Privacy notice.
What we collect when you use the Spa 99 website, why, and the choices you have. Plain words, nothing hidden.
Who we are
Spa 99 is run by BML SPA 99 LIMITED, a company registered in England (company number 16930909). Our registered office is 40 Wellington Avenue, London N15 6AS.
The spa is at BML House, 99c Vale Road, London N4 1PR. We are part of BML Group.
We are the data controller for the information in this notice. That means we decide how it is used, and we are responsible for looking after it.
We are registered with the Information Commissioner's Office. Our registration number is ZC284282.
If you have a question about your information, write to hello@spa99.uk.
What we collect
We collect only what we need, and only when you do something on the site.
When you browse
- Nothing that identifies you. We count visits without cookies (see Cookies, below).
- If a page breaks, an error report is made. It leaves out names, email addresses and IP addresses, but can include your account's internal number and the type of browser.
When you take the guided journey
- Your answers: when you would come, how often, what you would use, whether you come alone, what you do (and, for property, your link to property and roughly how many properties), how you heard about us, and anything you type in the short text boxes.
- The membership we suggest, and why.
- About the visit: the page that linked to us (if any), campaign tags in the link, the kind of device (phone, tablet or computer), and when you started and finished.
Answers are saved as you go, even if you stop part way. They carry no name unless you register.
- Your email address, if you give it. Before the journey shows your suggested membership and price, it asks for your email, with a tick to say Spa 99 may email you about opening. We keep the address with your answers, the date you gave it and the version of this notice in force. If you are signed in, we use your account email instead and do not ask.
When you register
- Your name, email address, UK mobile number, date of birth and password. The password is stored scrambled (hashed), so nobody can read it, including us.
- That you accepted the men-only policy and this notice (which version), with the dates.
- Whether you would like news from us by email, and when you told us.
- The membership you registered for, your account ID, and whether you have confirmed your email.
- Sign-in records: when you sign in and out, failed attempts, and the IP address and browser used.
When you apply for the Gold Card
- Your name, email address and mobile number.
- What you do. For property: your link to property and roughly how many properties. Also the area you are based in, your company and role, whether you work with BML, who referred you, and any note you add.
- Your journey answers, if you took the journey.
- A potential rating (High, Medium or Low) worked out from your answers, with its reasons.
- Whether you would like news from us by email, and which version of this notice you accepted.
- Our decision and, if we approve, the date and the invitation we send you.
- If our team writes to you about your application (for example to ask a question), a record of that email.
When you use the Ask us chat
- What you type to the assistant and its replies, with the time. If you gave your email to see prices, or you are signed in, the chat is linked to it. We do not store your IP address with a chat.
Change history
- Earlier versions of your details (a change history): when your account, registration or Gold Card application changes, we keep the previous version, so we can see what changed and put mistakes right. Passwords are never kept in it.
Emails
- A record of each email we send you: which email, when, and whether it went out.
- Emails you send us, kept in our mailbox.
Our team
- When our team use our own tools, we record what they do, with their IP address and browser, to keep the system secure. This covers team accounts only.
Why we use it
The law asks us to name a lawful basis for each use. Here they are.
To run your account and registration
Creating your account, keeping your registered membership, confirming your email, resetting your password and writing to you about opening. Basis: a contract with you, or steps you asked us to take before one.
To check you can join
Spa 99 is for men aged 18 and over. We use your date of birth and your acceptance of the men-only policy to check this. Basis: steps before a contract, and our legitimate interest in running the spa as described.
To suggest a membership and plan the spa
Your journey answers give you a suggestion. Added together with everyone else's, they show us which times and rooms matter most. Those figures are totals, never decisions about you. Basis: legitimate interests.
To consider a Gold Card application
We read your application, and the potential rating helps us. Our team may email you with questions about it. The rating never decides on its own: a person does. Basis: steps before a contract, and legitimate interests.
To send news, only if you ask
We send news by email only if you said yes. You can stop it at any time in My Spa 99, or by writing to hello@spa99.uk. Basis: your consent.
To email you about opening after the journey
If you gave your email in the guided journey and ticked the box, we use it to send news about the opening and to understand which membership suits people (your answers, linked to your address, show us what people choose). Basis: your consent. You can withdraw it at any time by following the unsubscribe link in any email or by writing to hello@spa99.uk; we then stop emailing you and delete the address.
To answer your questions in the chat
The Ask us assistant answers questions about Spa 99 from our own information. It does not make decisions about you. Basis: legitimate interests.
