Privacy Policy

Last updated: 21 September 2026

This Privacy Policy explains how Six Senses Asian Massage & Spa collects, uses, stores and protects personal data when you visit sixsencesspa.com, contact us, book a treatment, purchase a gift voucher or otherwise use our services.

1. Who is responsible for your data?

Six Senses Asian Massage & Spa is operated by KNV INTERNATIONAL LTD, company registration number HE427080, VAT number 10427080V (the “data controller”).

Registered address: Tafoi Ton Vasileon, 4 Queens Gardens Dora, Flat 5, 8046 Paphos, Cyprus.
Telephone: +357 99 778982
Email: jessie@knvinternational.com

2. Personal data we may collect

  • Contact details such as your name, email address and telephone number.
  • Booking details such as selected service, duration, preferred date and time, number of guests and messages you choose to send us.
  • Order and billing information needed to process a purchase, gift voucher or refund.
  • Technical information such as IP address, browser, device, cookie identifiers and security logs.
  • Communications, feedback and requests you send by form, email, telephone or social media.
  • Information you voluntarily provide about preferences or health considerations relevant to treatment suitability. Please provide only information that is necessary and do not send detailed medical records through ordinary email or website forms.

Payment card details are handled by the payment provider made available during checkout. We do not intentionally store complete card details on this website.

3. Why we use personal data

  • To respond to enquiries and manage appointment requests.
  • To confirm, provide, reschedule or cancel services.
  • To process orders, payments, vouchers, refunds and transaction records.
  • To maintain website security, prevent fraud and resolve technical problems.
  • To comply with legal, accounting and regulatory obligations.
  • To send marketing communications only where permitted and to honour opt-out requests.
  • To improve our website and services using aggregated or appropriately protected information.

4. Legal bases

Depending on the situation, we process personal data because it is necessary to take steps at your request or perform a contract, comply with a legal obligation, pursue a legitimate interest that does not override your rights, protect vital interests, or because you have given consent. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

5. Health-related information

Information about health may be special-category personal data. If you voluntarily provide relevant information so that we can consider treatment suitability or safety, we limit its use to that purpose and apply the additional protections required by applicable law. Our spa services are not medical diagnosis or treatment.

6. Who may receive personal data?

We may share only the information necessary with trusted service providers that support website hosting, email and communications, booking and order administration, payment processing, security, technical support, accounting or professional advice. We may also disclose information where required by law, a court or a competent authority. Service providers must process data only for authorised purposes and with appropriate safeguards.

We do not sell personal data.

7. International transfers

Some service providers may process data outside Cyprus or the European Economic Area. Where this occurs, we use an applicable lawful transfer mechanism and appropriate safeguards, such as an adequacy decision or approved contractual clauses.

8. How long we keep information

We retain personal data only for as long as necessary for the purpose for which it was collected, including providing services, responding to requests, maintaining transaction and tax records, resolving disputes and meeting legal obligations. Retention periods vary according to the type of record and applicable requirements. When information is no longer required, it is deleted, anonymised or securely restricted.

9. Cookies and similar technologies

The website may use essential cookies needed for security, shopping-cart, checkout and core functions. Optional analytics or marketing technologies, where enabled, should be used only in accordance with applicable consent requirements. You can control cookies through the available consent settings and your browser, although blocking essential cookies may affect website functions.

10. Your data-protection rights

Subject to applicable conditions, you may have the right to request access, correction, deletion, restriction, portability or objection to processing, and to withdraw consent. You may also lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus or another competent supervisory authority.

To exercise a right, contact jessie@knvinternational.com. We may need to verify your identity before responding.

11. Security

We use reasonable technical and organisational measures intended to protect personal data. No internet transmission or storage system is completely secure, so please avoid sending unnecessary sensitive information through ordinary email or forms.

12. Children

The website and online purchasing functions are not directed to children. A parent or legal guardian should contact us before booking a service for a minor.

13. Third-party links

Our website may link to third-party services or social-media platforms. Their own privacy notices govern their processing, and we are not responsible for their practices.

14. Changes to this policy

We may update this Privacy Policy when our services, technology or legal obligations change. The latest version will be published on this page with the revised date.

15. Contact us

KNV INTERNATIONAL LTD
Tafoi Ton Vasileon, 4 Queens Gardens Dora, Flat 5, 8046 Paphos, Cyprus
Telephone: +357 99 778982
Email: jessie@knvinternational.com