Last updated: 30 August 2026
1. Who we are
Sayang’s Massage & Spa (“SMS”, “we”, “us”, “our”) is a trading name of Market Emergence Ltd, a company registered in England and Wales (company number 11788982), registered office 97 Rosslyn Crescent, Harrow, Middlesex, HA1 2SA. We operate massage and spa services from our Harrow, Watford, and Hammersmith locations, and are the data controller for the personal data described in this policy.
- Harrow: 97 Rosslyn Crescent, Harrow, Middlesex, HA1 2SA · Mobile: 07520 615 692 · Landline: 0203 048 2161
- Watford: Unit 7, Mowat Industrial Estate, Sandown Road, Watford, Hertfordshire, WD24 7UY · Mobile: 07441 920 042 · Landline: 01923 381 629
- Hammersmith: West 12 Shopping Centre, Unit 14 (Cutting Bar, next to Doctors), Hammersmith, London W12 8PP · Mobile: 07441 916 111 · Landline: 0203 048 2161
- Contact for privacy queries: 0203 048 2161 (landline) or 07520 615 692 (mobile — call or text), Harrow
- Company number: 11788982
2. What personal data we collect
Booking and client data (via our booking system, Bookly): your name, contact details (phone number, email), appointment history, and service preferences.
Therapist professional preferences: each therapist sets their own professional comfort/boundary preferences — for example, which client genders they work with, their draping/coverage preference during treatment, and the treatment styles they offer. Where a therapist’s preferences are informed by their own religious, cultural, or personal beliefs, we respect and record this so it can be honoured. Our booking system uses these preferences to try to match clients with an appropriate therapist.
Health/medical consultation forms: before certain treatments, we ask you to complete a consultation form (based on the standard FHT — Federation of Holistic Therapists — format), covering relevant medical conditions, allergies, pregnancy, recent surgery, and similar information, so your therapist can check the treatment is safe for you and avoid any adverse health condition. This is special category health data under data protection law, and is currently collected and stored on paper (not digitally). We collect and retain these forms because our special treatment licence — issued by Harrow Council, Watford Borough Council, and Hammersmith & Fulham Council respectively — requires us to as a safeguard.
Aftercare review forms: after certain treatments, we may ask you to complete an aftercare review, also part of the FHT-based framework above. This covers two different kinds of information, handled differently:
- Medical/aftercare feedback (e.g. how you responded to the treatment) — this is confidential, handled the same way as the consultation form above (special category health data, statutory/safeguarding basis, not made public).
- Star rating or written testimonial — this may be used publicly (e.g. as a review or testimonial on our website or social media), but only with your separate, explicit consent given specifically for that purpose. We do not publish your feedback publicly without asking first.
Public engagement with our reviews and social media: if you leave a Google review, or like, share, comment on, or otherwise publicly engage with our posts on social media (TikTok, Facebook, Instagram, YouTube, and others), that’s public content you’ve posted on the platform itself — we do not “collect” it from you in the way we do the data described elsewhere in this policy. However, we may cross-reference this public activity against our own client records (e.g. by name, profile details, or what’s said) to identify who it is and understand it in context. This act of identification is itself a form of processing your personal data, which we do on the basis of our legitimate business interest in understanding and responding to client feedback and engagement.
Marketing communications data (via TextMagic, our SMS marketing platform): your phone number, submitted when you opt in via our online registration form, your marketing consent status (opted in / opted out), and delivery/engagement data for the messages we send.
Payment and transaction data (via Square, our in-person point-of-sale system, and Stripe, our online payment gateway): payment card details (processed by Square/Stripe directly — we do not store your full card number), purchase/transaction history, and receipt contact details where provided.
Gift card data (via Square): the personal data involved depends on how you buy or top up a gift card, and how you choose to receive your receipt. If you pay by cash for a physical gift card and take a printed receipt, we hold little to no personal data about you at all — the card itself works like cash, and nothing about the purchase touches your bank account. If you instead ask for your receipt by SMS or email, we hold the phone number or email address you gave us for that purpose, and you receive the receipt that way — even though the purchase itself was still cash. If you pay by card/bank transfer, or purchase an online (digital) gift card, that payment naturally leaves a transaction record (see “Payment and transaction data” above), and for online gift cards specifically we also hold your email address, used to let you recover access via a forgotten-password process if needed. Whichever way it’s bought, the funds are held in trust by Square (we do not hold them ourselves) pending your future use of our services, so we keep any associated data for as long as the gift card carries a balance — balances do not expire.
