Privacy Policy
How we collect, use and look after personal information when you visit vilasa.co.uk, download one of our guides or get in touch with us.
Who we are
This website is run by VILASA Limited (“VILASA.”, “we”, “us”). We are the data controller for the personal information described in this policy.
VILASA Limited, company number 11853185
Registered office: 30 New Barrels Pitch, Chipping Campden, Gloucestershire, England, GL55 6FA
Email: hello@vilasa.co.uk
Registered with the Information Commissioner’s Office (ICO): ZB145823
This policy covers vilasa.co.uk. Our online shop, VILASA Boutique at vilasaboutique.co.uk, has its own privacy policy.
The information we collect
Information you give us
- Contact and enquiry forms: your name, job title, company, hotel or spa, email address, the brands or services you are interested in, your message and how you heard about us.
- Hammam & Rasul Consultancy enquiries: your name, email address, property and location, the service you are interested in, the current stage of your facility and anything you choose to tell us about your situation.
- Guide downloads: your name, email address and spa or hotel name.
- Email sign-up: your email address.
- When we work together: contact details for you and your colleagues, purchase orders, invoicing details and any information you share for a consultancy engagement, such as treatment menus, booking reports or photographs of your facilities.
- Emails and calls: anything you share with us directly.
Information collected automatically
When you visit the website, we and our service providers may collect technical information such as your IP address, browser and device type, the pages you visit and how you arrived. Some of this is collected using cookies. We only use non-essential cookies, such as analytics, with your consent.
How we use your information
| What we do | Our lawful basis |
|---|---|
| Reply to your enquiry and discuss how we might work together | Legitimate interests: responding to business enquiries |
| Send you a guide you have requested | Legitimate interests: providing what you asked for |
| Deliver products, training or consultancy, and manage invoices and purchase orders | Contract, or steps taken at your request before entering into one |
| Keep business and accounting records | Legal obligation |
| Send news, insights and updates about our brands and services | Consent, where you have opted in, which you can withdraw at any time |
| Understand how the website is used and improve it | Consent, given through our cookie banner |
| Keep the website and our systems secure and free from spam | Legitimate interests: security and fraud prevention |
Where we rely on legitimate interests, we have considered your rights and expectations, and we only use your information in ways you would reasonably expect from a business relationship.
Marketing
We only send marketing emails if you have opted in. Every email includes a way to unsubscribe, or you can email hello@vilasa.co.uk at any time. Downloading a guide or making an enquiry does not sign you up to marketing unless you tick the box to say so.
Who we share it with
We never sell your personal information. We share it only where needed to run our business, with:
- Service providers who help us operate, including our website host, our customer relationship management system (HubSpot), Google (for Tag Manager and website analytics), our email delivery services and secure backup providers. They may only use your information on our instructions.
- Professional advisers, such as our accountants, insurers and lawyers, where necessary.
- The brands we represent, only with your consent, for example when arranging training or an account with a brand.
- Authorities, where we are required to by law.
International transfers
Some of our service providers, such as HubSpot and Google, may process information outside the UK, including in the United States. Where this happens, we rely on the safeguards UK law requires, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or Addendum.
How long we keep it
- Enquiries and guide downloads: up to two years after our last contact, unless we go on to work together.
- Clients and suppliers: six years after the end of our relationship, for tax and legal purposes.
- Marketing: until you unsubscribe. We keep a minimal record so we do not contact you again.
- Analytics: in line with the retention settings of the tool concerned, typically no more than 14 months.
Cookies
When you first visit, our cookie banner asks for your consent before any non-essential cookies are set. Essential cookies, which make the website work, do not need consent. You can change your choices at any time through the cookie settings on the website, or by clearing cookies in your browser.
Keeping it secure
We use appropriate technical and organisational measures to protect your information, including secure hosting, encrypted connections, restricted access and regular backups. No website can be completely secure, but we take care to limit what we collect and who can see it.
Your rights
Under UK data protection law, you have the right to:
- ask for a copy of the information we hold about you
- ask us to correct information that is wrong or incomplete
- ask us to delete your information
- ask us to restrict or stop using your information, or object to how we use it
- ask for your information in a portable format
- withdraw your consent at any time, where we rely on it
To make a request, email hello@vilasa.co.uk. We will respond within one month. There is normally no charge.
Complaints
If you have a concern about how we handle your information, please contact us first and we will do our best to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page.
Last updated: 25 October 2026
