+8801354896869

10:00 AM – 10:00 PM (Daily)

info@touchspa.xyz

78 Gulshan Avenue, Dhaka 1212

Your Privacy Matters

Privacy Policy – How Touch Spa Protects Your Data

At Touch Spa, we take your privacy seriously. This policy explains how we collect, use, and protect your personal information when you visit our website or book our services. We are committed to transparency and safeguarding your data.

Read Full Policy Contact Us
GDPR
Compliant
Secure
Data Protection
Transparent
Privacy Policy

Last Updated: 4 September 2026

1. Introduction

Touch Spa & Wellness ("we", "us", or "our") operates the https://touchspa.xyz website. This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our website and the choices you have associated with that data.

We use your data to provide and improve our services. By using our website and booking our services, you agree to the collection and use of information in accordance with this policy. We are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner.

Quick Summary: We collect minimal personal data (name, phone, email, booking preferences) solely to provide our spa services. We do not sell or share your data with third parties. We use cookies to improve your browsing experience. You can contact us anytime to access, correct, or delete your data.

2. Information We Collect

We collect several types of information for various purposes to provide and improve our services to you. The types of data we collect include:

2.1 Personal Data

While using our website or booking our services, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. This may include:

  • Name – Your full name to address you properly during your visit.
  • Email Address – To send you booking confirmations, reminders, and occasional updates.
  • Phone Number – To contact you about your booking and for urgent communications.
  • Address – Only if you request a service that requires location-based information.
  • Booking Preferences – Service type, duration, therapist preferences, and any special requests.
  • Health Information – Any medical conditions or allergies you voluntarily disclose to ensure safe treatment.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or genetic data. Any health information you provide is used solely to tailor your spa experience and ensure your safety.

2.2 Usage Data

We may also collect information on how the website is accessed and used. This Usage Data may include information such as your computer's IP address, browser type, browser version, the pages of our website that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

2.3 Cookies and Tracking Data

We use cookies and similar tracking technologies to track the activity on our website and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our website.

We use cookies for the following purposes:

  • Essential Cookies: Necessary for the website to function properly.
  • Preference Cookies: To remember your preferences and settings.
  • Analytics Cookies: To understand how visitors interact with our website and improve our services.

3. How We Use Your Information

Touch Spa uses the collected data for various purposes, including:

  • To provide and maintain our services – Including processing bookings and delivering treatments.
  • To notify you about changes to our services – Such as policy updates or service availability.
  • To allow you to participate in interactive features – When you choose to do so.
  • To provide customer support – Responding to your inquiries and resolving issues.
  • To gather analysis or valuable information – So that we can improve our services and website.
  • To monitor the usage of our website – Ensuring security and performance.
  • To detect, prevent, and address technical issues – Maintaining a reliable service.
  • To send you marketing communications – Only if you have opted in to receive them. You can opt out at any time.

We do not sell, rent, or lease your personal information to third parties. We may share your data with trusted service providers who assist us in operating our website and conducting our business, provided they agree to keep your information confidential.

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR) and other applicable data protection laws, we process your personal data on the following legal bases:

  • Contractual Necessity: Processing your data is necessary to fulfill our contractual obligations to you, such as processing your booking and providing our services.
  • Legitimate Interests: We process your data for our legitimate interests, such as improving our services, marketing our offerings, and ensuring the security of our website.
  • Consent: Where you have given us explicit consent to process your data for a specific purpose, such as receiving marketing communications.
  • Legal Obligation: We may process your data to comply with legal obligations, such as tax or regulatory requirements.

5. Data Retention

We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Specifically, we retain:

  • Booking records: For up to 7 years to comply with tax and regulatory requirements.
  • Contact information: For as long as you remain an active client or until you request deletion.
  • Marketing data: Until you opt out or request deletion.

You can request the deletion of your personal data at any time by contacting us.

6. Data Security

The security of your data is important to us. We implement a variety of security measures to maintain the safety of your personal information, including:

  • Encryption: All data transmitted between your browser and our website is encrypted using SSL/TLS technology.
  • Access Control: Access to your personal data is restricted to authorised personnel only.
  • Regular Security Audits: We conduct regular reviews of our security practices to ensure your data is protected.
  • Data Minimisation: We collect only the data we need and ensure it is stored securely.

While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. However, we take all reasonable steps to protect your information from unauthorised access, disclosure, alteration, or destruction.

7. Your Rights

Under applicable data protection laws, you have the following rights regarding your personal data:

  • Right to Access: You have the right to request a copy of the personal data we hold about you.
  • Right to Rectification: You have the right to request that we correct any inaccuracies in your personal data.
  • Right to Erasure: You have the right to request that we delete your personal data, subject to certain exceptions.
  • Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data.
  • Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Object: You have the right to object to the processing of your personal data for marketing purposes.
  • Right to Withdraw Consent: If we are processing your data based on your consent, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us using the details provided in the "Contact Us" section below. We will respond to your request within 30 days.

