Privacy Policy

Last updated: 13 October 2026

This policy explains how Infusão Spa Unipessoal, Lda. ("Infusão Spa", "we") collects and uses your personal data when you visit our website, create an account, book a treatment or contact us, and the rights you have under the General Data Protection Regulation (GDPR) and Portuguese law.

1. Who is responsible for your data

The data controller is Infusão Spa Unipessoal, Lda., NIF 519356730, Rua da Bica do Marquês 43 A, 1300-087 Lisboa, Portugal.

For any question about your data, or to exercise your rights, write to privacidade@infusaospa.com or call +351 912 558 157.

2. The data we collect

• Account data: your name, email address, phone number, password (stored only in encrypted form) and preferred language.
• Booking data: the treatment, date, time, therapist and space, any notes you add, cancellations, and whether you attended.
• Messages: what you send us by email, phone, WhatsApp or the contact form, and our replies.
• Sign in with Google: if you choose it, Google shares your name, email address and an account identifier with us. We never receive your Google password.
• Technical data: your IP address, browser, the pages you request and when, recorded in server logs for security, and the cookies described in section 8.
• Website statistics: only if you accept analytics cookies, how you use the website: the pages you view, how you arrived, your device and browser, and your approximate location (city or region), collected with Google Analytics.

We never ask for card details on the website: you pay at the spa.

3. Health information

Some treatments require us to know about health conditions, allergies, pregnancy or other contraindications. Please do not write health information in online booking notes. Your therapist will ask for what is needed before the treatment, and we use it only to provide the treatment safely, with your explicit consent (Article 9(2)(a) GDPR).

4. Why we use your data and on what legal basis

• To create and manage your account and bookings, and to send confirmations, reminders and notices of changes or cancellations: performance of a contract (Article 6(1)(b) GDPR).
• To answer your messages and requests: performance of a contract, or steps you ask for before one (Article 6(1)(b) GDPR).
• To issue invoices and keep accounting and tax records: legal obligation (Article 6(1)(c) GDPR). Invoices are issued at the spa with certified invoicing software, not by this website.
• To keep the website and your account secure, prevent abuse such as repeated failed sign-ins or spam, and keep backups: our legitimate interest (Article 6(1)(f) GDPR).
• To record missed appointments so that we can manage the schedule fairly: our legitimate interest (Article 6(1)(f) GDPR).
• To measure how the website is used, so that we can improve it: your consent, given in the cookie banner (Article 6(1)(a) GDPR and Article 5 of Law 41/2004). You can withdraw it at any time, as explained in section 8.

We do not send marketing messages without your consent, we do not sell your data, and we do not make decisions about you by automated means alone.

5. Who receives your data

Your data is handled by our team and, on our behalf, by service providers bound by data processing agreements:

• DigitalOcean, LLC: website hosting and backups, in data centres in the European Union (Amsterdam).
• Amazon Web Services EMEA SARL: sending booking and account emails (Amazon SES), from the European Union (Sweden).
• WhatsApp Ireland Limited: if you choose to write to us on WhatsApp, your messages and phone number pass through WhatsApp, under its own privacy policy. The website's WhatsApp button is a plain link: nothing from WhatsApp loads until you use it.
• Google Ireland Limited: business email (Google Workspace), website statistics (Google Analytics, only with your consent) and, when you choose it, Sign in with Google.
• Cloudflare, Inc.: spam protection (Turnstile) on the sign-up, sign-in and password reset forms. It checks technical signals such as your IP address and browser, only to tell people from automated programs.

We may also disclose data when the law requires it, for example to the tax authorities or the courts.

6. Transfers outside the European Union

The website is hosted in the European Union. Some providers, such as Google, may process data outside the European Economic Area, including in the United States. Such transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework or on standard contractual clauses approved by the Commission.

7. How long we keep your data

• Account data: while your account is active. When you close it, we delete or anonymise it within 30 days, except for data the law requires us to keep.
• Booking history: up to 3 years after your last appointment, to manage your bookings and any complaints or claims.
• Messages: up to 3 years after the matter is closed.
• Invoices and accounting records: 10 years, as Portuguese tax law requires.
• Server logs: up to 90 days. Backups: replaced within 30 days.
• Website statistics: up to 14 months in Google Analytics.

8. Cookies

Essential cookies make the website work and remember your choices; they need no consent:

• session_id: keeps you signed in and protects forms. It ends when your session ends or expires.
• frontend_lang: remembers your language.
• Cookie banner choice: your answer to the cookie banner, stored in your browser.
• Cloudflare Turnstile: on the sign-up, sign-in and password reset forms, Cloudflare may store the technical data it strictly needs to tell people from automated programs. It is not used for advertising or tracking.

Analytics cookies are set only if you click "I agree" in the cookie banner. Google Analytics then uses the _ga cookies, kept for up to 2 years, to count visits and tell visitors apart. Google acts as our processor, does not store your IP address, and may process the data in the United States (section 6). If you arrive from a link of one of our campaigns, a cookie also remembers which campaign for 31 days.

We do not use advertising cookies. You can change your choice at any time on the Cookie Policy page, which reopens the cookie banner, or by deleting cookies in your browser settings; without the session cookie you cannot sign in.

9. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time, without affecting what was done before. You can update most account details yourself in My account.

To exercise any of these rights, write to privacidade@infusaospa.com. We reply within one month.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

10. Security

We protect your data with encrypted connections (HTTPS), encrypted passwords, access limited to the staff who need it, protection against repeated sign-in attempts, and regular backups.

11. Children

Accounts and online booking are for adults aged 18 or over. Treatments for minors are booked by a parent or guardian, who is responsible for the information provided.

12. Changes to this policy

We may update this policy, for example when we add new services. Every change is published on this page with a new date, and we notify account holders by email of significant changes.

This policy is available in Portuguese, English and French. If the versions differ, the Portuguese version prevails.