Last updated: [DATE OF PUBLICATION]

Saunassa is a Nordic spa: wood-fired sauna, hot tubs and cold-water plunges. To run it we need to know a little about you, and we would rather you knew exactly what that is. This policy explains what personal information we collect, why, what we do with it, how long we keep it, and the choices you have. It covers our website at saunassa.co.uk, our booking platform at app.saunassa.co.uk, the Saunassa mobile app, and what happens when you visit one of our studios.

1. Who we are

The Saunassa network, website, booking platform and app are operated by Saunassa Franchise Limited ("Saunassa", "we", "us"), a company registered in England and Wales, company number 16776712, registered office The Feel Good Building, 13 Pargolla Road, Newquay, Cornwall, TR7 1RP. Saunassa Franchise Limited is the data controller for your personal information across the network.

Individual Saunassa studios are run by operating companies under a franchise agreement with us. Our Newquay studio is operated by Saunassa Limited, which is why card payments taken at Newquay may appear on your statement in that name. Studio operators use our platform to look after their own customers and act under written agreements with us that require them to handle your information in line with this policy. [Solicitor to confirm the franchisee's role wording, data map §2, legal-pack question 7.]

We are registered with the Information Commissioner's Office (ICO), registration number [ICO REGISTRATION NUMBER].

Questions, requests and complaints about your data: email hello@saunassa.co.uk, call 01637 226642, or write to Saunassa Franchise Limited at the address above.

2. The information we collect, and where it comes from

When you browse our website or use the app. Technical information such as your IP address, browser or device type, and the pages you visit. Which cookies and similar tools we use, and how to control them, is set out in our separate Cookie Policy.

When you join our mailing list or a waiting list. Your name and email address, whether you ticked the box to receive news and offers, the page you signed up from, and the time you confirmed your email address. We use a double opt-in: you are only added to the mailing list once you click the confirmation link we send you.

When you create an account. Your name and preferred name, email address, phone number and password (which we never see in plain text). If you sign in with Apple or Google, we receive the name and email address (or Apple's private relay address) that you choose to share with us. You can add a postal address, date of birth, gender and a profile photo if you wish; none of these is required to book.

When you book or buy. The sessions you book, attend, cancel or miss; your place on a waiting list; the memberships, credit packs, passes, gift vouchers and private hires you buy; and your payment history. Card details are entered directly with our payment provider, Stripe, in the browser, in the app or on the card reader at the desk. They never pass through Saunassa's own systems. We hold only a secure reference to your saved card, together with its type, last four digits and expiry date so that you can recognise it.

When you sign our health and safety waiver. Before using the sauna, hot tubs or cold plunge for the first time (and again when the waiver changes) we ask you to read and sign a waiver. We keep your drawn signature, your name, the date and time, the version of the document you signed, the IP address or device it was signed from, and where it was signed (website, app, card reader or front desk). The waiver asks you to tell us about any medical conditions that make sauna or cold-water immersion unsafe for you. See section 4, health information.

When you come as somebody's guest, or walk in. Your name and email address, so that we can send you the waiver and, if a payment is taken, a receipt. If you walk in without an account we create a minimal record of your visit.

When you buy or receive a gift voucher. The purchaser's and recipient's names and email addresses, the voucher value or experience, any message, and the redemption history.

When you contact us. Whatever you include in your message, and our notes of how we dealt with it.

When you use the mobile app. If you allow notifications, a device token so we can send them. If you allow location access, we use it only to show you your nearest studio; we do not track or store your movements. [Confirm the app requests location at all; delete this sentence if not.]

When you enquire about a Saunassa franchise. Your name, contact details, location of interest and anything you tell us about yourself and your plans. If you go on to apply, we will give you a separate notice covering the checks that stage involves.

Information about you that we did not get from you. If you were a member or customer before September 2026, we received your record from our previous booking provider, Glofox (ABC Fitness), including your contact details, membership, credits and booking history, and, where you had one, your saved card, which was transferred securely between Stripe accounts without Saunassa seeing the card number. Gift vouchers bought before September 2026 were transferred from our previous voucher provider, Gift Up. If you were on our mailing list before September 2026, your preference came to us from Mailchimp. Studio staff may also add notes to your record, for example about a booking you asked them to make for you.

3. What we use your information for, and our lawful basis

UK data protection law requires us to have a lawful basis for each thing we do with your information.

Where we rely on legitimate interests we have weighed them against your rights and interests. You can ask us for more detail about that assessment.

4. Health information

Sauna and cold-water immersion place real demands on the body. The waiver asks you whether you have any condition that makes them unsafe for you, and lets you tell us anything you want staff to know.