How to Contact Us: To exercise your privacy rights, email us at info@touchspa.xyz or call us at +8801354896869. We are here to help.

8. Third-Party Services

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to read the privacy policies of any third-party websites you visit.

We use the following third-party services that may process your data:

  • Google Analytics: To analyse website traffic and improve our services. Google Analytics collects anonymised usage data.
  • WhatsApp Business: For client communication and booking confirmations. Your phone number may be used to send WhatsApp messages.
  • Email Services: For sending booking confirmations and marketing communications.

These third-party service providers have their own privacy policies and data protection practices. We ensure they comply with applicable data protection laws.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from a child under 18 without verification of parental consent, we will take steps to remove that information from our servers.

10. International Transfers

Your information, including personal data, may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. By using our website and providing your data, you consent to the transfer of your data to countries where we operate.

We take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. We ensure that appropriate safeguards are in place, such as standard contractual clauses, to protect your data during international transfers.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this page.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page. We will also notify you via email or a prominent notice on our website if we make significant changes.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.

This Privacy Policy is designed to protect your rights and ensure transparency in how we handle your data. We are committed to maintaining your trust.

DPO Information

Data Protection Officer – Your Privacy Contact

We have appointed a Data Protection Officer (DPO) to oversee our data protection strategy and ensure compliance with applicable privacy laws. The DPO is your primary point of contact for all privacy-related matters.

Who is the DPO? Our DPO is a senior member of our management team with specialised training in data protection law. They are responsible for monitoring our compliance with GDPR and other privacy regulations.

What does the DPO do? The DPO oversees our data protection policies, conducts privacy impact assessments, handles data subject requests, and serves as the liaison with supervisory authorities. They ensure that your privacy rights are respected at all times.

How to contact the DPO. You can reach our DPO by emailing dpo@touchspa.xyz or by writing to us at our physical address. Please mark your correspondence as "FAO: Data Protection Officer".

  • Dedicated Data Protection Officer
  • GDPR compliance oversight
  • Handles privacy inquiries
  • Direct contact available
Data Protection Officer – privacy contact at Touch Spa
Automation

Automated Decision-Making & Profiling

We are transparent about our use of automated decision-making and profiling. Here is how we use these technologies and your rights regarding them.

What is automated decision-making? Automated decision-making involves using technology to make decisions without human intervention. This can include profiling, which analyses aspects of your behaviour to make predictions.

Do we use automated decision-making? We do not use automated decision-making that produces legal or similarly significant effects on you. We do not use profiling that could adversely affect your rights.

What we do use. We use simple automated systems for appointment reminders, booking confirmations, and email marketing. These are routine communications that do not involve complex decision-making.

Your rights. You have the right to object to automated decision-making. You can request human intervention, express your point of view, and contest decisions made by automated systems.

  • No significant automated decisions
  • Simple reminder systems only
  • You can object at any time
  • Human intervention available
Automated decision-making policy at Touch Spa
Cross-Border

International Data Transfers – Your Data's Journey

In today's connected world, data often crosses borders. We want you to understand how your data is transferred internationally and the safeguards we have in place.

Where does your data go? Your data may be transferred to and stored on servers located in countries outside Bangladesh, including the European Union, the United States, and Singapore. These countries have different data protection laws.

Safeguards we use. When we transfer your data internationally, we use approved safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission. These clauses ensure that your data receives adequate protection.

Our commitment. Regardless of where your data is stored, we apply the same high standards of protection. We ensure that our data processors comply with data protection laws and provide appropriate security measures.

  • Transparent international transfers
  • Standard Contractual Clauses used
  • Adequate safeguards in place
  • Consistent protection standards
International data transfers policy at Touch Spa
Dispute Resolution

Complaints & Dispute Resolution Process

We take all privacy complaints seriously. Here is our process for handling complaints and resolving disputes related to your personal data.

How to make a complaint. If you believe we have violated your privacy rights, please contact us in writing. Include your name, contact details, a description of the issue, and any supporting documents.

Our investigation process. We will acknowledge your complaint within 3 working days. We will investigate thoroughly and provide a written response within 30 days. If we need more time, we will inform you.

Escalation. If you are not satisfied with our response, you have the right to complain to the relevant data protection supervisory authority. In Bangladesh, this is the Bangladesh Data Protection Authority.

Legal recourse. You also have the right to seek legal remedy through the courts. We are committed to resolving disputes fairly and transparently.

  • Simple complaint process
  • 30-day resolution target
  • Escalation to supervisory authority
  • Legal recourse available
Complaints and dispute resolution at Touch Spa
Cookie Policy

We use cookies to enhance your browsing experience and improve our website. Here is a clear explanation of how and why we use cookies.

