Privacy Policy

This notice describes how Cloud9 Head Spa uses personal information collected through this website. It reflects the site as currently implemented. Items that still need a business or legal decision are marked TODO(CLIENT/COMPLIANCE).

Who we are

The website is operated by Cloud9 Head Spa at cloud9headspa.co.uk. TODO(CLIENT/COMPLIANCE): confirm the legal entity that is the data controller, any registered office, and Companies House details if they should appear here.

How to contact us

For privacy questions or to exercise your rights, contact us using:

• Email: TODO(CLIENT/COMPLIANCE): Cloud9 contact email not yet published
• Telephone: TODO(CLIENT/COMPLIANCE): Cloud9 telephone number not yet published

TODO(CLIENT/COMPLIANCE): confirm a postal address if one should be offered as a contact route. Do not treat this website as confirmation of a trading address until that address is supplied in site configuration.

Information we collect through this website

The holding-page Register Your Interest form collects:

• name (required)
• email address (required)
• telephone number (optional)
• whether you have asked to receive occasional updates (marketingConsent: yes or no)

A full contact form on the wider website, when that mode is enabled, may also collect an enquiry type and a message.

We do not use this website to collect payment card details. We do not currently run website analytics, advertising pixels, or embedded booking or map widgets on the holding page.

Why we use this information

If you submit the Register Your Interest form, we use your details to receive and respond to that enquiry, including telling you when Cloud9 is preparing to open where that is part of answering the enquiry.

If you separately tick the optional updates box, we also use your details to send occasional information about opening, treatments and bookings. That box is not pre-ticked. You can submit an enquiry without ticking it.

TODO(CLIENT/COMPLIANCE): confirm whether the business wants register-interest submissions to be treated only as enquiries, or also as a mailing list when marketingConsent is true. This implementation sends a true/false consent flag with the enquiry; it does not silently add people to a marketing list in this website.

Lawful basis

TODO(CLIENT/COMPLIANCE): confirm the lawful basis for each purpose under UK GDPR. This website does not assume a basis. Typical options a solicitor or data-protection adviser may consider include legitimate interests or steps prior to a contract for responding to an enquiry, and consent for optional marketing emails. Do not treat this paragraph as legal advice.

Marketing

Optional marketing updates are recorded as marketingConsent true or false with the form submission. Where consent is used, you can withdraw it at any time by contacting us using the details above. Withdrawal does not affect the lawfulness of processing before that point.

Service providers

Enquiry and register-interest submissions are sent from the website server using Resend, a transactional email provider. Resend acts as a service provider / processor for delivering those emails. The Resend API key is not exposed in the browser.

Notification emails for those enquiries are delivered to the Cloud9 business enquiry mailbox cloud9headspaharpenden@gmail.com, which is hosted by Google. That address is the enquiry destination for form delivery; it is not automatically published as a public website contact address unless separately configured.

TODO(CLIENT/COMPLIANCE): confirm the website hosting provider. This application is built with Next.js; the hosting company is not recorded in the codebase.

Fonts used on this site are self-hosted through the application build. They are not loaded from Google in the visitor's browser.

Retention

This website does not store form submissions in its own database. Copies exist in the notification email (and any confirmation email) sent through Resend, and in the inbox that receives them.

TODO(CLIENT/COMPLIANCE): confirm how long enquiry records and any marketing contacts are kept, and when they are deleted or anonymised.

Security

Form data is validated on the server and sent to Resend over HTTPS. We do not store the Resend API key in client code. No website is completely secure; please only send information you are comfortable providing.

Your rights

Under UK data protection law you may have the right to access, correct, delete or restrict use of your personal information, to object to certain processing, and to data portability in some cases. Where processing is based on consent, you may withdraw that consent. To make a request, contact us using the details above.

Complaints

If you are unhappy with how we use your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk/make-a-complaint

External links and social platforms

If Instagram or Facebook links are published on this site, those platforms are responsible for their own privacy practices. Following a social link takes you to a third-party site. We only publish social URLs once they are added in site configuration.

Bookings and maps

Timely booking is not currently embedded. If a Timely URL is added later, booking will open as an external link unless a widget is introduced. A Google Maps embed is not currently enabled. If either becomes an embedded widget, this notice and the Cookie Policy must be reviewed before that change goes live.

Cookies

Please see our Cookie Policy for what this website actually uses.

Changes

We may update this notice when the website or our practices change. The date at the top of this page will be revised when that happens.