Privacy Policy

Last updated: 16 September 2026

Gentlemans Massage Spa ("we", "us") respects your privacy. This policy explains what personal data we collect, why, and your rights under Kenya's Data Protection Act, 2019.

What we collect

Booking details: your name, phone number, email (optional), preferred treatment and time, and any notes you give us.
Health information you choose to share: injuries, conditions, allergies or pregnancy, so we can give you a safe treatment.
Payment records: M-Pesa transaction references and card payment confirmations. We do not store full card numbers.
Website data: our hosting provider may log basic technical data such as IP address and browser type for security.

How we use it

To confirm, manage and remind you of bookings
To give you a safe, suitable treatment
To keep financial records required by law
To send occasional offers, only if you agree. You can opt out at any time.

We rely on your consent, on the need to perform our service for you, and on our legal obligations.

Who we share it with

We never sell your data. We share it only with service providers who help us run the business, such as our form processor (FormSubmit), messaging (WhatsApp), payment providers (Safaricom M-Pesa, card processors) and our website host, and where the law requires it.

How long we keep it

Booking and health notes are kept for up to two years after your last visit. Financial records are kept for as long as Kenyan tax law requires.

Your rights

You can ask to access, correct or delete your data, object to its use, or withdraw consent. You can also complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.

Security

Client records are kept securely and accessed only by staff who need them.