Last updated: 27 September 2026
This policy explains how Whispering Wood Spa ("we", "us") collects and uses personal information about you when you visit https://whisperingwoodspa.co.uk/, contact us, book an appointment, buy from us or otherwise deal with us, and the rights you have over that information.
Who we are
Whispering Wood Spa is responsible for your personal information (the "controller").
- Address: Surrey Hills, Surrey, United Kingdom
- Email: reception@whisperingwoodspa.co.uk
- Phone: 01483 664860
For anything about your personal information, please contact Katie Cheeseman at katie@whisperingwoodspa.co.uk.
The information we collect
We only collect the information we need. Depending on how you deal with us, it can include:
- Contact details: your name, email address, phone number and delivery and billing address.
- Your messages: what you write to us through the contact form on our website, email, phone, messaging apps or social media, and our replies.
- Booking details: the appointments you book, change or cancel, the services and staff involved, and the payments and deposits you make.
- Order details: what you buy, payments and refunds, delivery details and any correspondence about your order. Card details are handled by our payment provider; we do not see or store your full card number.
- Marketing preferences: whether you have agreed to receive our emails, and whether you open them.
- Health information needed for your treatment: for example allergies, skin conditions, medication, pregnancy or medical conditions that affect whether a treatment is safe for you.
- Technical information: when you visit our website, the servers that run it record your IP address, browser and the pages requested, to deliver the website and keep it secure. See our Cookie Policy for cookies and similar technology.
Most of this information comes from you. We may also receive it from others: someone who books an appointment for you, our payment provider (confirming your payment), and the services listed under "Who we share it with" when they act for us.
Why we use it, and our legal basis
Data protection law only allows us to use personal information when we have a legal reason (a "lawful basis"). This is what we use your information for, and the basis for each use:
| What we do | Lawful basis |
|---|---|
| Answer your questions and requests | Taking steps you ask for before a contract, where you ask about our services; otherwise our legitimate interest in replying to the people who contact us |
| Take, manage and remind you of your bookings, and take deposits and payments | Performing our contract with you |
| Process and deliver your orders, handle returns and refunds | Performing our contract with you |
| Check that a treatment is safe and suitable for you | Your explicit consent to our use of the health information you give us (UK GDPR Article 9(2)(a)). If you do not give it, we may not be able to carry out some treatments |
| Send you news and offers by email | Your consent; or, where you are an existing customer, our legitimate interest in telling you about similar services, with a way to refuse in every email |
| Run our website and keep it and your information secure | Our legitimate interest in providing a working, secure website |
| Keep accounting and tax records | Complying with our legal obligations |
| Deal with complaints and legal claims, and protect our business | Our legitimate interest in defending our business; complying with our legal obligations |
| Measure how our website is used, and advertise, where you allow it | For the privacy-friendly statistics described in our Cookie Policy, our legitimate interest in improving our website (you can switch them off at any time); for everything else, your consent |
Health information is a "special category" of personal information, which the law protects more strictly. Only the people who need it for your care can see it, and we never use it for marketing.
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects for you.
Do you have to give us your information?
We need the information marked as required in our forms to take your booking or process your order; without it we cannot provide the service. Everything else you give us is your choice.
Who we share it with
We do not sell your personal information. We share it only with:
- Service providers who work for us, only as much as they need and under contracts that require them to protect it. These are:
- Website hosting (Make My Web): Hosts our website and the information it holds. Location: Austria (Vienna).
- Meta Pixel (Meta Platforms Ireland): Measures our Facebook and Instagram adverts, only if you allow it. Location: EU and USA. Their privacy policy.
- Google Maps (Google): Maps shown on our website, after you allow them. Location: EU and USA. Their privacy policy.
- Umami (Umami): Privacy-friendly visit statistics, without cookies. Location: EU.
- Professional advisers such as our accountants, lawyers and insurers, when they need it to advise us.
- Authorities such as tax authorities, regulators, courts or the police, when the law requires us to.
- A buyer of our business, if we sell or transfer it, who would then be responsible for your information under this policy.
Transfers outside the UK
Some of the service providers above store or access information outside the UK. When they do, the transfer is protected in one of the ways the law allows:
- Meta Pixel (EU and USA): the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework).
- Google Maps (EU and USA): the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework).
You can ask us for more information about these safeguards, or a copy of them, using the contact details in "Who we are".
How long we keep it
We keep your information only as long as we need it for the reasons above, then delete it or make it anonymous:
- Enquiries that do not lead to a booking or order: 2 years after our last contact with you.
- Booking records: 2 years after your last appointment.
- Payment, invoice and other accounting records: 6 years from the end of the financial year they relate to, as tax law requires.
- Health information for your treatments: 6 years after your last treatment.
- Email marketing: until you unsubscribe. We then keep your email address on a "do not contact" list so we respect your choice.
- Website server logs: a short period for security, normally no more than a few weeks.
We may keep information longer if we need it for a complaint or a legal claim.
Your rights
You have the right to:
- access your personal information and get a copy of it;
- have inaccurate information corrected and incomplete information completed;
- have your information deleted in some circumstances;
- restrict how we use it in some circumstances;
- object to our use of it where we rely on our legitimate interests, and at any time to direct marketing;
- receive the information you gave us in a portable format, or have it sent to another organisation (data portability), where we use it by consent or under a contract and by automated means;
- withdraw your consent at any time, where we rely on it. This does not affect what we did before you withdrew it.
To use any of these rights, contact us using the details in "Who we are". We will reply within one month. We may need to confirm who you are first, and in some cases we can extend the time limit by up to two more months, in which case we will tell you why. You do not normally have to pay.
Complaints
If you are unhappy with how we have used your personal information, you have the right to complain to us. Please contact us at katie@whisperingwoodspa.co.uk or use our complaint form. We will acknowledge your complaint within 30 days, look into it, keep you informed and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to deal with your concern first.
Marketing
We only send you marketing emails if you have agreed to receive them, or if you are a customer and did not refuse when you gave us your details, in which case we only tell you about services similar to the ones you have used. Every email has a link to unsubscribe, and you can also tell us at any time. Unsubscribing is free.
Cookies
Our website uses cookies and similar technology. Our Cookie Policy explains which ones, why, and how to change your choices.
Children
Our services are for adults. We do not knowingly collect information from children under 13 through our website. If you think a child has given us information, please contact us and we will delete it.
Keeping your information safe
We use appropriate technical and organisational measures to protect your information, including encrypted connections to our website, access limited to the people who need it, and extra safeguards for health information. If a breach happens that is likely to put your rights at high risk, we will tell you.
Changes to this policy
We update this policy when the law or the way we use information changes. The date at the top shows when it last changed. If we make a significant change, we will tell you on our website or by email.