Privacy Policy

This policy explains how Spa Simple Ltd (“Spa Simple”, “we”, “us”) collects and uses personal information when you use our website, contact us, book a service or join a service plan. We are the controller of this information.

For any privacy question or request, email service@spasimple.co.uk, call 01275 401140 or write to our registered office.

Service enquiries and bookings. When you use our enquiry form we collect your name, email address, telephone number, postcode, hot tub or swim spa brand, the service you need, your preferred contact method and any notes you give us about faults.

Service plan sign-ups. New website Bronze, Silver and Gold signups and checkout are currently blocked. Existing signup and subscription administration records may contain your full name, email, telephone, service address, town and postcode, optional spa make and model, the plan chosen, a signup reference, and the version and time of any terms you accepted.

Online appointment bookings. Our Book Online buttons open Koalendar as an external booking service in a new tab; the website does not embed a booking widget. If you book an appointment online we use Koalendar. Koalendar is used to let you choose an available appointment, send you an automatic booking confirmation email and send you a reminder the day before. When you book through Koalendar, the details you enter on the booking form (such as your name and email address, and any other details the form asks for) and the appointment you choose are processed by Koalendar and made available to us.

Payments. Plan payments are taken by Stripe. We receive your name, email, plan, subscription and payment status, payment dates and payment method type (for example “card” or “Bacs Direct Debit”). We do not receive or store full card or bank account details.

Invoicing and accounting. For one-off servicing and repair work we normally send invoices through QuickBooks after the visit. This involves your name, billing and service address, email address, telephone number (where needed), a description of the work carried out, invoice amounts, payment due dates, payment status and payment history. Each invoice includes a secure card payment link and our bank details for payment by bank transfer. We do not store full card details on our website or in our own records; if you pay by bank transfer we receive the payment information shown in our bank records (such as the payer name, amount, date and reference).

Email delivery records. We keep a record of whether our automated emails to you and to our team were accepted for delivery, with the recipient, email type, a provider reference and any error message. Acceptance for delivery is not proof that an email was received.

Security and anti-spam data. To stop spam and abuse we use Cloudflare Turnstile (see section 6), a hidden anti-bot field, a submission identifier for duplicate protection, and rate limiting based on a one-way scrambled (hashed) version of your IP address. The hash is pseudonymous data, not automatically anonymous. Cloudflare receives the original IP address when available for its security verification. With an enquiry we also store that hashed IP value and your browser’s user-agent description.

Correspondence. Emails, calls, WhatsApp messages, photos and videos you send us, and our servicing and repair records.

Marketing. If you subscribe to our emails, your email address, name (if given), consent details and your subscription or unsubscribe status.

• Responding to enquiries and arranging visits — steps at your request before a contract, and performance of a contract.
• Carrying out servicing, repairs and service plans, including taking payments and tracking plan entitlements — performance of a contract.
• Taking online appointment bookings and sending booking confirmations and day-before reminders (through Koalendar) — steps at your request before a contract, and performance of a contract.
• Sending automated confirmations of enquiries — legitimate interests in confirming we received your request.
• Website security, spam prevention and duplicate-submission protection — legitimate interests in keeping our services secure.
• Creating and sending invoices and collecting payment for work carried out (including through QuickBooks) — performance of a contract.
• Keeping business, tax and accounting records (including in QuickBooks) — legal obligation.
• Following up unpaid invoices and reconciling payments — performance of a contract and our legitimate interests in being paid for work carried out.
• Handling disputes, refunds and claims — legitimate interests.
• Marketing emails — consent where applicable, or an appropriate separately assessed UK GDPR lawful basis (such as legitimate interests) where the PECR soft opt-in conditions described in section 4 are met. The soft opt-in is marketing permission under PECR, not itself a UK GDPR lawful basis.

Marketing is separate from service enquiries. Contacting us, making an enquiry or booking a service does not add you to our marketing list.

We send marketing emails only where we have your permission, or where the law allows us to contact existing customers about similar services and you have been given a simple way to refuse. Our marketing emails are currently sent using EmailOctopus.

You can unsubscribe using the link in any marketing email or by contacting us. Unsubscribing does not affect service messages about bookings or plans. After you unsubscribe we keep a minimal record of your email address and opt-out so that we do not contact you again by mistake.

We do not sell your information. We share it only with service providers who help us run our business, and only as needed:

• Lovable / Lovable Cloud — hosts this website, processes transactional email requests through its connector service to Resend, and provides the secure database holding enquiries, plan sign-up and payment-status records, accessible only to authorised Spa Simple staff.
• Resend — sends the website’s automated emails (enquiry notifications to our team and confirmations to you).
• Cloudflare — Turnstile spam protection on our forms.
• Stripe — processes payments for existing service plans, including card and Bacs Direct Debit.
• QuickBooks (Intuit) — our accounting and invoicing software, used to create and send customer invoices, maintain accounting records, and provide card payment links and bank transfer details on invoices.
• Koalendar — our online appointment booking service, used to let customers book available appointments, send automatic booking confirmation emails and send appointment reminders the day before.
• EmailOctopus — sends our marketing emails.
• Google Fonts — delivers externally loaded website fonts and processes associated technical requests.
• Microsoft 365 — our business email and correspondence.
• WhatsApp (Meta) — if you choose to message us on WhatsApp.
• Our accountants, professional advisers, insurers, and authorities where the law requires.

We do not use advertising or analytics cookies. The website loads Google Fonts from Google’s servers, which involves your browser sending technical information, such as your IP address, to Google. Our enquiry form uses Cloudflare Turnstile for spam protection, which processes technical information about your device and browser. Staff who sign in to the administration area use browser storage to keep them signed in.

Our Book Online buttons open Koalendar in a separate tab rather than embedding a booking widget. If you follow links to Koalendar, Stripe or WhatsApp, their own privacy and cookie policies apply.

Some of the service providers listed in section 5 are based outside the UK or may process personal information outside the UK. Where personal information is transferred outside the UK, it must be protected by a transfer mechanism recognised under UK data-protection law. You can contact us using the details in section 1 for more information about the transfers and safeguards that apply.

We keep personal information only for as long as we need it for the purposes described in this policy, including meeting legal, tax and accounting requirements and dealing with questions, complaints or claims.

How long depends on the type of information. Enquiries that do not lead to work are kept for a shorter period than records of servicing, repairs, invoices and payments, which may need to be kept for several years for accounting and legal reasons. Anti-spam security data is kept only for as long as it is needed for that purpose. If you unsubscribe from marketing, we keep a minimal suppression record so that we respect your choice.

Under UK data protection law you have the right to access your information; correct it; have it deleted; restrict or object to our use of it (including an absolute right to object to direct marketing); data portability; and to withdraw consent at any time. Some rights apply only in certain circumstances. We will respond without undue delay, normally within one month. Where the law permits an extension for a complex or multiple request, we will explain the extension and its reasons within the first month. To make a request, contact us using the details in section 1.

Our records are kept in a secure database that only authorised staff can access after signing in. Payment card and bank details are handled by Stripe or, for invoice payments, by the payment service linked from our QuickBooks invoices, and full payment credentials are not stored on our website. Bank records may contain payer names, amounts, dates and references, as described in section 2.

Please contact us first so we can try to help. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

We may update this policy. The current version, with its effective date, will be available on this website.