Privacy Policy (Datenschutzerklärung)

1. Introduction

Welcome to AYUWAVE. We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website or contact us to enquire about or book our services.

AYUWAVE offers Ayurvedic-inspired relaxation and wellness services, including massage and home service sessions. Please note that all services provided by AYUWAVE are wellness and relaxation services only — they are not medical treatments, medical therapies, or healthcare services of any kind. We do not collect or process any medical or health-related personal data.

This Privacy Policy applies to all personal data we collect through:

• Our website and its informational pages
• Our contact form
• Email and WhatsApp communications
• Online booking (current or future functionality)
• Website analytics tools

We process personal data in full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation — 'GDPR'), the Republic of Cyprus Law 125(I)/2018 on Personal Data Protection, and any other applicable data protection legislation.

By using our website or contacting us, you acknowledge that you have read and understood this Privacy Policy. Please read it carefully before submitting any personal information.

2. Data Controller Information

For the purposes of the GDPR, the data controller responsible for your personal data is:

If you have any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact us using the details provided in Section 17 of this document.

As a small business operating in Cyprus (EU), AYUWAVE is not legally required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. However, we take data protection obligations seriously and handle all data-related enquiries directly and promptly.

3. Types of Data Collected

We collect only the personal data that is necessary for the purposes described in this Privacy Policy. We do not collect sensitive personal data ('special category data') as defined under Article 9 GDPR. In particular, we do not collect any data related to your health, medical history, or physical conditions.

3.1 Personal Identification Data

When you contact us or submit a booking request, we may collect:

• Full name
• Email address
• Phone number (including WhatsApp number if applicable)

3.2 Communication and Booking Data

• The content of messages you send us via the contact form, email, or WhatsApp
• Booking request details (such as preferred date, time, service type, and location for home visits)
• Records of correspondence between you and AYUWAVE

3.3 Technical and Usage Data

When you visit our website, we or our analytics tools may automatically collect:

• Your IP address (anonymised where possible)
• Browser type and version
• Operating system
• Date and time of your visit
• Pages visited and time spent on each page
• Referring URL (the page you came from)

3.4 Data We Do Not Collect

We explicitly confirm that we do not collect, and have no interest in collecting, the following:

• Health records, medical information, or physical condition data
• Financial or payment card information (any payment processing is handled by third-party providers)
• Sensitive personal data under Article 9 GDPR (racial or ethnic origin, religious beliefs, biometric data, etc.)
• Data relating to minors under the age of 16

4. Purpose of Data Processing

We process your personal data only for specific, explicit, and legitimate purposes. The purposes for which we collect and use personal data are:

• Responding to enquiries: To read and respond to messages submitted through our contact form, email, or WhatsApp.
• Booking management: To process booking requests for wellness sessions (at our premises or as home visits), coordinate scheduling, and confirm appointments.
• Service delivery: To provide the wellness and relaxation services you have requested.
• Communication: To send you relevant information about your booking, follow-up after a session, or respond to any ongoing communication.
• Website improvement: To analyse how visitors use our website so that we can improve the user experience and content quality.
• Legal compliance: To comply with applicable legal obligations under Cyprus and EU law.

We do not use your personal data for automated decision-making or profiling as defined under Article 22 GDPR.

5. Legal Basis for Processing (GDPR)

In accordance with Article 6 GDPR, we rely on the following legal bases for processing your personal data:

5.1 Contractual Necessity (Article 6(1)(b) GDPR)

Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering a contract. This applies when you submit a booking request or enquiry, as processing your contact details is required to confirm and deliver the service.

5.2 Legitimate Interests (Article 6(1)(f) GDPR)

We process technical data such as server log files on the basis of our legitimate interest in the secure and stable operation of our website. Website analytics and advertising measurement are not covered by this; those take place exclusively on the basis of your consent, see section 8.

5.3 Consent (Article 6(1)(a) GDPR)

Where required — for example, for the placement of non-essential cookies or for direct marketing communications — we will obtain your freely given, specific, informed, and unambiguous consent before processing your data. You may withdraw your consent at any time (see Section 14).

