Business Name: Nistiri Vibes

Location: Burton-on-Trent, Staffordshire, United Kingdom

Contact: nistirivibes@gmail.com | +44 7886 745087

For any questions or concerns regarding your personal data or this Privacy Policy, please contact us using the details above.

Booking Information:

• Full name
• Email address
• Telephone number
• Appointment date and time preferences
• Service preferences (e.g., massage oil selection)
• Special requests or health notes

Account Information (for registered users):

• First name and surname
• Email address
• Phone number
• Gender (optional)
• Date of birth (optional, for birthday rewards)
• Preferred massage oil

Health Information:

• Health conditions, allergies, or contraindications relevant to massage therapy
• Any special requirements or concerns

Feedback and Reviews:

• Session ratings and feedback
• Testimonials (only published with your explicit consent)
• Business ratings and comments

• Website usage data (pages visited, time spent, navigation patterns)
• Device information (browser type, operating system, device type)
• IP address and approximate location data
• Cookies and similar tracking technologies (see Section 10)

• Membership subscription payments and online session payments (processed securely through Stripe Payment Links; we do not store full card details). Session payments may alternatively be collected in cash on the day of the appointment
• Booking history and transaction records
• Nistiri Loyalty session count and reward history
• Booking dates (used to determine eligibility for Bank Holiday & Special Day discounts)

4.1 Contract Performance: Processing necessary to fulfil our service contract with you (booking and providing massage therapy services).

4.2 Consent: Where you have given explicit consent (e.g., marketing communications, testimonial publication).

4.3 Legitimate Interests: For business operations, fraud prevention, and improving our services, where not overridden by your rights.

4.4 Legal Obligation: Where required by law (e.g., tax records, health and safety regulations).

5.1 Service Provision:

• Processing and managing bookings
• Providing massage therapy services
• Sending appointment confirmations and reminders
• Managing health and safety requirements

5.2 Account Management:

• Creating and maintaining user accounts
• Managing the Nistiri Loyalty rewards programme
• Tracking booking history and preferences
• Processing birthday rewards

5.3 Communication:

• Responding to enquiries and requests
• Sending service updates and important notices
• Processing feedback and complaints
• Marketing communications (only with your consent)

5.4 Business Operations:

• Payment processing and financial record-keeping
• Fraud prevention and security
• Analysing and improving our services
• Legal compliance and regulatory requirements

6.1 Service Providers:

• Payment processors (Stripe) for membership subscription payments and online session payments (session payments may alternatively be cash-on-the-day)
• Email service providers for appointment confirmations and communications
• Website hosting and technology platforms (Base44)
• Analytics providers (anonymised data only)

6.2 Legal Requirements:

• When required by law or legal process
• To protect our rights, property, or safety
• To enforce our Terms and Conditions
• With professional advisers (lawyers, accountants) under confidentiality obligations

6.3 Business Transfers:

In the event of a business sale, merger, or acquisition, your data may be transferred to the new owner under equivalent privacy protections.

7.1 Booking and Health Records: Retained for 7 years from the date of last service (in line with professional insurance and regulatory requirements).

7.2 Account Information: Retained for the duration of your account plus 1 year after account closure or inactivity.

7.3 Financial Records: Retained for 6 years (UK tax law requirement).

7.4 Marketing Consent: Until you withdraw consent or we no longer use the data for marketing purposes.

7.5 Website Analytics: Typically retained for 26 months in anonymised form.

After the retention period, data is securely deleted or anonymised.

8.1 Right to Access: Request a copy of your personal data we hold.

8.2 Right to Rectification: Request correction of inaccurate or incomplete data.

8.3 Right to Erasure: Request deletion of your data (subject to legal retention requirements).

8.4 Right to Restrict Processing: Request limitation on how we use your data.

8.5 Right to Data Portability: Receive your data in a structured, commonly used format.

8.6 Right to Object: Object to processing based on legitimate interests or for marketing purposes.

8.7 Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

8.8 Right to Lodge a Complaint: Contact the Information Commissioner's Office (ICO) if you believe your rights have been violated.

To exercise any of these rights, please contact us at nistirivibes@gmail.com.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (SSL/TLS)
• Secure password-protected user accounts
• Regular security assessments and updates
• Restricted access to personal data (need-to-know basis)
• Staff training on data protection and confidentiality
• Secure backup systems

Whilst we take all reasonable steps to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but continually work to maintain industry best practices.

10.1 What Are Cookies: Small text files stored on your device to improve website functionality and user experience.

10.2 Types of Cookies We Use:

• Essential Cookies: Necessary for website functionality (e.g., login, booking system)
• Performance Cookies: Help us understand how visitors use our website (anonymised data)
• Functionality Cookies: Remember your preferences and settings

10.3 Managing Cookies: You can control and delete cookies through your browser settings. Note that disabling essential cookies may affect website functionality.

11.1 Third-Party Links: Our website may contain links to third-party websites (e.g., donation platform, social media). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

11.2 Website Imagery: With the exception of our logo, the images used on our website are placeholders. They are copyright-free and are used as visual representations of our various services and options. They are not necessarily real representations of what we currently use, offer, or do at our premises. These images contain no personal data relating to our guests.

14.1 Consent: We will only send marketing emails if you have opted in or as permitted by law.

14.2 Content: Marketing communications may include special offers, new services, and wellness tips.

14.3 Opt-Out: You can unsubscribe at any time using the link in our emails or by contacting us directly.

14.4 Transactional Emails: Booking confirmations and service-related emails are not marketing and cannot be opted out of whilst using our services.

Contact Us:

For any questions, concerns, or to exercise your rights regarding your personal data, please contact us:

• Email: nistirivibes@gmail.com
• Phone: +44 7886 745087
• Address: Nistiri Vibes, Burton-on-Trent, Staffordshire, United Kingdom

ICO Complaint:

If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF