KUBU SPA & WELLNESS LTD (“KUBU”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share your personal information when you visit our website, make a booking, purchase a gift voucher, contact us, subscribe to marketing communications or receive treatments and services at our salon.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

The organisation responsible for your personal information is:

KUBU SPA & WELLNESS LTD
Company registration number: 17330918
Registered office: 2 Mountside, Stanmore, Middlesex HA7 2DT, United Kingdom
Email: info@kubuspa.com
Telephone: 01491 414130
VAT registration number: 526 208896

KUBU SPA & WELLNESS LTD is the data controller for the personal information described in this policy.

Our salon location

Henley-on-Thames
16 Bell Street
Henley-on-Thames
Oxfordshire
RG9 2BG
United Kingdom

2. Personal information we collect

The information we collect depends on how you interact with us.

Contact and identification information

This may include your name, email address, telephone number, address, date of birth where required, and your communication preferences.

Booking and treatment information

When you make a booking or receive a treatment, we may collect information relating to your appointments, treatment history, preferences, consultations, consent and aftercare.

Where relevant to treatment safety and suitability, this may include information about allergies, medical conditions, medications, contraindications, skin concerns and other health-related information you choose to provide.

Some of this information may constitute special category personal data under UK data protection law. We will only process it where we have an appropriate lawful basis and an applicable condition for processing special category data.

Payment and gift voucher information

When you purchase a treatment or gift voucher, we may collect transaction details, purchase amounts, voucher references and relevant purchaser or recipient information.

Payments may be processed by Stripe or other payment providers used in connection with our services.

Website and technical information

When you visit our website, we may collect technical and usage information, including:

• IP address and general device or browser information.
• Pages visited and how you arrived at our website.
• Interactions with website features.
• Referring websites and traffic sources.
• Cookie preferences and consent records.
• Website performance and security information.

Google Analytics tracking is subject to the consent arrangements described in this policy.

3. How we collect your information

We may collect information when you:

• Visit our website.
• Make or manage an online booking.
• Create or use a client account.
• Purchase an online gift voucher.
• Contact us by telephone, email, social media or website forms.
• Complete a consultation, consent or treatment form.
• Attend our salon or receive a treatment.
• Subscribe to marketing communications.
• Respond to our messages or interact with our services.

We may also receive information through the service providers that support our bookings, payments, communications and website.

4. How we use your information

We use personal information where necessary to:

• Manage appointments and bookings.
• Provide treatments and services.
• Assess treatment suitability and safety.
• Maintain client, consultation and treatment records.
• Record consent and relevant treatment information.
• Provide appropriate aftercare.
• Send appointment confirmations, reminders and service updates.
• Process payments and administer gift vouchers.
• Respond to enquiries and customer service requests.
• Manage client accounts and preferences.
• Send marketing communications where legally permitted.
• Understand how visitors use our website.
• Maintain website and business security.
• Prevent fraud and misuse.
• Comply with legal and regulatory obligations.
• Handle complaints, disputes and legal claims.

We only use personal information for purposes that are appropriate and lawful.

5. Our lawful bases for processing

Under UK GDPR, we must have a lawful basis for processing personal information. Depending on the circumstances, we may rely on the following.

Contract: where processing is necessary to manage a booking, provide a treatment, process a gift voucher or fulfil a service you have requested.

Legal obligation: where we need to process information to comply with applicable legal or regulatory requirements.

Legitimate interests: where processing is necessary for our legitimate business interests, such as managing our business, improving services, maintaining security or handling enquiries, provided these interests do not override your rights and freedoms.

Consent: where you have given consent for a particular purpose, such as certain marketing activities or the use of non-essential analytics cookies.

Health and treatment-related information

Where we process health-related information or other special category data, we will identify an applicable condition under UK GDPR Article 9 and, where relevant, any additional requirements under UK law.

Depending on the circumstances, this may include your explicit consent or another legally applicable condition.

We will not assume that agreeing to a treatment automatically provides consent for every separate use of your health-related information.

6. Marketing communications

We may send you information about KUBU, including new treatments, offers, promotions, events, memberships, gift vouchers and salon news.

We will send marketing communications only where we have an appropriate lawful basis and comply with applicable electronic marketing rules.

You can unsubscribe from marketing emails by using the unsubscribe link in the message or contacting info@kubuspa.com.

Unsubscribing from marketing will not prevent us from sending essential service communications, such as appointment confirmations, reminders or information relating to an existing booking.

We use Phorest to support our client communications and marketing activities.

7. Phorest — bookings, client records and gift vouchers

We use Phorest as our salon management and client experience platform.

Phorest may process personal information on our behalf for purposes including:

• Online bookings and appointment management.
• Client profiles and contact details.
• Consultation and consent forms.
• Treatment and appointment history.
• Appointment confirmations and reminders.
• Marketing communications.
• Online gift voucher purchases and administration.
• Other salon management functions.

We take reasonable steps to ensure that service providers processing personal information on our behalf are subject to appropriate data protection and security arrangements.

8. Stripe and payment processing

We use Stripe to process payments where applicable.

When you make a payment, relevant transaction and payment information may be processed by Stripe in accordance with its own privacy policy and terms.

We do not generally store full payment card details ourselves.

