Privacy Notice

The Wash & Spa is the data controller for the personal data described in this notice.

Information you give us

When you create an account, make a booking or contact our support team, we collect:

• Identity and contact data: your name, email address and phone number
• Billing data: billing details needed to process payment for your orders
• Communications: the messages and enquiries you send us

Information we collect automatically

When you use the Services, we collect:

• Technical data: IP address, device details, browser type and operating system
• Usage data: the pages and features you visit and how you interact with them

Cookies and similar technologies

We use cookies and similar technologies to remember your preferences and understand how the Services are used. See Section 9 for details.

Special categories

We do not intentionally collect any special categories of personal data (such as health or biometric data). Please do not send us such information.

On this website

The franchise application form collects only what you type into it: your name, mobile number and email address; the city and area where you want a store; whether you have a space and the liquid capital (yes or no); and, if you choose, your occupation, a preferred call time and a message. The nearest-store feature works in your browser, and your chosen store is remembered on your own device only.

We only process your personal data when we have a lawful basis to do so. The table shows what we use your data for and the legal basis for each purpose.

Where we rely on legitimate interests, we have considered your rights and expectations and concluded that they do not override those interests. You can ask us for more detail about this assessment at any time.

We do not sell your personal data. We share it only where necessary with:

• Service providers (processors) who help us run the Services, such as hosting and IT providers, payment processors, delivery partners and customer-support tools. They may only use your data on our instructions and under written agreements that require appropriate security and confidentiality.
• Public authorities, courts and regulators where we are legally required to disclose information, or where disclosure is needed to protect our rights, privacy, safety or property.
• Business successors if our business is sold, merged or restructured, in which case your data may be transferred to the new owner, who must continue to protect it in line with this notice.

Some of our service providers may be located outside your country or outside the European Economic Area (EEA). Where we transfer personal data to such countries, we make sure it is protected by an appropriate safeguard, such as an adequacy decision, Standard Contractual Clauses approved by the European Commission, or another mechanism permitted by law.

You can contact us to request a copy of the safeguards we use.

[TO CONFIRM: the countries or regions where data is transferred]

We keep personal data only for as long as needed for the purposes described in this notice, including to meet legal, tax, accounting and reporting requirements.

When data is no longer needed, we delete or anonymise it.

Under data protection law, you have the following rights over your personal data:

• Access: to receive confirmation that we process your data and a copy of it.
• Rectification: to have inaccurate or incomplete data corrected. You can also update much of your data directly through our website or app.
• Erasure ("right to be forgotten"): to ask us to delete your data in certain circumstances.
• Restriction: to ask us to limit how we use your data in certain circumstances.
• Data portability: to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Objection: to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Withdraw consent: where we rely on your consent (for example, for marketing), you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
• Not be subject to solely automated decisions that have legal or similarly significant effects on you. We do not currently make such decisions.

How to exercise your rights

Email us at infowashandspa@gmail.com. We may need to verify your identity before acting on your request. We will respond within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you why. There is normally no charge.

Opting out of marketing

Use the unsubscribe link in any marketing message, or contact us directly.

Right to complain

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work or where you believe an infringement occurred. We would appreciate the chance to address your concerns first, so please contact us in the first instance.

You are not obliged to give us your personal data, but some of it (such as your name, contact details and billing information) is necessary for us to create your account and deliver your orders. Without it, we may not be able to provide the Services. Providing data for marketing is entirely optional.

Cookies are small files stored on your device. We use them to:

• Keep the Services working (strictly necessary cookies, which do not require consent)
• Remember your preferences
• Understand how the Services are used so we can improve them (analytics)

Where required by law, we place non-essential cookies only after you give consent, and you can change or withdraw your choice at any time through your browser settings.

[TO CONFIRM: a cookie settings link, and the list of cookies used with their purpose and duration, if any]

Our Services are not directed at children under [TO CONFIRM: 16, or the age of digital consent in your country], and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration and disclosure across our website and mobile app. These include encryption in transit (HTTPS) and a private database that cannot be read without an access token [TO CONFIRM: any further measures, such as staff confidentiality obligations and regular security reviews].

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach is likely to put your rights and freedoms at risk, we will notify you and the relevant authority as required by law.

We may update this Privacy Notice from time to time. We will post the updated version on our website and mobile app and change the "Last updated" date above. If we make significant changes, we will give you clearer notice, such as an email or an in-app message, and where the law requires it, we will ask for your consent again.

For any questions about this notice or how we handle your personal data, or to exercise your rights, contact us at:

• The Wash & Spa
• Email: infowashandspa@gmail.com
• Address: [TO CONFIRM: registered address]

At The Wash & Spa, your privacy is our priority. We are committed to keeping your personal information confidential and secure while delivering the best laundry services.