Privacy Policy

Renovar Haven Wellness & Spa, 2b Adenugba Street, off Ziatech Road (Daystar Church Road), Oregun, Ikeja, Lagos, Nigeria.

We are the data controller for the personal information described in this policy. For all data-related enquiries, corrections, or requests, contact our designated data privacy contact:

WhatsApp: +234 916 641 6172
Email: renovarhavenbooking@gmail.com

We will respond to all data requests within 30 days of receipt.

• Booking details — your name, WhatsApp or phone number, email address (if you provide one), the services you select, your chosen date and time, and any notes or preferences you share with us.
• Gift voucher details — the recipient's name and, where you provide it, a personal message.
• Payment information — deposits and payments are processed by Paystack. We receive only a transaction reference and status confirmation. We never see, store, or have access to your full card number, CVV, or bank credentials.
• Technical information — basic device, browser, and usage data collected by cookies and analytics tools to keep the site functioning and to improve the user experience.

• To create, confirm, reschedule, and deliver your booking.
• To take a deposit or full payment and issue receipts.
• To contact you about your appointment — for example, confirming your slot, following up on an unconfirmed reservation, or notifying you of a change on our side.
• To create and deliver gift vouchers you purchase.
• To maintain a service history so our therapists can tailor future treatments to your needs.
• To meet our legal, accounting, and tax obligations.

We only send marketing messages if you have asked to receive them. Every marketing message includes a clear and simple way to stop them.

• Contract performance — processing necessary to fulfil your booking and any associated payment.
• Legal obligation — processing required to meet our accounting, tax, and regulatory duties under Nigerian law.
• Legitimate interests — processing necessary for the safe and effective operation of the spa, including maintaining appointment records, preventing fraud, and improving our services. We have balanced these interests against your rights and do not believe they override them.
• Consent — for optional analytics cookies and marketing communications. You may withdraw consent at any time without affecting any processing already carried out.

We do not sell your personal data. We share it only with the service providers we need to operate the business:

• Paystack — secure payment processing and transaction verification.
• Lovable (our website and booking platform) — where your appointment is recorded so our team can prepare for your visit.
• WhatsApp (Meta) — when you choose to message us or receive appointment confirmations through that channel.
• Analytics providers — where cookies are enabled, to understand aggregate site usage and improve the booking experience.
• Regulators, legal advisors, or authorities — where disclosure is required by law or to protect our legal rights.

All third-party providers are required to handle your data securely and only for the purposes we specify.

Some of the service providers we use — including WhatsApp (operated by Meta Platforms, Inc., based in the United States) and our analytics tools — may store or process your data outside Nigeria. Where this occurs, we ensure that appropriate safeguards are in place consistent with the requirements of the NDPA, including using providers that operate under recognised data protection frameworks. By using our website or booking a service with us, you acknowledge that your data may be transferred in this way.

Our website may contain links to third-party websites, including our Instagram page, Google Maps, and WhatsApp. Once you leave our site, this privacy policy no longer applies. We recommend reviewing the privacy policy of any third-party site you visit, as we have no control over their content or data practices.

• Essential cookies — keep the site and booking flow working correctly. These cannot be switched off as the site requires them to function.
• Analytics cookies — help us understand which pages and treatments attract the most interest, so we can improve the site. These are optional.

When you first visit the site, a banner allows you to accept all cookies or keep only the essential ones. You can change your choice at any time by clearing this site's data in your browser settings, which will display the banner again.

• Booking and payment records — retained for as long as necessary for treatment history, accounting, and legal purposes, normally up to six years from the date of the appointment.
• Gift voucher records — retained until the voucher expires, plus a reasonable period afterwards for accounting purposes.
• Marketing preferences — retained until you withdraw consent or ask us to stop.
• Technical and analytics data — retained in aggregate or anonymised form for site improvement purposes.

Access to booking and client records is limited to team members who need it to carry out their role. Payment details are handled entirely by Paystack on secure, PCI-DSS-compliant infrastructure.

Treatment notes and anything you share with us in the spa are treated as confidential. Privacy is a core part of the experience we provide.

Under the Nigeria Data Protection Act 2023, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct anything that is inaccurate or out of date.
• Erasure — request deletion of your data where we have no ongoing legal reason to keep it.
• Restriction — ask us to limit how we use your data in certain circumstances.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdrawal of consent — withdraw any consent you previously gave, at any time.

To exercise any of these rights, message us on WhatsApp at +234 916 641 6172 or email renovarhavenbooking@gmail.com with your name and the phone number used for your booking. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng. We would appreciate the opportunity to resolve any concern directly before you contact the Commission.

Our services are intended for adults. We do not knowingly collect personal data from anyone under the age of 18 without a parent or guardian arranging the booking on their behalf. If you believe we have collected data from a minor without appropriate consent, please contact us immediately so we can address it.

We may update this policy from time to time to reflect changes in our services, technology, or legal obligations. The date at the top of this page shows when it was last revised. We recommend checking back periodically. Where changes are material, we will make reasonable efforts to notify you directly.