The short version
- We only ask for what we need to handle your appointment or stay request: your name, phone/WhatsApp number, and either your treatment and preferred time or your studio, dates and number of guests.
- We don't take payments on this website and we don't ask for card or M-Pesa details here.
- We don't sell your details. They're used to confirm and manage your booking and to contact you about it.
- Please don't put medical details in the booking form — tell your therapist directly instead.
- You can ask to see, correct or delete your details at any time.
1. Who we are
This website is run by Lincy's Spa & Massage Parlour ("Lincy's Spa", "we", "us"), located inside Tsavo Coral Bells, Thindigua, Kiambu, Kenya. We are the data controller for the personal data described in this policy, meaning we decide how and why it is used.
Our contact details are in section 12.
2. What we collect
| When | What we receive |
|---|---|
| You use the booking form | Your full name, phone/WhatsApp number, chosen treatment, preferred date and time, and anything you choose to write in the notes box. |
| You use the stay request form | Your full name, phone/WhatsApp number, chosen studio, check-in and check-out dates, number of guests, and anything you choose to write in the notes box. |
| You tap a treatment's booking button | The treatment you chose and the time you tapped it. No name or phone number is recorded at that point. |
| You message us on WhatsApp, by phone or by email | Your phone number or email address and whatever you tell us in the conversation. |
| You visit the website | Standard technical data such as IP address, browser type and pages visited, collected by our hosting provider and by the Google services described in section 6. |
Health information. Details about your health are sensitive personal data. The booking form does not ask for any, so please don't enter medical details in the notes box. If something affects your treatment (an injury, pregnancy, allergy to oils or scrubs), tell your therapist in person or by message so we can look after you properly.
What we don't collect. We don't take payments through this website, so we never receive your card or mobile-money details here. There are no user accounts.
3. Why we use it
- To handle your booking or stay request — reading your request, checking availability, confirming or rescheduling your slot, and reaching you if something changes. This is needed to take the steps you've asked for.
- To keep a simple record of bookings — so appointments aren't double-booked and we can see which treatments are popular.
- To answer your questions when you contact us.
- To keep the website working and secure.
By submitting the booking form or messaging us, you consent to us using your details for these purposes. You can withdraw that consent at any time (see section 9). We will not use your details for marketing messages unless you ask us to, and we don't sell or rent them to anyone.
5. Transfers outside Kenya
The providers above run servers in several countries, so your data may be processed outside Kenya. Where this happens we rely on providers that apply recognised security safeguards, and by using the booking form or messaging us you agree to this. If you'd rather not have your details handled this way, you can book by phone call instead, and tell us when you do.
7. How long we keep it
We keep booking and stay-request records for up to 12 months after your appointment date, then delete them. We may keep a record for longer only if the law requires it or if it's needed to resolve a dispute. WhatsApp chats stay on our phone until we delete them, and we aim to clear old booking conversations within the same period.
8. Keeping it safe
We take reasonable steps to protect your data: the website is served over HTTPS, our booking record is kept in a private spreadsheet that only authorised staff can open, and we don't share its access with anyone else. No method of transmission or storage is completely secure, so we can't guarantee absolute security. If a breach ever puts your data at risk, we will tell you and the Office of the Data Protection Commissioner as the law requires.
9. Your rights
Under the Kenya Data Protection Act, 2019 you have the right to:
- be told how your data is being used (this policy);
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or out of date;
- ask us to delete your data;
- object to, or ask us to restrict, how we use your data;
- ask for your data in a portable format, where this applies; and
- withdraw your consent at any time. This won't affect anything we did before you withdrew it.
To use any of these rights, contact us using the details in section 12. We may need to confirm who you are first, and we'll respond within the time the law allows.
If you're unhappy with how we've handled your data, you have the right to complain to the Office of the Data Protection Commissioner (ODPC) in Kenya: www.odpc.go.ke. We'd appreciate the chance to put things right first.
10. Children
Our services and this website are intended for adults aged 18 and over. We don't knowingly collect personal data from anyone under 18 through this site. If you believe a child has sent us their details, contact us and we'll delete them.
11. Changes to this policy
We may update this policy from time to time, for example if we add a new service to the site. The date at the top shows when it was last changed. If we make a significant change, we'll make it clear on the website.
12. Contact us
For questions about this policy or to exercise your rights:
Lincy's Spa & Massage Parlour
Inside Tsavo Coral Bells, Thindigua, Kiambu, Kenya
WhatsApp / phone: 0708 787 150
See also our Terms & Conditions.