5.4 Legal Obligation (Article 6(1)(c) GDPR)

We may process personal data where necessary to comply with a legal obligation to which AYUWAVE is subject under Cyprus or EU law.

6. Contact Forms and Communication

Our website includes a contact form that visitors may use to send us enquiries or booking requests. When you submit the contact form, we collect the data you enter — typically your name, email address, phone number, and message content.

This data is transmitted to us electronically and stored in our email inbox or business communication system. We process it solely to respond to your message and, if applicable, to fulfil a service booking.

The same applies to direct email communications sent to our contact email address. We retain email correspondence for as long as necessary to complete the communication and any related service agreement, and for a reasonable period thereafter for record-keeping purposes (see Section 10 on data retention).

We do not send unsolicited marketing emails. If you wish to receive service updates or promotional communications from AYUWAVE, we will ask for your explicit consent.

7. WhatsApp Communication

AYUWAVE offers WhatsApp as a convenient channel for enquiries and bookings. If you choose to contact us via WhatsApp, please be aware of the following:

• WhatsApp is operated by WhatsApp LLC (a Meta company), headquartered in the United States. When you send us a message via WhatsApp, your data — including your phone number, profile name, and message content — is processed by WhatsApp in accordance with WhatsApp's own Privacy Policy and Meta's data practices.
• We do not control WhatsApp's data processing. We strongly encourage you to review WhatsApp's Privacy Policy before using this channel: https://www.whatsapp.com/legal/privacy-policy
• AYUWAVE only uses WhatsApp to read and respond to your enquiries and to coordinate bookings. We do not store your WhatsApp data on our own systems beyond what is necessary to fulfil your request.
• If you prefer not to use WhatsApp, you are welcome to contact us via the contact form on our website or by email.

Note: By choosing to contact AYUWAVE via WhatsApp, you acknowledge that your data will be processed by WhatsApp LLC and potentially transferred to servers outside the European Economic Area (EEA). This transfer is governed by WhatsApp's own data transfer mechanisms.

8. Website Analytics

To understand how our website is used and to measure the effect of our advertising, we use the tools described below. None of them is loaded before you have accepted marketing cookies.

8.1 Loading Only After Consent

When you open our website, no analytics or advertising tool is active. Only if you choose "Accept All" in the cookie banner are the tools described below loaded. If you choose "Necessary Only", nothing is transmitted to Google or Meta.

• You can withdraw your decision at any time via "Cookie Settings" in the footer
• Without consent no cookies from Google or Meta are set
• Legal basis is your consent under Article 6(1)(a) GDPR

8.2 Data Collected via Analytics

Analytics tools may collect the following data about your visit:

• Anonymised IP address
• Pages visited and navigation paths
• Time and duration of visit
• Browser and device type
• Country or general geographic region (derived from IP address)

8.3 Google Analytics 4

We use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records which pages you open, how you move through the site and which steps of the booking process you complete. Your IP address is shortened by Google before it is stored.

Data may be transferred to Google LLC in the United States. Google provides safeguards through Standard Contractual Clauses under Article 46 GDPR. You can additionally prevent collection with the browser add-on available at https://tools.google.com/dlpage/gaoptout

8.4 Meta Pixel and Conversions API

We use the Meta Pixel, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It lets us measure whether our advertising on Facebook and Instagram leads to enquiries and bookings, and it allows us to show advertising to people who have already visited our website.

In addition to the pixel running in your browser we use the Meta Conversions API. With it, a completed booking is reported from our server directly to Meta. Your email address and your user number are irreversibly encrypted before transmission using the SHA-256 procedure. Meta does not receive readable contact details from us.

The following information may be transmitted:

• Pages opened and treatments viewed
• Which step of the booking process you reached
• Value and currency of a completed booking
• Your email address and user number, irreversibly encrypted
• IP address, browser and device type
• The Meta cookies _fbp and _fbc

Data may be transferred to Meta Platforms Inc. in the United States, safeguarded by Standard Contractual Clauses under Article 46 GDPR. You can object to the use of your data for advertising purposes in your Facebook account settings at any time.

9. Cookies

9.1 What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet, or smartphone) by a website when you visit it. They help websites function correctly, remember your preferences, and provide analytical information about usage.

