THE UPSARA SPA — PRIVACY POLICY

1. Introduction & Commitment to Data Privacy

The Upsara Spa (“we”, “us”, “our”, or the “Spa”), operating at SAFRA Choa Chu Kang (#03-03, 28 Choa Chu Kang Drive, Singapore 689964), respects the privacy of our valued guests, website visitors, and clients.
This Privacy Policy outlines how The Upsara Spa collects, uses, discloses, stores, and safeguards your Personal Data in strict compliance with the Singapore Personal Data Protection Act 2012 (PDPA) and relevant advisory guidelines issued by the Personal Data Protection Commission (PDPC).
By accessing our website (https://theupsaraspa.com), booking an appointment, patronizing our spa premises, or communicating with us via phone, WhatsApp, or email, you acknowledge and agree to the practices described in this Policy.

2. What is Personal Data?

Under the PDPA, “Personal Data” refers to data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which an organization has or is likely to have access.

3. Personal Data We Collect

Depending on the nature of your interaction with us, we may collect the following categories of Personal Data:
  • Identity & Contact Information: Full name, contact telephone number, mobile number (for SMS/WhatsApp appointment updates), email address, and SAFRA membership ID (where applicable for member privilege verification).
  • Appointment & Booking Details: Preferred appointment dates, times, therapist preferences, treatment selections, booking history, and visit records.
  • Health & Wellness Consultation Declarations: Prior to undergoing specific body therapies, massages, or spa rituals, guests are requested to complete a confidential Pre-Treatment Health Declaration. This may include disclosures regarding pregnancy, recent surgeries, physical injuries, high blood pressure, cardiac conditions, skin sensitivities, or allergies. This data is collected solely for guest safety and to ensure treatments are contraindicated appropriately.
  • Payment & Transaction Records: Service transaction history, package balances, and payment status. Please note that online card transactions are processed securely through PCI-DSS compliant third-party payment gateways; The Upsara Spa does not store full credit card numbers or CVV codes on our servers.
  • Technical & Browsing Data: IP address, browser type, device information, and website interaction cookies when visiting our website.

4. Purposes for Collecting, Using & Disclosing Personal Data

We collect, use, and disclose your Personal Data strictly for legitimate business and operational purposes, including:
  1. Scheduling, managing, and confirming your spa appointments and service reservations.
  2. Sending automated appointment reminders, confirmations, and arrival instructions via WhatsApp or SMS.
  3. Ensuring guest physical health and treatment safety by tailoring massage pressure, essential oils, and contraindication protocols.
  4. Verifying SAFRA membership status for valid membership discounts and promotional entitlements.
  5. Administering treatment packages, gift vouchers, loyalty credits, and refund/cancellation queries.
  6. Responding to customer enquiries, service feedback, and providing concierge support.
  7. Complying with applicable Singapore laws, regulations, codes of practice, and requests by statutory authorities (including the Massage Establishments Act 2017).
  8. With your explicit consent, sending occasional promotional announcements, seasonal specials, or wellness updates (you may opt out at any time).

5. Consent & Right to Withdraw Consent

By submitting your details via our website booking engine, WhatsApp concierge, or filling out our on-site health consultation form, you consent to the collection, use, and disclosure of your Personal Data for the stated purposes.
You may withdraw your consent for receiving marketing communications or for the retention of your personal data at any time by contacting our Data Protection Officer in writing. Upon receipt of your withdrawal request, we will process it within ten (10) business days. Please note that withdrawing consent for essential operational data (such as health declarations) may prevent us from safely administering certain spa therapies.

6. Disclosure to Third Parties

The Upsara Spa does NOT sell, rent, trade, or transfer your Personal Data to third parties for marketing purposes. We may disclose your Personal Data only to:
  • Authorized service providers and vendors assisting us in website hosting, booking engine management, and automated messaging infrastructure, bound by strict confidentiality agreements.
  • Relevant government bodies, law enforcement agencies, or statutory regulators where required by Singapore law or court orders.

7. Protection & Security Measures

We implement robust administrative, physical, and technical safeguards to protect your Personal Data against unauthorized access, collection, use, disclosure, copying, modification, or leakage:
  • Digital data is transmitted via Secure Sockets Layer (SSL) 256-bit encryption.
  • Access to guest records and health declarations is strictly restricted to authorized spa managers and certified therapists on a need-to-know basis.
  • Confidential on-site physical consultation forms are secured in locked administrative storage and shredded upon expiry of the mandated retention period.

8. Retention of Personal Data

We retain Personal Data only for as long as necessary to fulfill the operational, business, or legal purposes for which it was collected, or as required by applicable Singapore financial, tax, and statutory record-keeping regulations. When Personal Data is no longer required, it is securely deleted or anonymized.

9. Access & Correction of Your Personal Data

Under the PDPA, you have the right to request access to your Personal Data in our possession and information about how it has been used or disclosed within the past year, as well as request corrections to any factual inaccuracies. We will respond to your request within thirty (30) days.

10. Data Protection Officer (DPO) Contact Details

If you have any questions, feedback, or requests concerning this Privacy Policy or our personal data management practices, please contact our Data Protection Officer:
The Upsara Spa — Data Protection Officer
Address: SAFRA Choa Chu Kang, 28 Choa Chu Kang Drive, #03-03, Singapore 689964
Telephone: +65 6980 8465
WhatsApp Concierge: +65 9812 9857
Email: theupsaraspa@gmail.com
We review and update this Privacy Policy periodically. Any revisions will be published immediately on our website.
Scroll to Top