Last updated: 02/09/2026

​

Casa Alma (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use and protect your personal information when you visit our website, contact us, or book and receive treatments from us.

​

Casa Alma is the data controller responsible for the personal information we collect and use.

​

Contact: info@casaalmawellness.co.uk
Business address:

​

1. Information We Collect

Depending on how you interact with Casa Alma, we may collect the following information:

​

This may include:

• Your name

• Email address

• Telephone number

• Booking and appointment details

• Information you provide when contacting us

• Information you provide when making or managing an appointment

• Payment or transaction information where applicable

• Any other information you voluntarily provide to us

​

Treatment and wellbeing information

​

Where necessary to assess whether a treatment is suitable and safe, we may ask you to provide information relating to your health, medical history, medications, injuries, pregnancy or other relevant circumstances.

Health information is treated as special category data under UK data protection law and requires additional protection and a specific condition for processing.

We will only collect health information that is relevant and necessary for the provision and safe delivery of your treatment.

​

Information collected when you use our website

​

When you visit our website, certain technical information may be collected automatically, such as:

• IP address

• Browser and device information

• General information about how you use our website

• Information collected through cookies and similar technologies

The information collected will depend on the cookies and other technologies enabled on our website.

​

2. How We Use Your Information

We may use your personal information to:

• Respond to enquiries and messages

• Manage and confirm appointments

• Provide treatments and services

• Assess the suitability of treatments

• Communicate with you about your appointment

• Process payments where applicable

• Maintain appropriate business and financial records

• Respond to questions, complaints or requests

• Improve our services and website

• Comply with our legal and regulatory obligations

• Protect the security of our business, website and clients

We will only use your personal information where we have a lawful basis to do so.

​

3. Our Lawful Bases

Depending on the circumstances, we may rely on one or more of the following lawful bases under UK data protection law:

​

Contract

We may process information where it is necessary to arrange or provide a treatment or service you have requested.

For example, we need your name and contact details to arrange your appointment.

​

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation.

Legitimate interests

We may process information where it is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms.

For example, this may include managing our business, responding to enquiries and maintaining the security of our website.

​

Consent

Where required, we may ask for your consent before processing certain information or using certain technologies.

Where we rely on consent, you have the right to withdraw it at any time.

​

4. Health Information

Some of our treatments may require us to collect information about your health or wellbeing to determine whether a treatment is appropriate and to provide it safely.

We will only collect information that is relevant to this purpose and will not ask for information that we do not reasonably need.

Where we rely on consent to process health information, we will seek the appropriate explicit consent separately from other types of consent. Explicit consent must be a clear affirmative statement and must be capable of being withdrawn.

You are responsible for providing accurate and up-to-date information and for informing us of any relevant changes to your circumstances.

​

5. Booking Through Fresha

Appointments may be booked and managed using Fresha, our third-party booking platform.

When you use Fresha to make an appointment, information you provide may be processed by Fresha in accordance with its own privacy policy and terms.

This may include information such as your name, contact details, appointment details and payment information.

Where treatment-related information is collected through Fresha, this may also include information relevant to your health or treatment suitability.

We recommend reviewing Fresha's Privacy Policy before submitting information through its booking system.

Casa Alma remains responsible for the personal information that we control, while Fresha may have its own responsibilities as a separate organisation in relation to information it processes.

​

6. Who We Share Your Information With

We may share personal information with trusted third-party service providers where this is necessary to operate our business and provide our services.

These may include:

• Fresha, for appointment booking and management

• Payment providers, where applicable

• Website and hosting providers, including Wix

• IT, email and communications service providers

• Professional advisers where reasonably necessary

• Government, regulatory or law-enforcement authorities where we are legally required to do so

We do not sell your personal information to third parties.

Where we use third-party service providers to process personal information on our behalf, we take reasonable steps to ensure that appropriate data protection arrangements are in place.

​

7. How Long We Keep Your Information

We will only keep your personal information for as long as we reasonably need it for the purposes described in this Privacy Policy, including where necessary to:

• Provide our services

• Maintain business and financial records

• Deal with complaints or disputes

• Meet legal or regulatory requirements

• Establish, exercise or defend legal claims

Different types of information may be kept for different periods.

When information is no longer required, we will securely delete it or anonymise it where appropriate.

[INSERT YOUR SPECIFIC RETENTION PERIODS ONCE DECIDED]

​

8. Keeping Your Information Secure

We take reasonable technical and organisational measures to protect your personal information from:

• Unauthorised access

• Loss

• Misuse

• Alteration

• Disclosure

• Accidental destruction

Access to personal information is limited to people and organisations that reasonably need it for the purposes described in this Privacy Policy.

However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.

9. Cookies

Our website may use cookies and similar technologies to provide essential website functionality, remember preferences and, where permitted, understand how visitors use our website.

Some cookies are strictly necessary for the website to function and do not require consent.

Where we use non-essential cookies, such as analytics or tracking technologies, we will provide appropriate information and obtain consent where required by law. Analytics cookies are not automatically exempt from consent requirements.

You can manage your cookie preferences through the cookie settings provided on our website.

For more information about the cookies used by our website, please see our Cookie Policy or cookie settings.

​

10. Your Data Protection Rights

Depending on the circumstances, you have rights under UK data protection law, including the right to:

• Request access to the personal information we hold about you

• Ask us to correct inaccurate or incomplete information

• Ask us to delete your personal information in certain circumstances

• Ask us to restrict how we use your information in certain circumstances

• Object to certain processing

• Request the transfer of certain information to another organisation

• Withdraw consent where we rely on consent as our lawful basis

These rights are subject to certain legal conditions and exemptions.

If you would like to exercise any of your rights, please contact us using the details below.

Email: info@casaalmawellness.co.uk

We may need to verify your identity before responding to a request.

 

11. Marketing Communications

We may occasionally wish to contact you about Casa Alma's services, offers or other marketing communications.

Where applicable, we will only send electronic marketing communications where we have the appropriate legal basis and any consent required under applicable law.

You can unsubscribe from marketing communications at any time.

We will not make marketing a condition of receiving our treatments.

​

12. Third-Party Websites

Our website may contain links to third-party websites or services, including our online booking provider.

We are not responsible for the privacy practices or content of third-party websites.

We recommend reviewing the privacy policies of any third-party service before providing them with personal information.

​

13. Children's Information

Our services and website are not specifically directed at children.

We do not knowingly collect personal information from children through our website unless this is necessary for a service we provide and appropriate arrangements have been made.

If you believe that a child has provided personal information to us without appropriate consent, please contact us.

​

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or the way we process personal information.

The latest version will always be made available on this website.

​

15. Contact Us

If you have any questions about this Privacy Policy or how we use your personal information, please contact us:

Casa Alma
Email: [EMAIL ADDRESS]
Address: [BUSINESS ADDRESS]

16. Complaints

If you are unhappy with how we have handled your personal information, please contact us in the first instance so that we have an opportunity to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.