To keep the site and your account safe
Sign-in records, limits on repeated attempts, error reports and our team's activity records. Basis: legitimate interests.
When the law requires it
Keeping records we must keep, and answering lawful requests. Basis: legal obligation.
If you do not give us your details
The guided journey is optional. To register or apply for the Gold Card, we need the details the form asks for; without them we cannot create your account or consider your application. News by email is always optional.
We do not sell your information, and we do not use it for advertising.
Men only, 18 and over
We ask for your date of birth to confirm you are 18 or over, and we ask you to accept our men-only policy. We use your date of birth for this and to run your membership, nothing else. We do not ask for documents online.
The site is not meant for anyone under 18. If we learn that someone under 18 has an account, we delete it.
Cookies
We use only cookies the site needs to work. No analytics, advertising or tracking cookies. That is why there is no cookie banner.
- csrftoken: protects our forms from misuse. Lasts one year.
- sessionid: keeps you signed in, or remembers a step while you use the site. Lasts up to two weeks. Our team's sign-ins to our own tools last up to 30 days.
- messages: shows a short note, such as "Saved", on the next page. Gone when you close the browser.
- spa99_journey: remembers your place in the guided journey, so you can come back to it. Lasts one year, and is removed when you sign out.
While you fill in the Gold Card application, your browser keeps what you have typed in that tab, so a refresh does not lose it. The virtual tour also remembers a few display choices in that tab, such as the simpler view. Both stay on your device and are cleared when you close the tab.
The visitor counter
To know how many people visit, we count without cookies. For each visit, our server mixes your IP address and browser details with a random value that changes every day, and turns them into a one-way code. The code lets us count you once a day. Your IP address and browser details are never stored. Each day's codes and random value are deleted the next day, so they cannot be traced back to you.
We also note the name of the website that sent you, such as a search engine. Only the name, never the full address.
Where it is kept
Our Amazon services run in London. Sentry keeps error reports in the European Union, which UK law recognises as protecting personal data properly.
Postmark is based in the United States, so the emails we send you pass through and are briefly stored there. This is covered by the UK-US data bridge or the UK International Data Transfer Agreement.
Anthropic, which runs the Ask us assistant, is based in the United States, so what you type in the chat is processed there. This is covered by the UK-US data bridge or the UK International Data Transfer Agreement. Please do not put personal or sensitive details in the chat.
If a provider handles information outside the UK, for example for support, we make sure the safeguards UK law requires are in place, such as the UK International Data Transfer Agreement or the UK-US data bridge.
How long we keep it
No longer than we need to.
- Your account: while you keep it. You can delete it at any time. If an account is not used for three years, we write to you, then delete it.
- Accounts whose email is never confirmed: 90 days.
- Journey answers with no account: two years, then deleted.
- Your email address from the journey: two years after you gave it, or until you unsubscribe, withdraw consent or register (then it is kept as part of your account), whichever comes first. The answers then stay only as anonymous figures.
- Gold Card applications we do not approve: one year after our decision.
- Sign-in records: one year.
- Records of emails we send: two years.
- Emails you send us: two years after we last hear from you.
- Visitor counter codes: deleted the next day.
- Ask us chats: 90 days, then deleted automatically.
- Error reports: 90 days.
- Change history: two years, or until you delete your account, whichever comes first.
- Our team's activity records: two years.
- Backups: replaced within 35 days.
Where the law asks us to keep something longer, such as payment records once memberships begin, we keep it for the time the law requires.
Your rights
You can ask us to:
- show you the information we hold about you (access)
- correct anything that is wrong (rectification)
- delete your information (erasure)
- hold your information but stop using it for a while (restriction)
- stop using it where we rely on legitimate interests, and always for news (objection)
- give it to you in a file you can take elsewhere (portability)
Where we rely on your consent, you can withdraw it at any time.
Do it yourself in My Spa 99
Under You, Download my data gives you a file of everything we hold about your account. Delete my account erases your account, your registration, any Gold Card applications made with your email, the email you gave in the journey, our records of emails about you, your sign-in records, and the change history of all of these. Your journey answers stay only as anonymous figures, no longer linked to you.
For anything else, write to hello@spa99.uk. We reply within one month, and there is no charge.
Complaints
If you are unhappy with how we use your information, please tell us first at hello@spa99.uk, so we can put it right.
You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
We update this notice when what we do changes. The date at the top shows the current version. If a change matters to you, we will tell you by email.
Contact
Write to hello@spa99.uk, or by post to BML SPA 99 LIMITED, 40 Wellington Avenue, London N15 6AS.