Phone call and SMS data (via Dialpad, our phone system): if you call us, you’ll hear a message telling you the call may be recorded for training and quality improvement purposes; continuing the call after hearing this means you consent to being recorded (you’re free to hang up if you don’t). We also record and use calls for the security of our therapists and the prevention and detection of fraud (for example, confirming what was agreed verbally in the event of a dispute) — for this purpose specifically, we rely on our Legitimate Business Interest in keeping our staff safe and preventing fraud, not only on your consent to being recorded. We also hold your contact details in our Dialpad contact list, and use it to send SMS messages related to sales enquiries (separately from the TextMagic marketing messages described above), which we may also use for the same fraud-prevention/dispute-evidence purpose.
CCTV: we operate CCTV at both our Harrow and Watford locations, which captures images of clients, therapists, and others entering, leaving, and on the premises. This footage is recorded and stored on our own on-premise servers (QNAP) at each location — it is not sent to or processed by any third party. We use this for the security of our premises, staff, and clients, and for the prevention and detection of fraud — including confirming, where needed, that a client attended and received a booked treatment as agreed, and agreed to these terms, in the event of a dispute (see “Professional conduct and treatment boundaries” in our Terms and Conditions).
Ring video doorbells: in addition to our CCTV, we use Ring video doorbells at both our Harrow and Watford locations, for the same security and fraud-prevention purposes. Unlike our on-premise CCTV, Ring is a cloud-based service — meaning this footage is processed and stored on Ring’s own servers, which are outside our direct control and likely outside the UK/EEA (see “International data transfers” below).
Enquiries you send us: if you contact us with a question or enquiry — by text message (TextMagic), phone call (Dialpad), or direct message on Facebook, TikTok, or (previously, or if still available) Google My Business/Google Maps messaging — we use the content of your message and your contact details to respond to you.
Website usage data: via Google Analytics (GA4), we collect anonymised/aggregated information about how visitors use our website — pages viewed, general location (country/ region level), device type. See “Cookies” below.
Photos and videos used in our marketing: some of the photos and videos on our website and social media channels are AI-generated images that do not depict any real person (used to illustrate a type of treatment). Where we use a real photo or video of a therapist, this only happens with that therapist’s own sign-off, given directly by them, covering both what’s created and how it’s used:
- Content: a therapist chooses whether their own real photo/video is used as taken, used with an AI-tailored background or setting (their real likeness, altered surroundings), or replaced entirely with a fully AI-generated image that does not depict them at all.
- Use: a therapist separately chooses whether that content is used on our website only, or on our website and social media.
A therapist can change either choice at any time, including asking us to stop using their content. We treat this as two distinct, separately-honoured requests:
- Take-down — the content is removed from public view (website and/or social media) but kept in our archive, so it can be reinstated later at the therapist’s request. This is the more common request, and doesn’t require the content to have done anything wrong — a therapist may simply want their public presence paused for a period, for any personal reason of their own.
- Deletion — the content is permanently and irreversibly removed. This is a separate, less common request, honoured distinctly from a take-down.
We do not use identifiable photos or videos of clients in our marketing without that client’s separate, explicit, written consent, obtained specifically for that purpose.
