Legal information
Privacy Policy
In accordance with Regulation (EU) 2016/679 (GDPR)
This Privacy Policy describes how Clariva LTD collects, uses, stores, and protects personal data of individuals interacting with its digital channels, in full compliance with Regulation (EU) 2016/679 (GDPR) and applicable Cypriot data protection law.
1. Data Controller Information
Clariva LTD acts as the Data Controller in respect of all personal data collected and processed as described in this Privacy Policy.
- Company Name
- Clariva LTD
- Registered Address
- Alyos Street, Germasogeia 4046, Limassol, Cyprus
- Industry / Services
- Spa and wellness services
- booking@clarivaspa.com
- Company Registration Number
- Registered in the Republic of Cyprus
Clariva LTD is registered and operates in the Republic of Cyprus and is subject to the supervisory authority of the Commissioner for Personal Data Protection of Cyprus, as well as the requirements of the GDPR.
Clariva LTD is in the process of appointing a Data Protection Officer (DPO) in accordance with applicable requirements. Until such appointment is confirmed, data protection enquiries should be directed to the contact details set out in Section 9 of this Policy.
2. Personal Data Collected
Clariva LTD collects only the personal data specified below. No additional categories of data are collected or inferred beyond what is expressly listed. Should the scope of data collection change in the future, this Policy will be updated accordingly.
2.1 Categories of Data Collected
- Electronic mail address (email address) — collected when an individual interacts with the Company's website landing pages, digital advertising forms, or automated chatbot interfaces.
- Name (full or preferred) — collected when an individual books a treatment online or submits an enquiry through website contact forms; required to identify the client when confirming and providing the service.
- Telephone number — collected when an individual books a treatment online or submits an enquiry; used to confirm the booking, communicate scheduling changes, and provide operational contact in relation to the service.
- Booking comment (optional, provided by the client) — free-text notes or preferences relating to the treatment; stored together with the booking record.
2.2 Data Not Currently Collected
The following categories of data are not currently collected by Clariva LTD:
- Postal address or location data
- Payment or financial information (payment is taken on-site at the point of service)
- Special categories of personal data (Article 9 GDPR) — not applicable
No data is collected from individuals under the age of 16. If Clariva LTD becomes aware that personal data has been collected from a minor, it will be deleted without undue delay.
3. Purpose of Processing
Personal data is processed exclusively for the purposes set out below. Data shall not be processed in a manner incompatible with the stated purposes (Article 5(1)(b) GDPR).
- Processing bookings and delivering spa and wellness services: booking confirmation, schedule change notifications, client identification at the appointment.
- Responding to enquiries submitted through the Company's digital channels, including chatbot interactions and contact forms.
- Direct marketing and promotional communications relating to Clariva LTD spa and wellness services.
- Lead generation and customer acquisition in connection with advertising campaigns.
- Improving the quality and relevance of communications, advertising content, and client experience.
- Compliance with legal obligations applicable to the Company.
4. Legal Basis for Processing
Clariva LTD processes personal data only where a valid legal basis under Article 6 GDPR exists. The applicable legal bases are set out below:
4.1 Consent (Article 6(1)(a) GDPR)
Where personal data is collected via website landing pages, advertising forms, or chatbot interfaces, the legal basis for processing is the freely given, specific, informed, and unambiguous consent of the data subject. Consent is obtained prior to the collection of data and individuals are informed of the purposes of processing at the point of collection.
Data subjects have the right to withdraw their consent at any time without detriment. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
4.2 Legitimate Interests (Article 6(1)(f) GDPR)
Clariva LTD may also rely on its legitimate business interests as a legal basis for processing in limited circumstances, such as improving service quality, preventing fraud, and ensuring the security of its digital channels. In each such case, a balancing assessment is conducted to ensure that the interests of Clariva LTD do not override the rights and freedoms of the data subject. Data subjects retain the right to object to processing on this basis at any time (see Section 7).
4.3 Legal Obligation (Article 6(1)(c) GDPR)
To the extent required by applicable Cypriot or European Union law, Clariva LTD may process personal data to comply with legal obligations, including tax, accounting, and regulatory requirements.
