LuxySpa
Legal
Last updated: October 2026
The controller of the personal data collected through this website is [Denominação social a preencher, Lda.], a legal entity with number [NIF a preencher], whose registered office is at [Sede social a preencher — morada completa] ("LuxySpa").
For any question relating to personal data, please contact info@luxyspa.pt.
This policy has been prepared in accordance with Regulation (EU) 2016/679 (GDPR) and Law No. 58/2019 of 8 August.
Online bookings: the experience chosen, therapist (if selected), preferred date and time, and the booking reference. The online form does not currently collect a name or contact details; confirmation is made through the website's contact channels.
Contact by WhatsApp, telephone or email: name, telephone number and/or email address, and the content of the communication you send us.
Technical browsing data: IP address and technical logs strictly necessary for the security of the service (for example, preventing misuse of the booking system), and cookies as described in section 8.
Website usage data (only if you accept analytics cookies): pages visited, duration and source of the visit, device and browser type, approximate city-level location and a pseudonymous identifier stored in a cookie, collected through Google Analytics.
Managing bookings and providing the service — performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).
Invoicing and compliance with tax and accounting obligations — legal obligation (Art. 6(1)(c)).
Website security, prevention of fraud and misuse, and audit logs — legitimate interest (Art. 6(1)(f)).
Analytics cookies (Google Analytics), for website usage statistics, and any marketing communications — consent (Art. 6(1)(a)), which may be freely withdrawn at any time.
Bookings: kept for as long as necessary to manage the service and for the business's operational history.
Invoicing documents: 10 years, in accordance with tax obligations.
Technical and audit logs: up to 12 months.
Google Analytics data: up to 14 months, after which it is deleted automatically.
Communications (email/WhatsApp): for the period necessary to follow up the matter.
Once the applicable periods have expired, data is deleted or anonymised.
LuxySpa does not sell personal data or share it with third parties for marketing purposes.
We use service providers who process data on our behalf under processing agreements compliant with Art. 28 GDPR: Vercel Inc. (hosting of the website and images) and Neon Inc. (database, hosted in the European Union) and, only if you accept analytics cookies, Google Ireland Limited (Google Analytics — website usage statistics). Google Analytics is configured without advertising features and without data sharing for other Google purposes.
If you choose to contact us via WhatsApp, the communication is processed by WhatsApp Ireland Ltd./Meta, and that service's privacy policy also applies.
Data may also be disclosed to public authorities where required by law.
Some providers (in particular Vercel and Google) may process data outside the European Economic Area, notably in the United States. In such cases, transfers rely on appropriate safeguards under Chapter V of the GDPR — the applicable adequacy decision (EU-U.S. Data Privacy Framework) and/or the standard contractual clauses approved by the European Commission.
Under the GDPR, you have the right of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
You may exercise these rights via info@luxyspa.pt. We will respond within one month at the latest, extendable as permitted by law in cases of particular complexity.
You also have the right to lodge a complaint with the supervisory authority: the Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon — www.cnpd.pt.
We use essential cookies, which are necessary for the website to function (for example, the authentication session for the administration area and the record of your cookie choice) — these do not require consent under Law No. 41/2004.
We use analytics cookies only with your consent, given through the cookie notice. You can change or withdraw your choice at any time via the "Cookie preferences" link in the website footer, or through your browser settings.
The analytics cookies are those of Google Analytics: "_ga" (distinguishes visitors pseudonymously) and "ga<ID>" (keeps the session state), both valid for up to 2 years. They are only set after you give your consent and are deleted if you withdraw it. For more information, see Google's privacy policy at policies.google.com/privacy.
We also collect aggregated audience and performance metrics through Vercel, without using cookies and without identifying visitors.
We do not use advertising cookies, nor do we share browsing data with advertising networks.
We adopt appropriate technical and organisational measures, including encrypted communications (HTTPS/TLS), access control with authentication and user profiles, logging of administrative operations, backups and restriction of access to what is strictly necessary.
In the event of a data breach likely to result in a risk to data subjects, we will notify the CNPD and, where applicable, the affected data subjects, in accordance with Articles 33 and 34 of the GDPR.
The website and LuxySpa's services are intended exclusively for persons aged 18 or over. We do not knowingly collect data from minors; if you become aware that a minor has provided us with data, please contact us so that it can be deleted.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect data subjects.
This Privacy Policy may be updated from time to time; the version in force is the one published on this page, showing the date of the last update. Significant changes will be highlighted on the website.
For any question relating to this Policy or the processing of your personal data, please contact us at info@luxyspa.pt.