Your privacy.Yourprivacy.

Incognito Spa and Events, 517 Generaal de Wet St, Pretoria North, Tshwane, 0182, is responsible for the personal information described here. Our Information Officer is the owner. Questions and requests go to info@incognitospa.co.za or 012 004 1424.

• Your name, mobile number and email, to make and manage your bookings, send your confirmation, receipt and reminders, and recognise you when you come back.
• Your bookings and purchases: treatments, times, your therapist, payments, gift cards, packages and memberships. We need these to run your appointments, and the law requires us to keep financial records. When you buy a voucher online, we keep your name, email and mobile number with the order, and the name and message you add for the person it’s for.
• Health details you give us, such as allergies, conditions or pregnancy, so your therapist can treat you safely. We record them only with your consent, and only the manager and the therapist treating you can see them.
• Messages you send us on WhatsApp or in the chat on this website, so we can answer you and pick up where we left off.
• Your choices: whether you accepted our cancellation policy and whether you want offers from us, with the date, so we can show we respect them.

We send offers only if you said yes, on the channel you said yes to. Every offer says how to stop them: reply STOP on WhatsApp, or tell us. Messages about your own bookings (confirmations and reminders) still come, because they are part of the service.

We never sell your information. These companies process it for us, under agreements that require them to keep it safe:

• Supabase stores our records, in London.
• Hostinger runs this website and our booking system, in Manchester.
• PayFast takes online payments, in South Africa. Your card or bank details go to PayFast, never to us.
• Meta (WhatsApp) carries our WhatsApp messages.
• Google shows the map on our Visit page. The map loads from Google, which may set its own cookies.
• OpenAI powers our booking assistant, which answers chat and WhatsApp messages. It receives the conversation to write a reply, in the USA, and doesn’t use it to train its models.

Some of these are outside South Africa (mainly in the United Kingdom and the United States). We use only providers bound by data protection laws or agreements that protect your information at least as well as POPIA does.

• Your client record and health details: while you visit us, and for 3 years after your last visit.
• Invoices, payments and other financial records: 5 years, as tax law requires.
• Chat and WhatsApp conversations: 12 months.
• A record of your choices about offers: as long as we send you offers, and 3 years after.

This website uses only the cookies it needs to work: one remembers the treatments you are booking, one keeps your chat with us, and our team’s sign-in uses its own. There are no advertising or tracking cookies.

You can ask what we hold about you, ask us to correct or delete it (unless the law requires us to keep it), and object to offers at any time. Write to info@incognitospa.co.za; we may ask you to confirm who you are first.

If you are unhappy with how we handled your information, please tell us. You can also complain to the Information Regulator: POPIAComplaints@inforegulator.org.za, 0800 017 160, inforegulator.org.za (opens in a new tab).

Our team sign in to see client records, and each role sees only what it needs. Every change is logged with who made it. Our records are encrypted when sent and backed up every night. If your information is ever exposed, we will tell you and the Information Regulator.