Privacy Policy

Last updated: 28th October 2026

Hidden Havens Massage ("we", "us") respects your privacy. This policy explains what personal information we collect, why, who we share it with and the choices you have. It applies to www.hiddenhavensmassage.com, book.hiddenhavensmassage.com, our online booking page, and any messages or calls with us. We handle personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA).

Who we are

Hidden Havens Massage
Inside Expand Health, 30 Hudson Street, De Waterkant, Cape Town, 8001
Phone and WhatsApp: 082 701 6275
Email: relax@hiddenhavensmassage.com
Information Officer: Joshua David Philip Hyams

What we collect

When you book or contact us

• Your name, phone number and email address

• Your appointment details: treatment, date, time, therapist and any notes you add

• Messages you send us by WhatsApp, phone, email or social media

• For home visits: the address you'd like us to come to

Health and comfort information

Before or during a session, we may ask about injuries, medical conditions, pregnancy or areas to avoid, so your therapist can work safely. This is health information, which POPIA treats as special personal information. We collect it only with your consent, use it only to plan and give your treatment, and share it only with your therapist.

Payments

Any online payments are processed by Booklink; we don't see or store your full card details. Remaining payments are taken in person at the studio.

When you visit our websites

Our websites use cookies and similar technologies to work properly, to understand how people use them, and to measure and improve our advertising. These collect information such as your device and browser type, the pages you view, how you arrived (for example from a Google ad) and your approximate location. See Cookies and advertising below.

How we use your information

We use your information to:

• take, confirm, change and remind you of bookings

• give you a safe, suitable treatment

• reply to your questions and messages

• keep records we're required to keep for tax and accounting

• understand how our websites and ads perform, and show our ads to people likely to be interested

• send you news or offers, only if you've opted in; you can unsubscribe at any time

We rely on your consent, on what's needed to provide the service you've booked, on our legal obligations, and on our legitimate interest in running and promoting the business.

Who we share it with

We don't sell your personal information. We share it only with service providers who help us run the business, and only as much as they need:

• Booklink, our online booking system

• WhatsApp (Meta), if you message us there

• Google (Google Ads, Google Analytics), for advertising and website statistics

• Squarespace and Netlify, which host our websites

• Our therapists, for your appointment details

We may also disclose information if the law requires it.

Cookies and advertising

We use Google Analytics to understand how visitors use our websites, and Google Ads to measure which ads lead to bookings. We also use Google Ads remarketing, which may show our ads to people who have visited our websites as they browse other sites. These services set cookies on your device and may process data outside South Africa.

You can:

• manage how Google personalises ads at adssettings.google.com

• opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout

• block or delete cookies in your browser settings (some parts of the website may not work as well)

Information stored outside South Africa

Some of our service providers (such as Google, Meta, Squarespace and Netlify) store data on servers outside South Africa. We use providers that are bound by data protection laws or agreements offering protection similar to POPIA.

How long we keep it

We keep booking and client records for as long as you're a client and up to 5 years after your last visit, and financial records for as long as tax law requires. After that we delete or anonymise them. Website and advertising data is kept according to Google's retention settings.

Keeping it safe

We take reasonable steps to protect your information against loss, misuse and unauthorised access, including limiting who can see it and using reputable, secure service providers. No online system is completely secure, so if a breach ever affects your information, we'll tell you and the Information Regulator as POPIA requires.

Your rights

You have the right to:

• ask what personal information we hold about you and get a copy

• ask us to correct or delete it

• object to us using it, including for marketing

• withdraw your consent at any time (this doesn't affect anything we did before you withdrew it)

To use any of these rights, contact us using the details above. We'll respond within a reasonable time.

If you're unhappy with how we've handled your information, please talk to us first. You can also complain to the Information Regulator (South Africa) at inforegulator.org.za.

Children

Our treatments are for adults only. We don't offer treatments to anyone under 18 and don't knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.