9.2 Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are required for the basic functioning of our website, for example to remember your cookie choice and your language. They cannot be disabled and require no consent.
• Analytics Cookies (Optional): Google Analytics 4 sets the cookies _ga and _ga_ in order to recognise returning visitors and to follow paths through the site. They are only set after you accept marketing cookies.
• Advertising Cookies (Optional): The Meta Pixel sets the cookies _fbp and _fbc in order to attribute bookings to advertising on Facebook and Instagram. They are only set after you accept marketing cookies.

9.3 Third-Party Cookies

When you consent to marketing cookies, Google and Meta set their own cookies on your device. These include _ga and _ga_ from Google Analytics and _fbp and _fbc from the Meta Pixel. Our website also contains links to Facebook, Instagram and WhatsApp; those providers may set further cookies when you follow such a link. We have no control over third-party cookies, please refer to the respective provider's privacy policy.

9.4 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to:

• View cookies stored on your device
• Accept or block all cookies
• Delete specific cookies

Please note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit: https://www.allaboutcookies.org

9.5 Cookie Consent

Where required by law, we will display a cookie consent banner allowing you to accept or decline non-essential cookies before they are placed. Your preferences will be stored and respected on future visits.

10. Data Storage and Retention

10.1 Where We Store Your Data

We store personal data primarily within the European Economic Area (EEA). Our email and communication systems are hosted by service providers that operate within the EEA or provide adequate data transfer safeguards in compliance with Article 46 GDPR (such as Standard Contractual Clauses).

10.2 How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our general retention guidelines are:

• Contact form and email enquiries: Up to 12 months from the date of last communication, unless a service relationship continues.
• Booking and service records: Up to 3 years from the date of service, to meet potential legal, contractual, or administrative obligations.
• WhatsApp messages: We do not retain WhatsApp data beyond the duration needed to respond to your enquiry.
• Website analytics data: Aggregated or anonymised data may be retained indefinitely; identifiable data is retained for no more than 14 months.
• Legal compliance records: As required by applicable Cyprus and EU law (e.g., accounting records: up to 7 years).

11. Data Sharing and Third Parties

11.1 General Principle

AYUWAVE does not sell, rent, or trade your personal data to any third parties. We do not share your data with third parties for marketing or advertising purposes.

11.2 Data Processors

We may share your personal data with trusted third-party service providers ('data processors') who assist us in operating our business. These include:

• Email and web hosting providers
• Google Ireland Limited (Google Analytics)
• Meta Platforms Ireland Limited (Meta Pixel and Conversions API)
• Payment service providers for online bookings
• Communication platforms (including WhatsApp)

11.3 Social Media Platforms

Our website may include links to or icons for social media platforms such as Facebook and Instagram (Meta). If you click on these links, you will be directed to the respective platform's website, which is governed by that platform's own privacy policy.

12. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or disclosure, in accordance with Article 32 GDPR.

Our security measures include, but are not limited to:

• Use of HTTPS (SSL/TLS encryption) on our website
• Limiting access to personal data to authorised personnel only
• Use of password-protected and secure email services
• Regular review of our data handling practices

13. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights with respect to your personal data:

• 13.1 Right of Access (Article 15 GDPR): Request a copy of your personal data.
• 13.2 Right to Rectification (Article 16 GDPR): Request correction of inaccurate data.
• 13.3 Right to Erasure (Article 17 GDPR): Request deletion of your data.
• 13.4 Right to Restriction (Article 18 GDPR): Request restriction of processing.
• 13.5 Right to Data Portability (Article 20 GDPR): Receive data in a structured format.
• 13.6 Right to Object (Article 21 GDPR): Object to processing based on legitimate interests.

14. Right to Withdraw Consent

Where you have given consent for any processing of your personal data, you have the right to withdraw that consent at any time.

15. Right to Lodge a Complaint

The supervisory authority for data protection in Cyprus is:

16. Updates to this Privacy Policy

We may update or revise this Privacy Policy from time to time to reflect changes in our business practices or applicable law.

17. Contact Information & Legal Notice