Privacy Policy

Rejuvenate Spa is a medical spa at Rose Garden, Rockley, Christ Church, Barbados, owned and run by Danielle Gonsalves. When you book a treatment, buy from us, write to us, join our mailing list or take one of our online courses, we decide how your information is used. That makes us the data controller under the Barbados Data Protection Act, 2019.

For anything about your information, contact Danielle Gonsalves at info@rejuvenatebarbados.com or on (246) 241-7565.

• rejuvenatebarbados.com: treatments, our shop, bookings, enquiries and the mailing list.
• learn.rejuvenatebarbados.com: our online courses, your course account and online booking.
• The spa itself: consultations, treatments, photographs and payments.

When you book a treatment. Your name, phone number and email address, the treatment, the date and time you choose, any deposit you pay and anything you write in the notes box. We use this to hold your appointment, remind you of it and contact you if something changes. Please keep detailed medical information for your consultation.

When you place an order. Your name, email address and phone number, what you ordered, how you chose to pay, and any note you add. We use this to prepare your order, to answer questions about it and to keep the records the law requires.

When you pay by card. You enter your card details on Scotiabank's secure payment page, not on our website. We never see or store your full card number or security code. Scotiabank tells us whether the payment succeeded, with a reference, an authorisation code, the card type and the last four digits of the card, and we keep those with your order.

When you write to us. Your name, email address and message, and your phone number and area of interest if you give them. We use these to reply.

When you join our mailing list. Your email address only. We email you a link first, and you join only if you click it, so nobody can add you without your knowledge. Every email we send has a link to leave the list, and it works at once.

When you create an account. Your name, email address and a password, stored scrambled and never readable. We use this so you can sign in, see your orders and keep a wishlist.

When you take a course. Your account details, which lessons you have finished, and any answers you submit. If a course gives a certificate, it shows your name.

When you visit either website. Our hosting providers record your device's internet address, the page requested and the time, as any web server does. We use this to run the sites and to slow down spam and password guessing. We also count visits each day without cookies and without recording who you are.

When you visit the spa. We keep notes from your consultation and treatments so we can treat you safely. If you have a skin analysis, its images and results form part of that record. With your written consent, we may take before-and-after photographs. We will never publish a photograph of you without separate written permission. We keep a record of deposits and payments.

• Bookings, orders and course accounts: you asked us to provide something, and we need the information to do it.
• Treatment records: we need them to treat you safely, as part of the care you asked for. Health information is sensitive, so only the people treating you see it.
• Records the law requires, such as sales records for tax: we have to keep them.
• The mailing list: you gave your consent, and you can withdraw it at any time.
• Photographs: only with your written consent.
• Website logs, visit counts and spam protection: we have a legitimate interest in keeping the sites safe and working.

We do not sell your information, and we never will. There is no advertising or tracking on our websites. A few companies handle information for us so that our systems work, and they may use it only to do that work:

• Vercel. Runs this website and keeps standard web server logs.
• Cloudways and DigitalOcean. Run our shop, booking and course system, which holds orders, bookings, accounts and course records.
• Scotiabank and its processor Fiserv. Take card payments. You type your card details on Scotiabank's secure page, not on ours, and we receive only the result, the card type and the last four digits.
• Resend. Sends our emails (order and booking confirmations, replies, the newsletter) and keeps the mailing list.
• Our email provider. Holds the business inbox where your emails to us arrive.
• Teralith Incorporated. Builds and looks after our website. Its client system keeps a copy of booking requests and messages sent through the site, and a daily count of visits that identifies no one, so we can see how the site is doing.
• Google Maps. Shows the map on our contact page; Google sees your internet address when it loads.
• WhatsApp (Meta). Only if you choose to message us on WhatsApp.

We share information with anyone else only if the law requires it, for example a court order, or to protect someone from serious harm.

Most of these companies store information in the United States, and card payments are processed through Scotiabank's international payment network. We use them because they are reliable and secure, because each must protect your information, and because we could not offer online booking, ordering, payment, email and courses without them. By using our websites and services, you agree to your information being handled outside Barbados for these purposes.

• Booking details: 2 years after the appointment.
• Orders and payment records: 7 years, for tax and accounting.
• Enquiries sent through the website: 2 years.
• Accounts, wishlists and course records: until you ask us to delete your account, or 3 years after you last sign in.
• Mailing list: until you leave the list; after that only your address stays on a do-not-email list, so you are never added back by mistake.
• Consultation and treatment records: 7 years after your last treatment.
• Photographs and skin analysis images: 7 years after your last treatment, or sooner if you withdraw consent.
• Website logs: as set by our hosting providers, usually a few weeks.

Under the Barbados Data Protection Act you can:

• ask what we hold about you, and get a copy free of charge;
• ask us to correct anything wrong;
• ask us to delete your information, where the Act allows;
• ask us to stop using it for a time while something is sorted out;
• ask for your information in a form you can take elsewhere;
• object to how we use it.

Contact us using the details at the top of this page. We may ask you to confirm who you are before we hand anything over. We reply within one month. If a request is complicated we may need up to two more months, and we will tell you why within the first month.

Stopping use that causes you damage or distress. If our use of your information causes, or is likely to cause, you substantial and unwarranted damage or distress, you can tell us in writing to stop. We will reply in writing within 21 days.

Stopping marketing. You can tell us in writing to stop using your information for marketing, and the same 21 days apply. The quickest way is the link in any of our emails, which works at once.

We do not make decisions about you by computer alone. A person is always involved.

Our treatments are for adults. We treat anyone under 18 only with the written consent of a parent or guardian, and we only use a young person's information with that consent. Our websites are not meant for children under 18.

If you only read our pages, nothing is stored on your device. Our cookies page lists everything that is stored when you fill your bag, sign in or use a course. We use no cookies for advertising, analytics or tracking.

Both websites use encrypted connections. Card details never pass through our systems. Passwords are stored scrambled. Only people who need your information to serve you can see it, and paper records at the spa are kept locked away.

If your information is lost or exposed and that puts you at risk, we will tell the Data Protection Commissioner within 72 hours of finding out where possible, and we will tell you without delay if the risk to you is high, as the Act requires.

If you are unhappy with how we have used your information, please tell us first so we can put it right. You can also complain to the Data Protection Commissioner of Barbados, whose office deals with complaints under the Act.

If we change how we use your information, we will update this page and the date at the top. If the change is significant, we will tell you before it takes effect.