Privacy Policy & Data Protection

1. Commitment to Data Sovereignty & Privacy

At Illusions Premier Spa & Wellness Ecosystem ("Illusions", "we", "us", or "our"), your personal privacy and confidential wellness information are treated with the highest tier of hospitality security. We comply strictly with the Kenya Data Protection Act (2019) and international hospitality data privacy standards.

This Privacy Policy applies to all interactions across our physical sanctuaries (Rivaan Centre, Azure Towers, Westlands, Nairobi), our online booking engine, our companion homecare portal, and our Nappily sanitary boutique.

2. Information We Collect

To deliver customized luxury wellness experiences and seamless transactions, we collect only necessary data categories:

• Identity & Contact Details: Full name, telephone number (M-Pesa registered format), email address, and delivery location.
• Health & Wellness Profile: Confidential consultation forms detailing pressure preferences, allergies, skin sensitivities, or medical conditions required to ensure safe therapy administration.
• Transaction & Order Telemetry: Reservation timestamps, purchased services, M-Pesa transaction receipts, and payment method identifiers. We do not store debit/credit card CVV codes or payment PINs.
• Sanctuary Loyalty Data: Earned tier status, point balances, and cryptographic PIN hashes used for member redemption security.

3. Lawful Basis & Data Usage Purpose

We process your personal information strictly for:

• Fulfilling spa treatment reservations, therapist scheduling, and suite preparation.
• Transmitting transactional SMS/Email confirmations, appointment reminders, and live dispatch tracking links.
• Facilitating secure M-Pesa STK push settlements and verifying transaction receipts against our authoritative ledger.
• Continuous quality assurance, therapist training, and dispute resolution.
• Fulfilling legal, tax, and accounting reporting requirements mandated by the Kenya Revenue Authority (KRA).

4. Zero Sale of Personal Data

We maintain a strict Zero Third-Party Data Monetization Policy. We will never sell, rent, monetize, or trade your personal or health information to third-party advertisers, data brokers, or marketing networks.

5. Data Storage, Cryptography & Retention

All client information is housed within isolated multi-tenant databases with encrypted transport layers (TLS 1.3 / HTTPS) and bcrypt-hashed authentication controls.

Client consultation health notes are retained for active treatment continuity and archived under strict role-based access control (RBAC). Inactive records may be anonymized or deleted upon customer request.

6. Your Rights as a Data Subject

Under the Kenya Data Protection Act (2019), you possess the right to:

• Access (Instant Self-Service): View and instantly export your complete, verified Sanctuary Booking & Ritual Ledger (as an official PDF statement or CSV data spreadsheet) directly within your Customer Account Portal.
• Rectification: Correct inaccurate phone numbers, addresses, or profile details at any time via our concierge or self-service portal.
• Erasure: Request the deletion of non-statutory account data ("Right to be Forgotten").
• Withdraw Consent: Opt out of promotional newsletters or automated SMS updates while retaining transactional service notices.

7. Data Protection Officer & Inquiries

If you have questions regarding this policy or wish to exercise your data rights, please contact our Data Governance Concierge at privacy@illusions-spa.com or call +254 (0) 791 200 019.