Privacy Policy
Last updated: 10 October 2026
1. Introduction
Welcome to Serendia Wellness.
At Serendia Wellness, we respect your privacy and are committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, book a session, attend a retreat, purchase a service, subscribe to our massage membership, complete a health waiver, sign up for marketing emails or otherwise interact with us.
We are committed to handling your personal information responsibly and in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable privacy and electronic communications legislation.
Please read this policy carefully to understand what information we collect, why we collect it, how we use it and the rights you have over your personal information.
2. Who We Are
For the purposes of applicable data protection legislation, Serendia Wellness is the data controller responsible for your personal information.
Business name: Serendia Wellness
Address: Marne House, 123-127 Deepcut Bridge Road, Deepcut, Surrey, England, United Kingdom, GU16 6SD
Website: https://serendiawellness.com
Email: jessica@serendiawellness.com
If you have any questions about this Privacy Policy or how your personal information is handled, please contact us using the email address above.
3. Personal Information We Collect
We may collect and process the following categories of personal information, depending on how you interact with our website and services.
3.1 Information You Provide Directly
This may include:
Your name.
Your email address.
Your telephone number.
Your address and billing address, where applicable.
Booking and appointment details.
Retreat registrations and enquiries.
Information submitted through contact forms.
Information provided through Google Forms or other registration forms.
Information provided when registering interest in an event, retreat or service.
Communications you send to us.
Information relating to your purchases, massage membership or subscriptions.
Feedback, reviews or testimonials you choose to provide.
3.2 Health and Wellbeing Information
When you book or attend massage therapy, sound therapy, yoga, breathwork, holistic treatments, coaching, retreats or other wellness services, we may collect health and wellbeing information where necessary to provide the relevant service safely and appropriately.
This may include information you provide through health waivers, client intake forms, consultations or other communications, such as:
Relevant medical conditions or health concerns.
Injuries or physical limitations.
Allergies or sensitivities.
Pregnancy-related information where relevant.
Medication information where relevant.
Physical or mental wellbeing information.
Relevant treatment preferences or accessibility requirements.
Health information is considered special category personal data under the UK GDPR and receives additional legal protection.
We will only process health information where we have identified an appropriate lawful basis and a separate legal condition for processing special category data.
We aim to collect only the information reasonably necessary for the relevant service.
Please avoid sharing unnecessary sensitive information through general contact forms or ordinary email.
3.3 Booking and Payment Information
Bookings are managed through Acuity Scheduling, which is connected to our website.
When you book a session, treatment, online event or other service, we may process information such as your name, contact details, appointment details, booking history and relevant communications.
Payments may be processed through Stripe or PayPal. We may also accept payment by bank transfer.
Payment providers may process your payment information in accordance with their own privacy policies.
We do not intend to collect or store full payment card details ourselves when these are handled directly by the relevant payment provider.
We may retain payment confirmations, transaction references, invoices and other necessary financial records for accounting, administrative and legal purposes.
3.4 Massage Membership and Subscription Information
If you join our massage membership or another subscription service, we may process information necessary to establish and manage your membership.
This may include:
Your name and contact details.
Membership and subscription details.
Subscription status and payment history.
Renewal and cancellation information.
Relevant booking and membership communications.
Recurring payments are processed through the payment arrangements available for your subscription.
We use this information to administer your membership, manage recurring payments, respond to enquiries and fulfil our contractual and legal obligations.
3.5 Retreat Registrations
If you register interest in or book a retreat, we may collect information through Google Forms or other registration methods.
Depending on the retreat and the information requested, this may include your contact details, booking preferences, relevant dietary or accessibility requirements, emergency contact details, and health or wellbeing information you choose to provide.
We will use this information to respond to your enquiry, administer your registration, communicate relevant arrangements and support the safe organisation of the retreat.
Where health information is collected, we will apply the additional protections required for special category data.
3.6 Website and Technical Information
When you visit our website, certain technical information may be collected automatically, depending on the website configuration and the technologies in use.
This may include:
Your IP address.
Browser type and version.
Device and operating system information.
Pages visited.
The date and time of visits.
Referring websites.
Website usage and diagnostic information.
Cookie identifiers and similar online identifiers.
We use this information where appropriate to operate, maintain, secure and improve our website.
Non-essential cookies and similar technologies will only be used with your consent where required by law.
4. How We Use Your Personal Information
We may use your personal information for the following purposes:
To respond to enquiries and messages.
To manage bookings and appointments.
To provide massage therapy, yoga, sound therapy, breathwork, coaching, day retreats, residential retreats and other wellness services
To administer retreats, events and group sessions.
To manage online sessions and related communications.
To process purchases, payments and refunds.
To administer massage memberships and recurring subscriptions.
To review relevant health information where necessary for the safe provision of a service.
To manage customer relationships and respond to requests.
To send booking confirmations, appointment reminders and service updates.
To send marketing emails where we have the necessary permission.