4.4 Performance of a Contract (Article 6(1)(b) GDPR)
Where an individual books a treatment online or otherwise enters into a service contract with Clariva LTD, the processing of the name, telephone number, and other data provided at booking is necessary for the performance of such contract or in order to take steps at the data subject's request prior to entering into a contract. Without providing such data, the Company will not be able to confirm the booking and provide the service.
6. Data Storage and Retention
6.1 Storage Location
Personal data collected by Clariva LTD is stored on secure cloud-based infrastructure hosted within the European Economic Area (EEA). All storage providers engaged by the Company are required to implement appropriate technical and organisational security measures in accordance with Article 32 GDPR.
6.2 Retention Period
Personal data shall be retained only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the principle of storage limitation under Article 5(1)(e) GDPR. As a general rule:
- Email addresses collected for marketing purposes are retained for a period of two (2) years from the date of last interaction, unless the data subject withdraws consent or requests erasure at an earlier date.
- Booking data (name, telephone number, booking comment) is retained in the Company's CRM system for the duration of the active client relationship and for up to five (5) years from the date of the last visit, after which it is anonymised or deleted.
- Data retained for compliance with legal obligations (including tax records of completed bookings) is held for the period required by applicable law, typically up to seven (7) years.
Once the applicable retention period expires, personal data will be securely deleted or irreversibly anonymised.
6.3 Security Measures
Clariva LTD implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure, in accordance with Article 32 GDPR. Measures in place include:
- Encryption of personal data in transit using industry-standard TLS protocols.
- Access controls ensuring that personal data is accessible only to authorised personnel on a need-to-know basis.
- Regular review of security practices and procedures.
- Contractual requirements imposed on all third-party processors to maintain equivalent security standards.
7. Rights of Data Subjects
In accordance with Chapter III of the GDPR, individuals whose personal data is processed by Clariva LTD are entitled to exercise the following rights:
- Right of Access (Article 15): The right to obtain confirmation as to whether personal data concerning the individual is being processed, and to receive a copy of such data.
- Right to Rectification (Article 16): The right to request correction of inaccurate or incomplete personal data without undue delay.
- Right to Erasure / 'Right to be Forgotten' (Article 17): The right to request deletion of personal data where it is no longer necessary for the original purpose, consent is withdrawn, or no legitimate grounds for processing remain.
- Right to Restriction of Processing (Article 18): The right to request that processing be restricted in certain circumstances, including where accuracy is contested or the processing is unlawful.
- Right to Data Portability (Article 20): The right to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller, where processing is based on consent or contract and is carried out by automated means.
- Right to Object (Article 21): The right to object at any time to processing based on legitimate interests, including for direct marketing purposes. Upon receipt of such an objection, Clariva LTD will cease processing personal data for direct marketing without delay.
- Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of prior processing.
- Right not to be Subject to Automated Decision-Making (Article 22): The right not to be subject to solely automated decisions, including profiling, which produce legal or similarly significant effects.
To exercise any of the above rights, data subjects may contact Clariva LTD at the details set out in Section 9 of this Policy. Clariva LTD will respond to requests within one (1) month of receipt, unless the complexity or volume of requests necessitates an extension of up to two (2) additional months, in which case the data subject will be informed without undue delay.
Data subjects also have the right to lodge a complaint with the Commissioner for Personal Data Protection of Cyprus (the competent supervisory authority), or with any other EU supervisory authority in the Member State of their habitual residence or place of work, if they consider that the processing of their personal data infringes the GDPR.
9. Contact Information
For any questions, requests, or concerns relating to this Privacy Policy or the processing of personal data by Clariva LTD, data subjects may contact the Company using the details below:
- Data Controller
- Clariva LTD
- Registered Address
- Alyos Street, Germasogeia 4046, Limassol, Cyprus
- Email Address
- booking@clarivaspa.com
Requests submitted by email will be acknowledged within five (5) business days. Responses to substantive requests regarding the exercise of data subject rights will be provided within one (1) month in accordance with Article 12 GDPR.
10. Changes to This Privacy Policy
Clariva LTD reserves the right to amend this Privacy Policy at any time. Material changes will be communicated to data subjects by appropriate means, which may include notification via email or a prominent notice on the Company's website. The date of the most recent revision is indicated at the top of this document.
Continued use of the Company's digital channels following notification of amendments constitutes acceptance of the revised Policy, to the extent permitted by applicable law.