Privacy notice

Sekhem Sauna & Recovery Ltd, a company registered in England and Wales, company number 17297125, at Trevissome Park, Blackwater, Truro, TR4 8UN.

Sekhem Sauna & Recovery Ltd is the data controller.

Email [email protected] or ring 01872 487 173.

ICO Registration Number: ZC261070

First and last name.

Email address
Required. It is how the confirmation, the manage-booking link, the reminder and any sign-in link reach you. Your email address is also used to track your booking history to enable the most efficient and accurate customer experience.

Phone number
Optional. Only used to contact you if a session is cancelled by us at short notice.

Your booking history.
Which sessions were booked, how many people you booked for, what you paid, what was refunded, whether you arrived, and whether you cancelled. Each change of state is written to an append-only event log with the reason and which member of staff or which client administered it.

Anything you type in the notes box.
Stored on the booking and read by staff before your session. Do not put medical details in the notes box.

Notes staff write about you.
Staff can attach an internal note to a customer or a booking to help us improve your experience and our service. You will never see it on the site, but it is your personal data and a subject access request will return it.

Guest names.
Optional, and only stored if you or a member of staff fill them in.

Marketing consent.
The sentence you ticked and its version, what it covers, where and when you ticked it, a one-way hash of the IP address it came from, and the date you withdrew it if you did. Held separately from the booking and never implied by making one.

Waitlist entries.
Name, email and party size, attached to one specific session. Permission to contact you about that session is recorded separately from marketing consent.

Emails we sent you.
Which template, the subject line, the time, and whether the provider accepted it. We record this to help us trace booking confirmations and improve your experience.

A one-way hash of your IP address
When a booking is created and when a member of staff signs in, the IP address is put through SHA-256 and only the result is stored. It is used to count requests from the same source so the site cannot be flooded. A hash cannot be turned back into an address, and the address itself is never written to the database.

Payment references.
Stripe identifiers, the amount, the currency and the status. This information helps us answer any questions you may have about a payment, and will not be used to create future payments.

You can book without signing in, and anyone who has booked can sign in with that email address to see and change their bookings. A membership requires you to sign in so that we can track your account balance as well as cancellations and renewals.

There are no passwords. When you ask to sign in we email a link that works once and expires, and we store only a hash of it, never the link itself. Signing in creates a session row and sets the cookie described below. Signing out ends both.

If you join or buy a block of sessions, we also hold data specifically related to:

What you agreed to.
The version of the membership or pass terms shown to you, and the moment you accepted them.

Your credits
Every batch of credits, how they were purchased, how many credits are left and when they expire.

Your subscription
The plan, the price you joined on, the renewal date, and your invoices. Card details are never stored by us. Stripe holds those, and we hold an identifier that lets us ask Stripe about your billing.

The lawful basis is the contract between us. When a membership ends, the record of it is kept for the same period as a booking, because it is part of the same accounting trail.

A gift card involves two people, and we hold data about both. The buyer is a customer like any other: name, email, the card they bought and its receipt. If the card is addressed to somebody else we will also hold that person’s name, their email address and the message the buyer wrote. We hold those details on the buyer’s instruction, use them to deliver the card and to remind the holder before the code lapses, and for nothing else. The recipient is never added to any list. A card sold at our desk is recorded the same way, with the name of the person who paid for it as they gave it, and without an account for them; a card handed over on paper holds no email address at all.

The code on a card is a credential, so we keep it the way we keep a sign-in link: as a hash. The code itself exists in the email and nowhere on our systems. Redeeming a card creates or uses an account under the redeemer’s own email address, which from then on is described under memberships and credits above. The buyer is told the card was redeemed, and not which account it went to.

The lawful basis for the buyer’s details is the contract; for the recipient’s, our legitimate interest in delivering what was bought, which is also plainly in the recipient’s interest. A card is kept for the same period as a booking once it has been redeemed, refunded or has lapsed.

