Privacy Policy

1 Introduction

Nayana Spa respects your privacy and handles your personal information with care. This Privacy Policy explains what information we collect when you visit www.nayanaspa.com, book a treatment, or contact us, and how we use and protect it.

Nayana Spa is operated by Zarya Wellness Spa Management Company and is located at Ramada Hotel & Suites by Wyndham Ajman, Sheikh Khalifa Bin Zayed Street, Al Rashidiya 1, Ajman, United Arab Emirates. In this policy, "Nayana Spa", "we", "us" and "our" refer to the spa and its operating company.

We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and other applicable laws. By using our website or services, you acknowledge that you have read this policy.

2 Information We Collect

Information you give us directly

• Contact and booking details: your name, phone number, email address, preferred date and time, and the treatment you are interested in, when you fill in a form on our website, call us, message us on WhatsApp, or reach us through social media.
• Health and wellness information: before a massage, Moroccan bath or other treatment, we may ask about allergies, injuries, pregnancy, skin conditions or other health matters. We collect this only so your therapist can deliver the treatment safely, and we treat it as sensitive data.
• Visit and payment records: the treatments you receive, therapist preferences, package or gift-voucher details, and payment confirmations. Card payments are processed by our payment providers; we do not store your full card number.
• Feedback and reviews: comments, survey answers or reviews you share with us.

Information collected automatically

When you browse our website, we and our service providers automatically collect technical data such as your IP address, device and browser type, approximate location, pages viewed, time spent on pages, the website or advertisement that referred you, and actions such as clicking a call or WhatsApp button.

Information from third parties

We may receive limited information from platforms you use to interact with us, such as Google, Facebook, Instagram, TripAdvisor or booking partners, for example when you send an enquiry through our Google Business Profile or a social media page.

3 Cookies and Tracking Technologies

Our website uses cookies, pixels and similar technologies to keep the site working, understand how visitors use it, and measure our advertising.

You can block or delete cookies through your browser settings, although some parts of the website may not work properly. You can also manage ad personalisation through Google Ad Settings and your Facebook or Instagram ad preferences, and opt out of Google Analytics with the Google Analytics opt-out add-on.

4 How We Use Your Information

We use your information only for clear, legitimate purposes:

• To respond to enquiries and confirm, change or remind you about bookings.
• To deliver treatments safely, taking your health information and preferences into account.
• To process payments, packages, memberships and gift vouchers.
• To send offers, seasonal promotions and news by WhatsApp, SMS, email or social media, where you have agreed to receive them.
• To improve our website, services and customer experience, including through feedback and reviews.
• To measure and improve our online advertising.
• To keep our website and premises secure and prevent fraud or misuse.
• To meet legal, tax, licensing and regulatory obligations in the UAE.

We rely on your consent (for example, for marketing and for sensitive health information), on the need to perform the service you requested, on our legal obligations, and on our legitimate interest in running and improving our business. Where we rely on consent, you can withdraw it at any time.

5 How We Share Your Information

We do not sell your personal information. We share it only when needed, and only with:

• Our team and operating company: therapists, reception staff and Zarya Wellness Spa Management Company, on a need-to-know basis.
• Service providers: website hosting, booking and messaging tools (such as WhatsApp), payment processors, and analytics and advertising platforms (such as Google and Meta). They may use your data only to provide services to us.
• Ramada Hotel & Suites by Wyndham Ajman: only where you ask us to, for example to charge a treatment to your hotel room. The hotel handles that information under its own privacy policy.
• Authorities and advisers: government authorities, courts, auditors or legal advisers when required by law or to protect our rights, clients or staff.
• Business transfers: a buyer or successor if our business is reorganised, merged or sold, under the same privacy protections.
• International transfers: some of our service providers, such as Google and Meta, may store or process data outside the UAE. When this happens, we take reasonable steps to ensure your information receives adequate protection, as required by UAE law.

6 Data Retention and Security

We keep personal information only as long as we need it for the purposes in this policy, or as long as UAE law requires. Booking, consultation and payment records are kept for the period needed for our services, accounting and legal obligations. Marketing data is kept until you unsubscribe. After that, we securely delete or anonymise the information.

We use reasonable technical and organisational safeguards to protect your information, including secure (HTTPS) website connections, restricted staff access, and confidentiality obligations for our team and service providers. Health information from consultation forms is accessible only to staff who need it to deliver your treatment. No method of transmission or storage is completely secure, but we work to protect your data and will act promptly on any breach as required by law.

7 Your Rights and Choices

Subject to applicable law, you have the right to:

• Ask what personal information we hold about you and receive a copy.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete your information, or to restrict or stop certain processing.
• Withdraw your consent at any time, including for marketing messages.
• Object to the use of your information for direct marketing.
• Raise a complaint with the UAE Data Office if you believe your data has been mishandled.

To use any of these rights, contact us using the details in Section 10. We may need to verify your identity first, and we will respond within the time required by law.

Marketing messages: you can opt out at any time by replying "STOP" to a WhatsApp or SMS message, clicking "unsubscribe" in an email, or contacting us directly.

Visitors from outside the UAE: if you are a resident of the European Union, United Kingdom or another region with its own data protection laws, you may have additional rights under those laws, and we will honour them where they apply.

8 Children's Privacy

Our website and services are intended for adults aged 18 and over. We do not knowingly collect personal information from children through our website. Treatments for minors, where offered, require a parent or guardian to book and be present. If you believe a child has sent us personal information, please contact us and we will delete it.

9 Third-Party Links and Changes to This Policy

Our website may link to other websites and platforms, such as Google Maps, WhatsApp, Instagram, Facebook, TripAdvisor or booking partners. We are not responsible for their privacy practices, so please review their policies before sharing information with them.

We may update this Privacy Policy from time to time to reflect changes in our services or the law. The updated version will be posted on this page with a new effective date. We encourage you to review it periodically.

10 Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, please contact us: