We value the trust of our guests and are committed to ensuring maximum protection of their personal data in accordance with the laws of the United Arab Emirates, including Federal Decree- Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

When booking or using our bath services, we may collect the following data:

• Full name;
• Contact number and email address;
• Booking information (date, time, selected services);
• IP address and technical data from devices during online interaction.

Data is collected and processed exclusively for the purpose of:

• Providing services in accordance with the booking;
• Compliance with UAE legislation;
• Internal analytics and service quality improvement;
• Notifications about special offers (with the client’s consent).

By using our services, the client consents to the processing of personal data within the framework of applicable UAE legislation. Separate written consent is requested when cross-border data transfer or marketing distribution is required.

We apply all reasonable organizational and technical measures to protect personal data from:

• Unauthorized access;
• Loss and destruction;
• Alteration or unlawful use.

Data is stored on local and secure servers with access granted only to authorized personnel.

We do not share personal data with third parties except in:

• Cases stipulated by UAE law;
• Situations necessary to complete a booking (e.g., payment providers);
• With the client’s written consent.

1.1 These Regulations are governed by the PDPL (Decree-Law No. 45 of 2021) and internal privacy standards.
1.2. Compliance is mandatory for all employees with access to guests' personal data.

2.1. Data is collected directly from the client (at the front desk, via online form, or by phone).
2.2. Processing includes: collection, systematization, storage, use, anonymization, and deletion.
2.3. Processing is conducted solely for the provision of services or as required by law.

3.1. Only employees who have signed a confidentiality agreement have access to the data.
3.2. Data is protected by passwords, encryption, and storage on closed servers.
3.3. Paper documents are stored in locked cabinets.

4.1. We guarantee no data transfer except in the following cases:

• Legal obligation under UAE law;
• Necessity of service provision (e.g., payment processing through providers).

4.2. When transferring outside the UAE, it is verified whether the receiving country provides adequate data protection (in accordance with PDPL, Article 22).

The client may request data deletion or withdraw consent at any time. A response will be provided within 10 business days.

6.1. Staff are responsible for complying with data handling rules.
6.2. All complaints are reviewed by the internal data protection officer within 15 days.
6.3. In case of violation, the client may contact the UAE Data Office.

/