What are cookies? Cookies are small text files stored on your device when you visit a website. They help us remember your preferences, understand how you use our site, and improve your experience.

Types of cookies we use: We use essential cookies (necessary for the website to function), preference cookies (to remember your settings), and analytics cookies (to understand how visitors interact with our site).

Managing cookies: You can control and manage cookies in your browser settings. You can choose to block all cookies or delete existing ones. However, blocking some cookies may affect your experience on our website.

  • Essential cookies for basic functionality
  • Preference cookies for a personalised experience
  • Analytics cookies for continuous improvement
  • Full control through browser settings
Cookie policy – understanding data privacy policy at Touch Spa
Security

Data Breach Response Plan

While we take every precaution to protect your data, we also have a robust response plan in case of a data breach. This ensures we can act quickly and transparently to protect you.

Immediate containment. Our team is trained to identify and contain breaches within minutes of detection. We isolate affected systems and prevent further unauthorised access.

Investigation. We conduct a thorough investigation to understand the cause and scope of the breach. We work with security experts to gather evidence and determine the impact.

Notification. If your data is affected, we will notify you within 72 hours of becoming aware of the breach, as required by GDPR. We will provide clear information about what happened and what you can do.

Preventive measures. After a breach, we review and strengthen our security measures to prevent future incidents. We learn from every event to improve our defences.

  • Rapid containment procedures
  • Thorough investigation protocols
  • 72-hour notification commitment
  • Continuous security improvement
Data breach response plan at Touch Spa
Third Parties

Third-Party Data Sharing – Our Commitment

We are transparent about how we share your data with third parties. We only share your information when necessary to provide our services or as required by law.

Service providers. We work with trusted partners who assist us in operating our website, processing payments, and communicating with you. These partners are contractually obligated to protect your data and use it only for the purposes we specify.

No selling or renting. We do not sell, rent, or trade your personal information to third parties for their marketing purposes. Your data is used exclusively to serve you better.

Legal requirements. We may disclose your data if required by law, such as to comply with a subpoena or legal process. We will notify you of such disclosure where permitted.

  • Data shared only with trusted providers
  • No selling or renting of data
  • Contractual protections in place
  • Legal compliance with transparency
Third-party data sharing policy at Touch Spa
Your Rights

Your Rights in Practice – How to Use Them

Knowing your rights is important. Here is how you can exercise them in practice when dealing with Touch Spa.

Access your data. You can request a copy of all personal data we hold about you. Simply email us with the subject "Access Request". We will provide your data in a clear, readable format within 30 days.

Correct your data. If any information we hold about you is incorrect, you can request a correction. Provide the correct details and we will update our records promptly.

Delete your data. You can request deletion of your data at any time. We will delete your data from our systems, except where we are legally required to retain it.

Object to processing. You can object to the processing of your data for marketing purposes. You can also object to other processing activities based on our legitimate interests.

  • Simple access request process
  • Quick correction of inaccuracies
  • Easy deletion of your data
  • Objection rights clearly explained
How to exercise your privacy rights at Touch Spa
Retention

Data Retention – How Long We Keep Your Data

We do not keep your data forever. We have a clear retention schedule to ensure we keep your data only as long as necessary.

Booking records. We retain booking records for up to 7 years. This is to comply with tax laws and to help us provide continuity of care if you return as a client.

Contact information. We keep your contact information for as long as you remain an active client. If you have not booked with us for 3 years, we may delete your contact data unless you request otherwise.

Marketing data. We keep marketing data until you opt out or request deletion. You can unsubscribe at any time.

Website usage data. We keep anonymised usage data for up to 26 months for analytics purposes. This data does not personally identify you.

  • 7-year retention for bookings
  • Active client contact data
  • Marketing data until opt-out
  • 26 months for anonymised analytics
Data retention schedule at Touch Spa
Security Measures

How We Protect Your Data – A Detailed Look

We take data security seriously. Here is a detailed look at the measures we have in place to protect your personal information.

Encryption. All data transmitted between your device and our website is encrypted using industry-standard SSL/TLS technology. This ensures that your data cannot be intercepted and read by unauthorised parties.

Access controls. Access to your personal data is restricted to authorised personnel only. Our team members are trained in data protection and privacy practices.

Regular audits. We conduct regular security audits and vulnerability assessments to identify and address potential weaknesses in our systems.

Staff training. All staff members receive regular training on data protection, privacy, and security best practices. We believe that a well-informed team is the best defence.

  • SSL/TLS encryption
  • Strict access controls
  • Regular security audits
  • Comprehensive staff training
How we protect your data at Touch Spa
FAQs

Frequently Asked Questions About Privacy

Common questions about our privacy policy, data protection, and your rights.

Have Questions About Privacy?

We are here to help. If you have any questions about our privacy practices, please reach out to us. We value your trust and are committed to protecting your data.

Contact Us Book a Session