Privacy Policy
This Privacy Policy explains how Sunshine Thai Massage SARL collects, uses and protects personal data when you visit our website, contact us, request a gift voucher or use our online booking service.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679, commonly known as the GDPR, and applicable data protection laws in Luxembourg.
1. Data Controller
The data controller responsible for the processing of personal data through this website is:
Sunshine Thai Massage SARL
17 Boulevard Royal
2449 Ville-Haute
Luxembourg
Telephone: +352 661 333 999
Email: sunshinethaimassage.luxe@gmail.com
Website: www.sunshine-thaimassage.luxe
2. Personal Data We May Collect
Depending on how you use our website, we may collect the following personal data:
- Your name
- Your email address
- Your telephone number
- Your postal address, when delivery by post is requested
- Information included in messages sent through our contact forms
- Gift voucher order information
- The name of a gift voucher recipient
- Information provided when making or managing an appointment
- Technical information such as IP address, browser type, device type and website activity
- Cookie preferences and consent records
Please do not submit sensitive medical or health information through the website forms unless it is specifically requested and necessary.
3. Contact Forms
When you contact us through a form on this website, we process the information you provide so that we can answer your enquiry, provide requested information or take the necessary steps before providing a service.
Our website uses Contact Form 7 to manage website forms. Information submitted through a form may be sent to us by email and may be temporarily processed through the website and hosting infrastructure.
The legal basis for this processing is:
- Taking steps at your request before entering into a contract
- Performing a contract or providing a requested service
- Our legitimate interest in responding to enquiries and communicating with customers
- Your consent, where consent is specifically requested
4. Gift Voucher Requests
When you request a gift voucher through our website, we may process:
- Your name and contact details
- The selected gift voucher amount
- The recipient’s name
- An optional personal message
- Your chosen delivery method
- Your postal address if delivery by post is selected
- Information required to identify and confirm your payment
This information is used to process the gift voucher request, confirm payment, prepare the voucher, arrange collection or postal delivery and contact you regarding the order.
The legal basis for processing is the performance of a contract or taking steps at your request before entering into a contract.
Please ensure that you have permission to provide personal information relating to another person, such as the gift voucher recipient.
Bank payment information is processed by the banks and payment providers involved in the transaction. This website does not collect or store your complete online banking login details.
5. Appointment Bookings through Salonkee
Online appointments are provided through the external booking platform Salonkee.
When you click a booking link, you are redirected to Salonkee’s website or booking system. Salonkee may collect and process personal data such as:
- Your name
- Your email address
- Your telephone number
- Your selected treatment
- Your selected appointment date and time
- Booking history and account information
- Technical and device information
Salonkee processes information according to its own privacy policy and terms. Sunshine Thai Massage SARL may receive the information necessary to administer and provide your appointment.
The legal basis for processing appointment information is the performance of a contract or taking steps at your request before entering into a contract.
You can review Salonkee’s information before completing your booking:
6. Telephone and Email Contact
When you contact us by telephone or email, we process the information necessary to respond to your enquiry, administer an appointment, manage a gift voucher or provide our services.
The legal basis is the performance of a contract, taking steps at your request before entering into a contract or our legitimate interest in communicating with customers.
7. Website Hosting
This website is hosted by one.com.
When you visit the website, technical data may be processed on the hosting provider’s servers. This may include:
- IP address
- Date and time of access
- Requested page or file
- Referring website
- Browser and operating system information
- Technical error and security logs
This processing is necessary to operate the website, maintain security, prevent misuse and diagnose technical problems.
The legal basis is our legitimate interest in providing a secure and functional website.
one.com acts as a service provider and data processor for data stored or processed through its hosting services.
8. Server Log Files
The website and hosting provider may automatically record technical information in server log files. This information is generally used for website security, troubleshooting, statistical analysis and protection against unauthorised access.
Server log information is not normally combined with other information to identify individual visitors unless this is necessary to investigate misuse, fraud or a security incident.
9. Cookies and Similar Technologies
This website may use cookies and similar technologies to ensure that the website functions correctly, remember preferences, measure website use and enable external services.
We use Complianz to manage cookie information and, where required, request and record your consent.
Essential cookies may be used without consent where they are strictly necessary for the operation and security of the website. Non-essential cookies and external services are only activated where required after consent has been provided.
You can change or withdraw your cookie consent at any time through the cookie settings available on the website.