To publish and maintain blog content.
To understand how our website is used and improve its performance.
To maintain business, accounting and financial records.
To protect our website, services and customers against fraud, misuse and security threats.
To comply with legal obligations and establish, exercise or defend legal claims where necessary.
We will not use your personal information for purposes that are incompatible with those explained in this policy without providing further information and obtaining consent where required.
5. Our Lawful Bases for Processing
We must have an appropriate lawful basis for processing personal information under the UK GDPR.
Depending on the circumstances, we may rely on the following lawful bases.
Contract
We process personal information where necessary to enter into or perform a contract with you.
This may include managing bookings, delivering services, administering your massage membership, processing transactions and communicating with you about purchases.
Consent
We rely on consent where appropriate, including for certain marketing communications, non-essential cookies and other activities where consent is legally required.
Where we process health information on the basis of explicit consent, we will seek a clear, specific and affirmative indication of your agreement.
You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Legitimate Interests
We may process personal information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.
These interests may include responding to general business enquiries, maintaining website security, managing our business operations and improving our services.
Where we rely on legitimate interests, we will consider whether the processing is necessary and proportionate.
Legal Obligation
We may process personal information where necessary to comply with applicable legal obligations, including relevant accounting, tax and record-keeping requirements.
Special Category Personal Data
Where we process health or other special category personal data, we will identify both an appropriate lawful basis under Article 6 of the UK GDPR and a separate applicable condition under Article 9.
Where appropriate, this may include obtaining your explicit consent to process relevant health information.
Consent to process personal data is separate from consent to receive a treatment or participate in a wellness activity.
We will not assume that completing a health waiver automatically provides every form of consent required under data protection law.
6. Marketing Emails
We may send emails about our services, wellness sessions, retreats, events, membership options, offers, news and other updates.
We will only send marketing emails where permitted by applicable law.
Where consent is required, we will ask you to opt in and will not treat consent as a condition of purchasing a service where it is not necessary.
You can unsubscribe from marketing emails at any time by using the unsubscribe link included in the email or contacting us directly.
If you unsubscribe, we will stop sending the relevant marketing communications, although we may retain limited information where necessary to record your preference and ensure that you are not contacted again.
We may continue to send essential service-related communications, such as booking confirmations, subscription administration messages and important updates relating to a service you have purchased.
We do not sell your personal information to third parties for their own marketing purposes.
7. Cookies and Website Technologies
Our website is hosted on Squarespace and may use cookies and similar technologies to support essential website functionality and other features.
Depending on the website configuration, these technologies may be used for:
Essential website functionality.
Remembering preferences.
Website performance and analytics.
Understanding visitor interactions.
Advertising or marketing measurement, if implemented.
Some cookies may be provided by third-party services integrated with our website.
Strictly necessary cookies may be used where permitted by law. We will seek consent before using non-essential cookies or similar technologies where required.
You can manage your preferences through our cookie settings, where available.
You can also manage cookies through your browser settings, although blocking certain cookies may affect website functionality.
For further information, please consult our cookie settings or any separate Cookie Policy we make available.
8. Third-Party Services
We use third-party platforms and service providers to operate our website, manage bookings, collect forms, process payments and communicate with customers.
These may include the following services.
Squarespace
Our website is hosted and operated through Squarespace. Information submitted through or collected by the website may be processed by Squarespace to provide website functionality, hosting, security and related services.
Acuity Scheduling
We use Acuity Scheduling to manage bookings and appointments through our website.
Information provided during the booking process may be processed by Acuity to facilitate appointments and related communications.
Stripe and PayPal
We use Stripe and PayPal to process payments where available.
These providers process payment information in accordance with their own privacy notices and applicable requirements.
Jotform
We use Jotform to collect personal information through forms, including health waivers and relevant client information.
Please provide only the information requested and necessary for the relevant service.
Google Forms and Related Google Services
We may use Google Forms to collect retreat registrations, expressions of interest and other information relating to our services.
Information submitted through these forms may be processed using the relevant Google services.
Other Providers
We may use additional providers for email communications, website analytics, file storage, administration or other business functions.
We will take appropriate steps to ensure that personal information is handled lawfully and that suitable data protection arrangements are in place where required.
Some providers may act as independent data controllers for their own purposes. Their own privacy policies may apply to those activities.
You can consult the privacy information published by the relevant providers for further details about their data handling practices.
9. Sharing Your Personal Information
We do not sell your personal information.
We may share personal information with third parties where necessary for the purposes explained in this policy.
These recipients may include:
Website hosting and technical service providers.
Booking and appointment platforms.
Payment processors.
Form and registration platforms.
Email and communication providers.
Professional advisers, such as accountants or legal advisers.
Insurers where necessary and appropriate.
Regulators, public authorities or law enforcement agencies where disclosure is required by law.
Other parties where necessary to establish, exercise or defend legal claims.
