Privacy Policy

1. Overview & Data Controller

Welcome to Purple Mighty ("we", "our", or "us"). We respect your privacy and are committed to protecting the personal data you share with us when using our website, booking mobile wellness and massage treatments, or interacting with our customer support teams.

For the purposes of the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), Purple Mighty Ltd acts as the Data Controller responsible for processing your personal data.

2. Information We Collect

To provide our specialized mobile massage and spa party services directly to your location (Zones 1-6 and surrounding areas), we collect several categories of information:

A. Personal Identification Data

• Contact details: Full name, email address, telephone/WhatsApp contact number.
• Location data: Full address, postcode, access instructions, or hotel room number for mobile therapist dispatch.
• Account credentials: Username, password, and communication preferences.

B. Health & Wellness Intake Data (Special Category Data)

Because safety and physical well-being are paramount during therapy sessions (e.g., Swedish, Deep Tissue, Medical, or Sports Massage), we may ask for relevant health information. This includes injuries, medical conditions, allergies, skin sensitivities, or pregnancy status. We process this data strictly with your explicit consent prior to treatment.

C. Booking & Payment Details

• Therapy preferences, booking timestamps, duration, and group event specifications.
• Payment information processed securely via PCI-compliant payment gateways (we do not store raw credit card numbers on our local servers).

3. How We Use Your Information

We process your personal information for the following specific purposes:

• Service Fulfillment: Coordinating with assigned certified therapists to perform treatments at your chosen home, hotel, or corporate location.
• Communication: Sending booking confirmations, therapist dispatch notifications, customer support updates, and schedule adjustments.
• Personalisation: Remembering your atmospheric and therapy preferences (e.g., preferred pressure level, aromatherapy vibes).
• Safety & Compliance: Ensuring our treatments are medically suitable and upholding health and safety standards for both clients and therapists.
• Platform Improvement: Analyzing usage patterns to enhance website performance and client satisfaction.

4. Legal Grounds for Processing

Under UK GDPR, we rely on the following legal bases to process your personal data:

• Contractual Necessity: Necessary to perform the contract when you request and book a massage or spa session.
• Explicit Consent: Required for collecting health consultation notes or sending optional direct promotional emails.
• Legitimate Interests: Necessary to operate, safeguard, and improve our business operations effectively.
• Legal Obligation: Compliance with financial records, taxation, and legal accounting rules in the UK.

5. Data Sharing & Third Parties

We value your trust and never sell your personal data to third parties. We only share information with trustworthy service partners who adhere to strict data security standards:

• Assigned Therapists: Dispatched self-employed or employee therapists receive necessary booking details (first name, appointment time, address/location notes, and treatment preferences).
• Payment Service Providers: Secure payment gateways to process transactions and handle refunds smoothly.
• Technical Service Providers: Cloud hosting, encrypted database providers, and customer support management systems.

6. Your Legal Rights (UK GDPR)

Subject to data protection laws, you possess the following rights regarding your personal data:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where valid grounds exist.
• Right to Restrict or Object: Object to marketing messages or restrict processing under certain conditions.
• Right to Data Portability: Obtain a structured, machine-readable copy of your data.

To exercise any of these rights, please reach out to our Data Protection Officer using the contact details below.

7. Data Retention & Security

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy or to satisfy statutory accounting, legal, and insurance reporting requirements.

We maintain technical and organizational security measures—including SSL encryption, restricted access controls, and regular security reviews—to prevent unauthorized access, loss, or misuse of your personal data.