You can leave an email address if you'd like to hear from us about news, events and offers. You can also join by ticking the box while you book or buy something. Our mailing list is separate from your booking, with its own consent and its own record.

We store the address, a first name if you gave one, the email content you agreed to receive, where you ticked it, when, and a one-way hash of your IP address. The wording of any invitation to join our mailing list is stored verbatim because consent is a question of what you agreed to, not merely that you did.

The lawful basis is your consent, and you can withdraw it at any time from the link at the bottom of every message we send. Withdrawing keeps a record that you were on the list and that you left, which is the only way we can be sure not to email you again, and the consent itself is deleted two years later.

Being on the list does not create a customer record, and the list is used for nothing but these emails. We record which emails were sent to your address and whether the provider accepted them.

Each button and linked picture in one of these emails goes through an address of ours first. That address notes that your address followed the link, then sends you on to the page. It tells us which links in an email were used and by how many people. It puts nothing on your device, and the note is deleted after 2 years. Nothing in the email reports back when it is opened or read.

• No health information. There is no health questionnaire. At checkout you tick one box confirming you have read the Sauna & Cold Immersion Safety Declaration. That records a version number and a timestamp, and nothing about you. Health data is special-category data under Article 9, and our booking system will not ask for or store it.
• No card numbers, expiry dates or security codes. Those are typed on Stripe’s page. They never touch our server and are not in the database in any form.
• No analytics, no advertising pixels, no session recording, no heatmaps. The site loads no third-party script on any page except Stripe’s own checkout page.
• Pictures from our own Instagram account, where they appear, are copied to this site’s server on a schedule and shown from here. Nothing loads from Instagram in your browser.
• No customer passwords. You sign in with a link we email you, as described under memberships, credits and passes above.
• No date of birth. Age is checked at the door by looking at you and, if there is any doubt, at your ID. Nothing is recorded.

Payment is taken by Stripe on a page Stripe hosts. You leave this site to pay and come back afterwards. We never see the card.

What comes back to us is whether the payment succeeded, the amount, and a set of identifiers we can quote to Stripe if something needs sorting out. Stripe acts as our processor for taking the payment, and as a controller in its own right for fraud prevention, which is why it sets its own cookies on its own page. Stripe publishes what it collects at stripe.com/gb/privacy.

UK GDPR requires a lawful basis for each purpose. There are three here, and they are not interchangeable.

Taking and honouring a booking
Performance of a contract, Article 6(1)(b). This covers your name, email, phone, party size, payment and the confirmation and reminder emails. Without this data there is no booking to honour.

Marketing email
Consent, Article 6(1)(a), together with regulation 22 of PECR. Opt-in only, never a pre-ticked box, and never assumed because you booked. Withdrawing it changes nothing about your bookings.

Rate limiting, staff sign-in, keeping the site up
Legitimate interests, Article 6(1)(f). The interest is not being taken offline and not having every place bulk-held by a script. Hashing the address before storing it is what keeps the effect on you close to nothing.

Keeping records after your session
Legal obligation for tax records, and legitimate interests in being able to defend a claim or a chargeback. See retention below.

Three cookies, all strictly necessary, and no banner. Regulation 6(4) of PECR exempts a cookie that is strictly necessary to provide a service you asked for. A banner that consents to nothing is theatre, so there is not one.

Booking session
Set when you start a booking or open a manage-booking link from your confirmation email. It holds a reference to your own booking and nothing else. HttpOnly, so no script can read it, and short-lived. A CSRF token travels with it, which is what stops another website submitting a booking in your name.

Account session
Set when you sign in to your account with an emailed link, and only then. It holds a reference to a session row in our database, not your details. HttpOnly, and it ends when you sign out. If you have never signed in you will never be given one.

Admin session
Set only when a member of staff signs in to the admin area. If you are a customer you will never be given one.

Stripe
Set by Stripe, on Stripe’s checkout page, for fraud prevention. We cannot read them. Stripe lists them at stripe.com/cookies-policy/legal.

If analytics are ever added, this section changes and a working opt-out arrives at the same time.

Nothing is sold. Nothing is shared for advertising. Three suppliers process data on our instructions:

• Stripe, to take payments and process refunds.
• Resend, to deliver email. It sees your address and the contents of the message.
• The hosting and database providers, named here before launch, which hold the database the rest of this notice describes.

Hosting is intended to be in the UK or the EEA. If any of it moves outside, this section will name the country and the transfer mechanism rather than quietly changing. Confirming where each supplier actually stores the data is one of the outstanding items on this draft.

Information goes to the police, HMRC or another authority only where the law requires it, and we will tell you when that happens unless we are forbidden from doing so.

Bookings and the payment records attached to them are kept for 6 years from the date of the session. The Limitation Act 1980 allows six years to bring a claim on a contract, and HMRC expects six years of records, so deleting sooner would leave us unable to answer a question we are obliged to answer. The figure is set once, in the site’s settings, and every other part of the system reads it from there.

The waiver
Before a session, each person taking part signs a short waiver: their name as they typed it, the wording they were shown with its version number, the time, and whether it was signed from the link in the booking email or on the screen at reception. A waiver signed online also keeps a one-way hash of the address it came from, which we cannot turn back into an address. A waiver signed at reception records which member of staff was holding the screen. We keep a signed waiver with the booking it was signed for, and for the same period as the booking. A waiver you sign in your own name also stands for later bookings you make, for the period shown when you sign it, so we do not ask you to sign again at every visit. The waiver asks nothing about your health. It is not a medical form, and we do not collect health information at any point in booking or attending.

The rest are draft periods and are among the things that need review:

• Waitlist entries: deleted 30 days after the session they were for.
• Marketing consent: kept while it stands, and for 2 years after you withdraw it, so we can show why we stopped emailing you. The record that an address asked not to be emailed is kept, because it is what stops us emailing it again.
• Which links you followed in a marketing email: 2 years.
• Hashed addresses in the rate limiter: swept within 24 hours. Staff session records: 90 days.
• Email delivery records: 12 months.
• Notes staff wrote about you: deleted with the customer record they are attached to.

All of these are free to use, and using one is never held against you. We answer within one calendar month.

See what we hold
Article 15. We send you everything, including the internal notes, in a form you can read.

Correct it
Article 16. A misspelled name on a booking takes about a minute, so just email.

Have it deleted
Article 17. Marketing data goes immediately. We will usually decline to delete a booking inside the retention period above, because we need it for tax and for defending a chargeback, and Article 17(3) permits that. We will tell you exactly what we are keeping and why rather than refusing in general terms.

Restrict or object
Articles 18 and 21. You can object to anything we do on the basis of legitimate interests, and we then have to justify it or stop.

Take it elsewhere
Article 20. We export what you gave us in a machine-readable file.

Withdraw marketing consent
Article 7(3). Use the link at the bottom of any marketing email, or write to us. It takes effect at once. It does not affect emails already sent and it does not affect a booking you have made.

Not be decided about by a machine
Article 22. There is no automated decision-making and no profiling here, so this one has nothing to bite on.

To use any of them, email us at the address at the top of this notice. We may ask you to confirm something only you and your booking would know. We will not ask you to send a passport to prove you booked a sauna.

Tell us first. Most of what goes wrong with data is a mistake we can fix the same week.

Email [email protected] or ring 01872 487 173.

If that does not resolve it, you can complain to the Information Commissioner’s Office.

ico.org.uk/make-a-complaint
Helpline 0303 123 1113
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

When this changes we will date the new version here and notify you by email.

This notice is version 2026-09-30.8.

Related reading: the booking terms and the first visit guide, which explains what the participation acknowledgement at checkout actually says.