Privacy Notice

1. Who we are

Spa Liya Lux (“we”, “us”, “our”) is the data controller responsible for your personal data. We operate a wellness spa at 878 Caribbean Plaza, Suite 2A, 7 Mile West Bay Road, Grand Cayman, Cayman Islands.

Contact us: +1 (345) 321-4188 | info@spaliyalux.ky | www.spaliyalux.ky

This notice explains how we collect, use, share and protect your personal data in line with the Cayman Islands Data Protection Act (2021 Revision) (the “DPA”).

2. The personal data we collect

We may collect and hold the following information about you:

• Your name, contact details (phone, email, address) and, where relevant, the partner property or room you are staying in.
• Date of birth and emergency contact details (where provided).
• Appointment history, treatments received, products purchased and your preferences.
• Payment information (card payments are handled securely by our payment provider; we do not store full card numbers).
• Marketing preferences and your responses to our offers.
• Photographs (for example before-and-after images) only where you give consent.

3. Health and other sensitive information

As part of our consultation and consent forms (for treatments such as waxing, facials, massage and scalp rituals) we may collect health-related information — for example allergies, skin conditions, medications, pregnancy and relevant medical history. Under the DPA this is “sensitive personal data” and is given extra protection.

We collect and use this information only to provide your treatments safely. We rely on your explicit consent, which you give when you complete and sign our consultation forms. You may withdraw your consent at any time, although this may mean we are unable to safely provide certain treatments.

4. How we use your data and our legal basis

We use your personal data for the following purposes, relying on the legal bases shown:

• Booking and providing your treatments — performance of our contract with you.
• Health screening and tailoring treatments safely — your explicit consent (for health data).
• Taking payment and keeping financial records — contract and legal obligation.
• Keeping treatment and consultation records — our legitimate interests and legal/insurance obligations.
• Sending you marketing and offers — your consent (see section 5).
• Improving our services and keeping our premises secure — our legitimate interests.
• Meeting legal, tax, insurance and regulatory obligations — legal obligation.

5. Marketing communications

We will only send you marketing — such as promotions, seasonal specials or newsletters — where you have given your consent. You can opt out at any time by emailing info@spaliyalux.ky or telling our reception team, and we will stop within a reasonable period.

6. Who we share your data with

We do not sell your personal data. We may share it with trusted service providers (“data processors”) who help us run our business. We require them to protect your data and to use it only for the services they provide to us. We may also disclose data where required by law, or to protect someone’s vital interests.

7. International transfers

Some of our providers may store data outside the Cayman Islands. Where we transfer personal data abroad, we take steps to ensure an adequate level of protection as required by the DPA — for example by using providers in jurisdictions recognised as adequate, or by relying on your consent or the necessity of your contract.

8. How long we keep your data

We keep your personal data only as long as necessary for the purposes above. We retain health and consultation records for the legally required period after your last visit to meet our safety, insurance and legal obligations, after which they are securely deleted or destroyed.

9. How we protect your data

We use appropriate technical and organisational measures to keep your data safe — including secure storage, restricted staff access and confidentiality obligations. Paper consultation forms are stored securely and treated as confidential.

10. Your rights

Under the DPA you have the right to:

• be informed about how we use your data (this notice);
• access the personal data we hold about you (a “subject access request”);
• have inaccurate data corrected, or blocked, erased or destroyed;
• ask us to stop using your data for direct marketing;
• rights in relation to automated decision-making; and
• complain to the Office of the Ombudsman and seek compensation through the courts.

To exercise any of these rights, please contact us in writing at info@spaliyalux.ky. We will respond within 30 days and may ask you to confirm your identity first.

11. Data breaches

If a breach occurs that affects your personal data, we will notify you and the Office of the Ombudsman without undue delay and within the timeframe required by the DPA.

12. Complaints

If you have any concerns about how we handle your data, please contact us first so we can help. You also have the right to complain to the supervisory authority:

Office of the Ombudsman (Cayman Islands) — Phone: +1 345 9466283 | Email: info@ombudsman.ky | Website: www.ombudsman.ky

13. Changes to this notice

We may update this notice from time to time. The latest version is always available at our spa and on www.spaliyalux.ky.