Stripe may process certain information as an independent controller for some purposes. Its own privacy documentation explains how it handles personal information.

9. Online gift vouchers

Online gift vouchers are processed through Phorest.

To process and administer gift vouchers, we may collect purchaser and recipient details, contact information, transaction records and voucher references.

Payment information may be processed by Stripe or the relevant payment provider.

We use this information to issue vouchers, manage purchases, respond to enquiries and administer voucher-related transactions.

10. Google Analytics and website usage

We use Google Analytics to help us understand how visitors use the KUBU website and to improve its performance and user experience.

Google Analytics may collect information about:

• Website visits and page views.
• How visitors arrive at our website, including through search engines and social media.
• Interactions with website features.
• Clicks on booking, telephone, email and gift voucher links.
• Interactions with treatment enquiry or sign-up features, where configured.
• General device, browser and technical information.

Google Analytics uses cookies or similar technologies to collect and analyse website usage information.

Analytics tracking will only be activated where the required consent has been provided through our cookie consent mechanism. Visitors can reject non-essential analytics cookies and can change their preferences through the “Cookie settings” link in our website footer.

Rejecting analytics cookies may mean that we cannot measure all website visits or interactions. Analytics information may be processed by Google in accordance with its applicable terms and privacy documentation.

Further information is available at:

• Google Privacy Policy: https://policies.google.com/privacy
• Google Analytics information: https://support.google.com/analytics/answer/6004245

11. Cookies and cookie preferences

Our website may use cookies and similar technologies to operate correctly, remember preferences, maintain security and understand website usage.

These may include:

• Essential cookies: required for core website functionality or security.
• Analytics cookies: used to understand website visits and interactions.
• Other non-essential cookies: if additional functionality or tracking tools are introduced.

Where consent is legally required, non-essential cookies and similar tracking technologies will only be activated after you have provided the required consent.

Our cookie consent mechanism will provide options to accept or reject non-essential tracking, and you can revisit your choice through the “Cookie settings” link in the website footer.

You can also manage cookies through your browser settings. Blocking certain cookies may affect some website functionality.

12. Who we share information with

We may share personal information with trusted third parties where necessary to operate our business and provide our services.

These may include:

• Phorest for bookings, client records, gift vouchers and communications.
• Stripe for payment processing.
• Google Analytics for website analytics, subject to the applicable consent arrangements.
• Website hosting, maintenance and technical support providers.
• Email and communications service providers.
• Professional advisers, including accountants and legal advisers.
• Insurers where necessary.
• Regulators, law enforcement or public authorities where required by law.
• Other service providers where necessary for legitimate business purposes.

We do not sell your personal information to third parties.

Where a provider processes personal information on our behalf, we will take reasonable steps to ensure that appropriate contractual and security safeguards are in place.

13. International transfers

Some service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with applicable UK data protection legislation. This may include relying on an adequacy regulation or decision, appropriate contractual safeguards or another lawful transfer mechanism.

Further information about relevant safeguards can be requested by contacting us.

14. How long we keep your information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining appropriate client records, complying with legal obligations and resolving disputes.

Retention periods may differ depending on the type of information, the nature of the treatment, applicable legal requirements and the need to establish or defend legal claims.

When personal information is no longer required, we will take appropriate steps to securely delete it or anonymise it, subject to any legal obligations to retain it.

15. How we protect your information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, disclosure or destruction.

Access to client information is limited to people who need it for legitimate business or treatment-related purposes.

Although we take reasonable steps to protect personal information, no electronic storage system or internet transmission can be guaranteed to be completely secure.

16. Your data protection rights

Depending on the circumstances, you may have the right to:

• Be informed about how your personal information is used.
• Request access to your personal information.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information in certain circumstances.
• Request restriction of processing in certain circumstances.
• Object to certain processing.
• Request transfer of certain information in a portable format where the right applies.
• Withdraw consent where processing is based on consent.
• Make a complaint to the Information Commissioner’s Office (ICO).

These rights are subject to legal conditions and exceptions, so they may not apply in every situation.

To exercise your rights, please contact us at info@kubuspa.com or call 01491 414130.

We may need to verify your identity before responding to a request.

17. Children’s information

Our services are primarily intended for adults. Where we provide treatments or services to individuals under 18, we may require appropriate parental or guardian involvement and consent depending on the treatment and circumstances.

We will handle children’s personal information in accordance with applicable data protection requirements and will not use it for marketing where doing so would be unlawful.

18. Complaints and the ICO

If you have concerns about how we collect or use your personal information, please contact us in the first instance:

KUBU SPA & WELLNESS LTD
Email: info@kubuspa.com
Telephone: 01491 414130

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator.

Website: https://ico.org.uk/

We recommend contacting us first so we can try to address your concerns, but you are entitled to contact the ICO directly.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, systems, legal obligations or data processing practices.

The latest version will be published on our website with its updated date.

20. Contact us

For questions about this Privacy Policy or how we handle your personal information, please contact:

KUBU SPA & WELLNESS LTD
2 Mountside
Stanmore
Middlesex
HA7 2DT
United Kingdom
Email: info@kubuspa.com
Telephone: 01491 414130
Company number: 17330918
VAT registration number: 526 208896

Last updated: 20 October 2026