Privacy Policy

Last updated: 2 October 2026

1. Who we are

This website, thebotanicalmassage.com, is operated by The Botanical Massage (“we”, “us”), which is responsible for your personal data.

For any privacy question or request, contact us using the details above.

2. What we collect and why

We only collect what we need to answer your request, provide your treatment or deliver a gift voucher.

Booking requests

When you send a booking request from our contact page or a treatment page, we receive:

  • your name and phone number, and your email if you give it;
  • the treatment, preferred date, time and duration;
  • the names and phone numbers of any other guests you add;
  • anything you write in the notes.

The request is sent to our studio by email so we can confirm your appointment. It is not stored on the website. We use it to arrange and provide your session at your request.

Please only share another guest’s details if they agree. If you choose to tell us about health matters (for example, pregnancy or an injury), we use that information only to adapt your treatment safely.

To prevent spam, the website keeps a scrambled (hashed) version of your IP address for 10 minutes to limit repeated requests.

Booking through WhatsApp

When you choose WhatsApp, your browser opens WhatsApp with your booking details already filled in. Nothing is sent to our website. If you send the message, it is handled by WhatsApp (Meta) under its own privacy policy, and we use it to reply to your booking.

Gift voucher purchases

When you buy a gift voucher, we collect:

  • your full name and email address, and your phone number if you give it;
  • the name of the person the voucher is for;
  • the treatment, duration and price.

We use this to take payment, issue the voucher (a unique code valid for 6 months), email it to you with your order confirmation, keep our accounting records and honour the voucher when it is used. We do this to fulfil our contract with you and to meet our legal tax and accounting obligations.

Payments are processed by Stripe (card, MB WAY and Multibanco). Your payment details go directly to Stripe; we never see or store them. See Stripe’s privacy policy.

Map

On our contact page, Google Maps only loads if you press “Show map”. Google may then collect data under its own privacy policy.

Spam and bot protection (Google reCAPTCHA)

To stop automated spam and fraudulent payments, our booking form and gift voucher checkout use Google reCAPTCHA v3. It loads only once you start filling in one of these forms; other pages do not load it.

reCAPTCHA sends Google information about your device and how you use the page, for example your IP address, browser and device details, and how you move through the form. Google uses it to give a score showing how likely the form is being sent by a person. You never have to solve a puzzle. If the score is very low, we may ask you to contact us by phone or WhatsApp instead.

We keep only the result (the score and whether the form was let through), without your IP address or what you wrote in the form. We do this because we have a legitimate interest in protecting our website, our customers and our payments from abuse. Google’s Privacy Policy and Terms of Service apply.

Links to other websites

Our pages link to Instagram, Facebook, Google Reviews and Google Maps. These are simple links; once you visit those sites, their own privacy policies apply.

3. Cookies

We only use the cookies the website needs to work, such as keeping your gift voucher order together during checkout and processing your payment securely. Google reCAPTCHA may also set a security cookie when you use the booking form or checkout. We do not use analytics or advertising cookies. See our Cookie Policy for details.

4. Who we share data with

We do not sell your data. We share it only with the providers that help us run our service, and only as far as needed:

  • Stripe, to process payments;
  • Google, to protect our forms from spam and bots (reCAPTCHA);
  • our website hosting provider, which stores the website and voucher orders;
  • our email provider, which delivers booking and voucher emails;
  • WhatsApp (Meta), only if you choose to contact us there;
  • our accountant and the tax authorities, where the law requires it.

Some of these providers may process data outside the European Economic Area. When they do, they use safeguards recognised under EU law, such as the European Commission’s Standard Contractual Clauses.

5. How long we keep data

  • Booking requests: deleted after 6 months.
  • Voucher orders and invoices: for as long as Portuguese tax and accounting law requires.
  • WhatsApp conversations: kept only while we need them to arrange your appointment. We clear our chats regularly and do not keep them longer than necessary.
  • Spam-protection record of your IP address (hashed): 10 minutes.
  • reCAPTCHA results (score only, no IP address or form contents): the last 50 checks are kept; older ones are deleted automatically.

6. Your rights

Under the GDPR you can ask us to access, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Contact us using the details in section 1; we will reply within one month.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

7. Security

Our website uses a secure (HTTPS) connection, we never handle your card details ourselves, and only the people who need your information can access it.

8. Changes to this policy

If we change this policy, we will update the date at the top of this page.

Questions about this policy? Write to reservations@thebotanicalmassage.com or call +351 917 777 160.