For detailed information about the cookies and services used on this website, please see our:
10. Google Maps
This website may display an interactive map provided by Google Maps to show our location and help visitors obtain directions.
When Google Maps is activated, information may be transferred to Google. This may include your IP address, browser information, device information, location-related information and information about how you interact with the map.
Google may use cookies or similar technologies and may process information outside the European Economic Area. Where required, Google Maps is blocked until you provide consent through our cookie consent system.
Google is responsible for the processing it carries out through its own services.
11. Google Fonts
This website may use fonts provided by Google Fonts.
Where possible, fonts are stored locally on the website. If fonts are loaded directly from Google’s servers, your IP address and technical browser information may be transmitted to Google.
Where legally required, externally loaded Google Fonts will only be activated after consent has been provided.
12. External Links
Our website may contain links to external websites, booking platforms, social media services or other third-party services.
When you follow an external link, the relevant third party is responsible for its own website and processing of personal data. We recommend reviewing the third party’s privacy information before providing personal information.
13. Social Media
Our website may include links to social media profiles or communication services.
A simple link does not normally transfer information to the social media provider until you click it. After clicking the link, the provider may receive information such as your IP address, browser information and the page from which you accessed the service.
If social media content is embedded directly on the website, it may be blocked until you provide consent where required.
14. Images and Website Content
This website may contain private photographs, business photographs and licensed images obtained from authorised image providers.
Private photographs and images belonging to Sunshine Thai Massage SARL may not be copied, downloaded, reproduced or used by third parties without prior written permission.
Licensed images are used in accordance with the relevant licence conditions and remain subject to the rights of their respective copyright owners.
15. Legal Bases for Processing
Depending on the situation, we process personal data on one or more of the following legal bases:
- Consent: where you have actively agreed to specific processing
- Contract: where processing is necessary to provide a service, appointment or gift voucher
- Pre-contractual steps: where you contact us before purchasing or booking a service
- Legal obligation: where information must be retained or disclosed under applicable law
- Legitimate interests: where processing is necessary to operate, protect and improve our business and website, provided that your rights do not override those interests
16. Sharing of Personal Data
We do not sell or rent personal data.
Personal data may be shared only where necessary with service providers such as:
- Website hosting and email service providers
- Website maintenance and technical service providers
- Salonkee for online bookings
- Postal or delivery providers when a gift voucher is sent by post
- Banks, accountants or payment providers where necessary
- Professional advisers
- Public authorities where disclosure is required by law
Service providers may only process personal data for the agreed purpose and are required to protect the information appropriately.
17. International Data Transfers
Some external service providers may process personal data outside Luxembourg or outside the European Economic Area.
Where personal data is transferred internationally, we take reasonable steps to ensure that an appropriate legal transfer mechanism and suitable safeguards are used, where required by applicable data protection law.
18. Data Retention
We keep personal data only for as long as necessary for the purpose for which it was collected and to comply with legal, accounting, tax and contractual obligations.
In general:
- General enquiries are retained only for as long as necessary to respond and handle the matter
- Appointment information may be retained for customer service, administration and legal purposes
- Gift voucher and payment records may be retained for the period required by accounting and tax law
- Consent records may be retained for as long as necessary to demonstrate compliance
- Technical security logs are normally retained for a limited period unless required to investigate a security incident
Information may be retained for longer where necessary to establish, exercise or defend legal claims.
19. Data Security
We use reasonable technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration or disclosure.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
20. Your Data Protection Rights
Subject to the conditions of the GDPR, you may have the right to:
- Request access to your personal data
- Request correction of inaccurate or incomplete personal data
- Request deletion of your personal data
- Request restriction of processing
- Object to processing based on legitimate interests
- Withdraw consent at any time
- Request data portability where applicable
- Lodge a complaint with a data protection supervisory authority
Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise your rights, please contact:
sunshinethaimassage.luxe@gmail.com
We may need to request additional information to verify your identity before responding to a data protection request.
21. Complaints
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the Luxembourg data protection authority:
Commission Nationale pour la Protection des Données – CNPD
National Commission for Data Protection
Luxembourg
Website: cnpd.public.lu
We would appreciate the opportunity to address your concern directly before you submit a complaint.
22. Children’s Data
This website is not specifically directed at children. Children should not submit personal data through the website without the permission and supervision of a parent or legal guardian.
23. Changes to This Privacy Policy
We may update this Privacy Policy when our website, services, legal obligations or external service providers change.
The current version will always be published on this page.
Last updated: 22 July 2026