Data Policy

Last updated: October 24, 2025

At Calm House Spa, we take your privacy seriously. This Data Policy explains how we collect, process, and protect your personal data in compliance with applicable data protection laws. It also outlines your rights regarding your personal information and how you can exercise them.

1. Scope of This Policy

This policy applies to all data collected through our website spahoian.com, in-person interactions at our spa, and any other communication channels used to provide our services.

2. Data We Collect

We collect different types of data to provide and improve our services:

• Personal data: name, phone number, email address, and booking details provided by you.
• Transactional data: information about the services you purchase or book, including payment confirmations.
• Technical data: IP address, browser type, and usage data when you visit our website.
• Communication data: messages, feedback, or inquiries sent through our contact forms, phone, or email.

3. How We Use Your Data

We use your data to:

• Process and confirm your bookings.
• Provide personalized spa treatments and services.
• Improve our website functionality and customer experience.
• Communicate with you about offers, promotions, or updates (only if you’ve given consent).
• Comply with legal and financial obligations.

4. Data Storage and Retention

We store your personal data securely in our booking and customer management systems. Access is restricted to authorized staff only.

Your data is retained only as long as necessary for the purposes stated in this policy, or as required by law. When data is no longer needed, it will be securely deleted or anonymized.

5. Data Sharing and Third Parties

We do not sell or rent personal data to anyone. We may share limited information with trusted partners only when necessary to provide our services, for example:

• Booking management systems and payment processors.
• Technology providers that host or support our website.
• Analytics and security service providers to monitor performance and protect against misuse.

All partners are required to handle your data securely and in compliance with data protection laws.

6. Data Protection and Security

We use industry-standard security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. This includes secure servers, encryption where applicable, and strict access control for employees.

However, please note that no online transmission or storage system can be guaranteed to be 100% secure.

7. Your Data Rights

You have the right to:

• Access the personal data we hold about you.
• Request corrections to inaccurate or incomplete information.
• Request deletion of your personal data where legally applicable.
• Withdraw consent for receiving marketing communications at any time.

To exercise these rights, please contact us using the details provided below. We may verify your identity before processing your request.

8. International Data Transfers

Our data servers and partners may operate in other countries. When your personal data is transferred or processed outside of Vietnam, we ensure that it receives the same level of protection as required under local privacy regulations.

9. Policy Updates

We may update this Data Policy periodically to reflect new practices or regulatory changes. Updates will be published on this page with a new “Last updated” date. We encourage you to check this page regularly.

10. Contact Us

If you have any questions about this Data Policy or wish to make a data-related request, please contact us:

Effective date: October 24, 2025