3. How we use your personal data, and our legal basis for doing so
| What we do | Data used | Legal basis |
|---|---|---|
| Booking and providing your treatment | Booking/client data | Performance of a contract with you |
| Matching clients with an appropriate therapist | Therapist professional preferences | Legitimate Business Interests in appropriate client-therapist matching; your explicit consent where preferences involve religious/cultural belief (special category data) |
| Screening for contraindications before treatment | Health/medical consultation form | Legal obligation under our special treatment licence, and substantial public interest in safeguarding client health (special category data, supported by an Appropriate Policy Document) |
| Aftercare/service-improvement review (confidential medical portion) | Aftercare form | Legal obligation under our special treatment licence, same basis as the consultation form above |
| Publishing a star rating or testimonial (public-facing portion) | Aftercare form | Your explicit, separately-obtained consent |
| Issuing and honouring gift cards | Gift card data | Performance of a contract with you (the purchase creates an obligation on us to provide services in future) |
| Sending you appointment reminders/confirmations | Booking data | Performance of a contract with you |
| Sending SMS/email marketing | Marketing data | Your consent (you can withdraw this at any time) |
| Understanding and improving our website | Website usage data | Legitimate Business Interests in running an effective website |
| Featuring a therapist’s photo/video in marketing | Therapist-authorised media | The therapist’s own explicit consent |
| Featuring a client’s photo/video in marketing (rare, opt-in only) | Client-authorised media | Your explicit, separately-obtained consent |
| Identifying who left a Google review or engaged with our social media | Cross-referenced review/engagement data | Legitimate Business Interests in understanding and responding to client feedback and engagement |
| CCTV/Ring doorbell at our premises | CCTV/doorbell footage | Legitimate Business Interests in the security of our premises, staff, and clients, and the prevention/detection of fraud (including confirming what was agreed and that a booked treatment took place, if disputed) |
| Recording/using phone calls and sales SMS (Dialpad) | Call recordings/transcripts, SMS content | Your consent (from continuing the call after the recording notice), and separately our Legitimate Business Interest in the security of our staff and the prevention/detection of fraud |
| Responding to your enquiries (text, call, or social media direct message) | Enquiry content and contact details | Legitimate Business Interests in responding to enquiries and providing customer service |
4. Who we share your data with
We use the following third-party services to help us run our business. Each only receives the data it needs to perform its specific function:
- Bookly — booking and appointment management
- TextMagic — SMS marketing delivery and online opt-in registration
- Square — in-person payment processing and point-of-sale
- Stripe — online payment processing
- Dialpad — phone calls (including recording/transcription), contact list, and sales-related SMS messages
- Ring — video doorbell footage (our on-premise CCTV, via QNAP, is self-hosted and is not shared with any third party)
- WordPress, hosted via FastHosts — our website
- Google Analytics — website usage analytics
- Fal.ai and Runway — AI image, video, and audio generation tools used to create and edit marketing content (these providers process the images/prompts we submit to them in order to generate content; they do not receive your booking or contact data)
- Social media platforms (currently or in future: TikTok, YouTube, Facebook, Instagram, Google Business Profile, and others) — when we publish marketing content that includes a therapist’s authorised photo or video, and when we receive and reply to direct messages/enquiries sent to us via Facebook, TikTok, or Google My Business/ Google Maps messaging
We do not sell your personal data to anyone.
5. International data transfers
Some of the third-party services we use (including Fal.ai and Runway, used for AI content generation, and Ring, used for our video doorbells) may process data outside the UK/EEA, including in the United States. Where this happens, we rely on appropriate safeguards recognised under UK data protection law (such as Standard Contractual Clauses or the provider’s own UK-adequacy arrangements) to ensure your data continues to receive an appropriate level of protection.
6. How long we keep your data
- Booking/client data: for the duration of our relationship with you and for 6 years afterwards, in line with our record-keeping obligations.
- Health/medical consultation and aftercare forms: for as long as you remain an active client, and for 7 years afterwards. We set this period with reference to the time limit for bringing a personal injury claim under the Limitation Act 1980 (normally 3 years from the treatment, or from when you became aware of an issue if later), plus a safety margin to account for that “awareness” date being hard to pin down in advance. (We only treat clients aged 18 and over, a condition of our special treatment licence, so no separate minors provision applies.)
- Marketing data: until you withdraw consent, or 24 months of inactivity.
- Website analytics: as set by Google Analytics’ standard retention settings (14 months by default).
- CCTV footage (on-premise, QNAP): 90 days, unless needed for an ongoing investigation or incident.
- Ring video doorbell footage: up to 180 days, as set by our Ring subscription plan.
- Call recordings/transcripts: 12 months.
- Gift card data: for as long as your gift card carries a balance (balances do not expire), and for 6 years after the balance reaches zero, in line with our financial record-keeping obligations.
7. Your rights
Under UK data protection law, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data deleted in certain circumstances
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time (for anything based on consent, e.g. marketing, or your own photo/video appearing in our marketing if you are a therapist or a client who agreed to this) — for therapist content specifically, this can mean either asking us to restrict/take down content from public view while keeping it archived for possible future reinstatement, or asking us to erase it permanently; these are handled as two separate, distinct requests (see “Photos and videos used in our marketing” above)
To exercise any of these rights, contact us on 0203 048 2161 (landline) or 07520 615 692 (mobile — call or text), Harrow. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) if you believe we have not handled your data properly.
8. Cookies
Our website uses cookies for essential site functionality and for Google Analytics. You can control or disable non-essential cookies at any time through your browser’s own settings.
9. Children
Our services and marketing are directed at adults. We do not knowingly collect personal data from children.
10. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse.
11. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last revised.
12. Contact us
Questions about this policy or your data: 0203 048 2161 (landline) / 07520 615 692 (mobile — call or text), Harrow.
