privacy practices. We encourage you to read the privacy policies of any site you visit.

13) Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised “Last updated” date. We encourage you to review this page periodically.

14) Contact Us

For questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact:

[Business Name]
Email: [Privacy/Support Email]
Address: [Address, City, Country]
Phone: [Phone Number]

Quick Summary (Plain Language)

  • We collect only what we need to manage bookings, provide services, and keep the Website running.

  • We don’t sell your data. We share it with trusted providers only when necessary.

  • You control your marketing choices and cookies (non‑essential cookies require consent).

  • You can ask to access, correct, delete, or download your data. Contact us any time.

Implementation Notes (remove this section before publishing)

  • Replace all [bracketed placeholders] with your actual details.

  • If you do not accept online payments or use certain third‑party tools, remove the corresponding references.

  • Publish a Cookie Notice or ensure your cookie consent tool lists all active cookies/providers.

  • Keep a log of data retention periods and your processors (Data Processing Register).