Privacy Policy

This page explains how Lavana Spa handles personal information when you use this website or contact one of our three branches in Dubai to book a treatment. We have kept it short because our practices are short: we hold what you send us to arrange your appointment, and the website records the ordinary technical and analytics data most websites record. Please read it together with our Terms & Conditions.

Who we are

Lavana Spa runs three spas in Dubai, each with its own reception, phone line, WhatsApp and Telegram: Al Barsha (Rooftop, Grand Excelsior Hotel Al Barsha, near Mall of the Emirates, Al Barsha 1); Bur Dubai (HC floor, Grand Excelsior Hotel, Kuwait Street, Mankhool); DIFC (Residence Inn by Marriott, 115 Sheikh Zayed Road, floor 45, Trade Centre Second). There is no central booking desk: a message goes to the branch you choose and is read there. We are responsible for the personal data described on this page, and the branch you contact is the one that holds what you sent it.

What this website does not do

There are no forms, no accounts, no newsletter and no online payment on this site, so it does not ask you for a name, an email address or card details at any point. Booking happens in a conversation with reception, or on Fresha, and the website itself only links to those.

What we collect

What you send a branch. When you message or call reception, we receive what you choose to share: usually a name, a phone number, and the treatment, date and time you have in mind, sometimes with a note about a health condition or a therapist you would like. WhatsApp starts the chat with the branch name already filled in so reception knows which address you mean. We hold only what you volunteer in that conversation.

What Fresha collects. Fresha is a separate booking service. If you use a Fresha link on this site, the details you enter there, including any card details Fresha asks for, are collected and processed by Fresha under its own privacy policy and terms, and the branch sees the booking in its Fresha calendar. This website does not receive or store what you type on Fresha.

Technical data. The site is served through Cloudflare, which processes your IP address and request details for security and to deliver pages quickly, and keeps short-lived logs for that purpose. Google Maps is embedded on the home, contact and location pages: when a map loads, Google receives your request and may set cookies under Google's own privacy policy.

Analytics and advertising measurement. The site uses Google Tag Manager to load Google Analytics 4, Google Ads conversion measurement and the Meta (Facebook) Pixel. They record pages viewed, how you arrived, approximate location, and browser and device type, and they note when a visitor taps a WhatsApp, Telegram, phone or Fresha button, so we can tell which pages lead to bookings and whether our advertising is worth paying for. To keep pages fast, these tools are loaded only after the page has finished rendering.

How we use it

We use what you send a branch to answer you, arrange and hold your appointment, adapt a treatment to anything you told us about your health, and keep the ordinary records a business keeps. We use analytics to see how the site is found and used and to measure advertising. We do not sell personal data, do not share it for anyone else's marketing, and do not use it for automated decisions about you.

Cookies and how to control them

Cookies on this site come from the analytics and advertising tools above and from Google Maps when a map loads; the site sets none of its own. You can block or delete cookies in your browser settings, opt out of Google Analytics with Google's browser add-on, and manage advertising preferences in your Meta account and device settings. Blocking cookies changes nothing about booking: WhatsApp, Telegram, the phone and Fresha work exactly the same.

Who else sees it

A small number of providers process data on our behalf or carry your messages: Cloudflare (hosting), Google (analytics, advertising measurement, embedded maps), Meta (the Pixel, and WhatsApp as a messaging service), Telegram, our telephone providers, and Fresha if you book there. Each processes data under its own terms. We disclose personal data beyond that only where UAE law or a competent authority requires it.

How long we keep it

Messages and booking details stay with the branch for as long as they are needed to serve you and to keep ordinary business records, and are then deleted. Analytics data is held by Google and Meta for the retention periods set in those tools, in aggregated or pseudonymised form. If you would like the messages you sent a branch deleted sooner, ask that branch and it will be done.

Your rights under UAE law

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) you can ask what personal data we hold about you, have anything inaccurate corrected, ask for it to be deleted, and object to or restrict certain processing. To do any of these, message or call the branch you dealt with, or use the details on our contact page, and we will respond within a reasonable time.

Changes to this page

If our practices change, this page changes with them and the date at the top moves. Anything that alters what we collect or why will be described here rather than in a notice you have to hunt for.