This policy explains how Blue Lagoon Massage handles your personal data.
Who we are
- Data controller
- Blue Lagoon Massage Spa E.E. (a limited partnership), trading as Blue Lagoon Massage
- VAT no. (AFM)
- 802838015
- GEMI no.
- 183691420000
- Address
- Afstralias 114, 851 00 Rhodes, Greece
- rhodes007.olga@gmail.com
- Phone
- +30 694 289 9274
What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, phone number, chosen massage and time when you book online | Managing your appointment and contacting you about it | Steps before a contract and performance of a contract, Art. 6(1)(b) |
| Name, phone number and message content when you contact us | Answering your enquiry and arranging an appointment | Steps before a contract, Art. 6(1)(b) |
| Payment reference if a deposit is requested | Confirming your booking. Card details are handled by Stripe and are not stored on our website | Performance of a contract, Art. 6(1)(b) |
| Technical data and server logs | Security and operation of the website | Legitimate interests, Art. 6(1)(f) |
| Analytics and advertising data | Statistics and ad measurement | Consent, Art. 6(1)(a) |
Online bookings are stored on our website and sent to us by email. If you choose to send your booking on WhatsApp, the message is handled by WhatsApp under its own privacy policy.
Please do not send us health information unless it is needed for your treatment. If you tell us about a health condition so that we can adapt a massage, we use it only for that purpose, based on your explicit consent, Art. 9(2)(a).
How long we keep your data
We keep booking and contact data only as long as we need it to manage your appointment and answer your enquiries, and longer only where the law requires it, for example for tax records. Cookie lifetimes are listed in our Cookie Policy.
Who receives your data
- Hostinger: website hosting and server logs
- Google: email, Google Tag Manager, Google Ads and analytics
- WhatsApp: messaging, if you choose to contact us there
- Stripe: payments, if a deposit is requested
- Yandex: website statistics, only if you accept analytics cookies
Our pages also load some files from content delivery networks, which receive your IP address when delivering those files. We do not sell your personal data.
Transfers outside the EEA
Some providers may process data outside the European Economic Area. Where this happens, the transfer relies on a safeguard allowed by the GDPR, such as an adequacy decision or standard contractual clauses, or on your explicit consent. Yandex is based in Russia, which has no EU adequacy decision, so analytics data may be processed there if you accept analytics cookies.
Your rights
You can ask for access, correction, deletion, restriction or a copy of your data, and you can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time. To use these rights, write to rhodes007.olga@gmail.com.
You can also complain to the Hellenic Data Protection Authority (HDPA), 1-3 Kifisias Avenue, 115 23 Athens, www.dpa.gr.
Changes
We may update this policy. The date at the top shows the latest version.