We aim to limit the information shared to what is reasonably necessary for the relevant purpose.
Where a provider processes personal information on our behalf, we will put appropriate contractual and organisational safeguards in place where required.
We will not disclose your health information to unrelated third parties for their own marketing purposes.
10. International Transfers
Some of our third-party providers may store or process personal information outside the United Kingdom.
Where personal information is transferred internationally, we will take the steps required by applicable data protection law to ensure that the transfer is lawful.
Depending on the circumstances, this may include relying on an applicable adequacy regulation or decision, approved contractual safeguards or another permitted transfer mechanism.
You may contact us for further information about international transfers relevant to your personal information.
11. How Long We Keep Your Information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including meeting applicable legal, accounting, safety and record-keeping requirements.
The retention period depends on the type of information and the reason it is held.
Health Waivers and Client Health Information
When you complete a health waiver or client intake form through Jotform, we use the information to help us understand relevant health considerations and prepare for the safe delivery of your treatment or wellness session.
Completed forms are stored in our business workspace email environment and retained between appointments so that we can refer to the information when preparing for your next session.
We review the relevant information again before subsequent appointments to check whether anything needs updating. We may ask you to confirm or update your information if your circumstances have changed.
We retain these forms only for as long as reasonably necessary for the relevant services, client safety, appropriate record-keeping and any applicable legal or professional obligations.
Booking and Appointment Records
We retain relevant booking and appointment information for as long as necessary to manage appointments, provide our services and meet applicable legal or business record-keeping requirements.
Retreat Registrations
Information collected through retreat registration and expression-of-interest forms is retained for as long as necessary to manage enquiries, registrations, retreat arrangements and any relevant legal obligations.
Membership and Subscription Records
We retain membership details, subscription information, payment records and cancellation information for as long as necessary to administer memberships, manage payments and meet applicable legal and accounting requirements.
Financial Records
Invoices, payment confirmations and transaction records are retained for the periods required by applicable tax, accounting and legal obligations.
Marketing Information
If you subscribe to our marketing emails, we retain your information while you remain subscribed or until you withdraw consent where consent is the applicable lawful basis. We may retain limited information where necessary to record and respect your decision to unsubscribe.
Website Information
Technical information and cookie-related data may be retained according to the relevant purpose, applicable requirements and the settings of the website technologies we use.
We periodically review our retention practices and take appropriate steps to securely delete, anonymise or otherwise dispose of personal information when it is no longer required.
12. How We Protect Your Information
We take appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration and disclosure.
These measures may include appropriate access restrictions, secure service providers, account security measures and other safeguards proportionate to the nature and sensitivity of the information.
Access to health information should be limited to those who genuinely need it for the relevant service or business purpose.
However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.
If a personal data breach occurs, we will respond in accordance with applicable legal requirements.
13. Your Data Protection Rights
Under applicable data protection law, you may have the right to:
Access: Request a copy of the personal information we hold about you.
Rectification: Ask us to correct inaccurate or incomplete information.
Erasure: Request deletion of your personal information where the relevant legal conditions are met.
Restriction: Ask us to restrict processing in certain circumstances.
Data portability: Request certain information in a structured, commonly used, machine-readable format where the legal requirements apply.
Object: Object to certain types of processing, including direct marketing and, where applicable, processing based on legitimate interests.
Withdraw consent: Withdraw consent at any time where consent is the basis for processing.
These rights are subject to applicable legal conditions and exceptions. For example, we may need to retain certain information to comply with legal obligations or establish, exercise or defend legal claims.
To exercise your rights, please contact us using the contact details provided in this policy.
We may need to verify your identity before responding to your request.
We will respond within the time limits required by applicable law.
14. Children’s Privacy
Our services and website are primarily intended for adults unless a particular activity is expressly offered to children.
We do not knowingly collect children’s personal information without an appropriate legal basis and any necessary authorisation or consent.
If you believe a child has provided personal information to us in circumstances where it should not have been collected, please contact us so that we can review the situation.
15. Third-Party Websites
Our website may contain links to external websites, blogs, booking platforms or other third-party services.
If you follow these links, the privacy policies of the relevant organisations may apply.
We are not responsible for the privacy practices or content of third-party websites, and we encourage you to review their privacy information before providing personal information.
16. Automated Decision-Making
We do not intend to make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significant effects, unless we inform you otherwise and have an appropriate legal basis.
If this changes, we will provide the information required by applicable data protection law.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, website, third-party providers, business practices or legal obligations.
Any updated version will be published on this page, together with the revised date.
We encourage you to review this page periodically.
18. Contact Us
If you have any questions about this Privacy Policy, want to exercise your data protection rights or have concerns about how your personal information is handled, please contact:
Serendia Wellness
Marne House, 123-127 Deepcut Bridge Road, Deepcut, Surrey, England, United Kingdom GU16 6SD
Website: https://serendiawellness.com
Email: jessica@serendiawellness.com