Health information is "special category" data and we handle it with particular care: we ask for your explicit consent when you complete the waiver, only staff at the studio you attend and our head office team can see it, and we never use it for marketing or share it with anyone outside Saunassa except emergency services if you need them.

You can decline to give it, although we may then be unable to let you use some facilities safely. You can update or remove it at any time from your profile or by asking staff.

If you give us an emergency contact, we hold their name, phone number and relationship to you purely so we can reach them if something happens to you at the studio.

5. Marketing

We only send marketing where you have asked for it, by ticking a box on our website, in the app, on your profile, or at the desk. Every marketing email carries an unsubscribe link, you can switch each channel on or off in the Privacy section of your account, and you can email hello@saunassa.co.uk.

Withdrawing consent does not affect your bookings or membership, and we will still send you the messages we need to send to run your account (for example a booking confirmation or a change to our terms).

If you were on our mailing list before September 2026, we continue to rely on the consent you gave then. If you would rather not hear from us, unsubscribe once and we will stop. [Solicitor to confirm the position on inherited Glofox and Mailchimp consent, legal-pack question 12.]

6. Who we share your information with

We do not sell your personal information, and we do not share it with anyone for their own marketing.

Saunassa studios. The studio you book with sees what it needs to look after you: your booking, membership, waiver status, any health notes you gave, and your contact details. If you use more than one Saunassa studio your account, credits, memberships and waiver travel with you so you do not have to start again.

Service providers who work for us. Companies that host our systems, take payments, send our emails and notifications, and help us find faults. They act only on our instructions, under contracts that require them to protect your information, and are listed in the annex at the end of this policy. Our platform is built and maintained for us by Imagination Deployed Limited, who work under a written data processing agreement with us.

Professional advisers and authorities. Our accountants, insurers and lawyers where they need to know; and the police, regulators, courts or emergency services where the law requires or permits it, or where someone's safety is at risk.

7. Where your information is kept

Our database, authentication system and file storage are hosted by Supabase in [London / the EU, confirm region in writing]. Some of the providers in the annex process information in the United States or elsewhere outside the UK.

Where they do, we rely on safeguards recognised under UK data protection law, principally the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on an adequacy decision covering that country. You can ask us for a copy of the relevant safeguard.

8. How long we keep it

We keep your information for as long as we need it for the purposes above and then delete or anonymise it. The main periods are:

If you close your account we delete your login and anonymise your record, keeping only what tax, safety or legal obligations require us to keep for the periods above.

9. Your rights

You can ask us to:

• give you a copy of the personal information we hold about you, and to explain how we use it;
• correct anything that is wrong or incomplete (most of your details you can change yourself in your profile);
• delete your account and information, which you can do from the Privacy section of your account on the booking platform or in the mobile app [confirm the in-app route is live], or by emailing us; we will keep only what the law obliges us to keep, in anonymised form where possible;
• send you your information in a machine-readable format, or send it to another provider;
• stop or limit how we use your information in certain circumstances, including objecting to anything we do on the basis of legitimate interests;
• withdraw consent at any time, for marketing, notifications or health information, without affecting anything we did before you withdrew it.

We do not make decisions about you by purely automated means that have a legal or similarly significant effect.

To use any of these rights, email hello@saunassa.co.uk. We will need to check who you are, and we will respond within one month. There is no charge unless a request is clearly unfounded or excessive.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to sort it out with you first.

10. Children

You must be 16 or over to hold a Saunassa account or membership. If you are 16 or 17, a parent or guardian must sign the membership agreement and health and safety waiver on your behalf, and it is their consent we rely on for your health information.

We do not knowingly create accounts for anyone under 16; if we learn that we have, we will delete it. [Confirm the minimum age to attend the studio at all, for example whether under-16s may attend with a parent, Zoey 29 June ruling still open on attendance.]

11. Keeping it safe

Your information is encrypted in transit, access is restricted to staff who need it to do their job, and signed waivers and health information are held in private storage that is not accessible from the open internet.

Our systems are monitored for errors and unusual activity, and we work only with providers who meet recognised security standards. No system is perfectly secure, so please keep your password to yourself and tell us straight away if you think your account has been accessed by someone else.

12. [CCTV]

[If any studio operates CCTV, add: "Our studios use CCTV in reception and communal areas, but never in changing rooms, showers or the sauna and plunge areas, for the safety of guests and staff and the prevention of crime. Recordings are kept for [30] days unless needed for an incident. The lawful basis is our legitimate interest in a safe studio." Otherwise delete this section.]

13. Changes to this policy

We will update this policy when what we do changes. The current version is always at saunassa.co.uk/privacy-policy and in the booking platform and app, and if a change matters to you we will tell you, for example by email or when you next sign in.

Annex: the companies that process your information for us