We keep this short and plain. We only collect what we need to process your order and deliver your purchase. We do not sell your data to anyone.
1. Who we are
y. diané spa is a luxury spa located at Elysia Park Resort, Paphos, Cyprus. We operate the website at ydianespa.com and the shop at ydianespa.com/shop.html.
For any privacy enquiries, contact us at relax@ydianespa.com or by WhatsApp at +357 99 424 441.
2. What data we collect
When you place an order, we collect the following through Stripe's secure checkout:
- Your name and email address
- Your phone number
- Your delivery address (for physical orders)
- Payment card details — these are handled entirely by Stripe and never stored on our systems
For gift vouchers, you may also choose to provide:
- The recipient's name and email address
- A personal message to include in the voucher email
If you contact us directly by email or WhatsApp, we keep a record of that correspondence.
3. Why we collect it
We use your data only for the following purposes:
- To process your payment and fulfil your order
- To send your gift voucher (by email or post)
- To send you an order confirmation
- To contact you if there is a problem with your order
- With your consent, to send you occasional news and offers from y. diané spa
The legal basis for processing your order is contract performance (Article 6(1)(b) GDPR). Where we send marketing communications, the basis is consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
4. Who we share it with
We use a small number of trusted third-party services to run the shop. Each acts as a data processor on our behalf:
- Stripe — payment processing. See Stripe's privacy policy.
- Resend — transactional email delivery (vouchers and confirmations). See Resend's privacy policy.
- Vercel — website hosting. See Vercel's privacy policy.
We do not sell, rent, or share your personal data with any other third parties.
5. How long we keep your data
We retain order and transaction records for up to 7 years, as required for accounting and legal compliance under Cypriot law. Correspondence and other contact details are kept for as long as they remain relevant to our relationship with you.
If you ask us to delete your data and there is no legal reason to retain it, we will do so within 30 days.
6. Your rights (GDPR)
If you are based in the European Economic Area, you have the following rights:
- Access — request a copy of the personal data we hold about you
- Correction — ask us to correct inaccurate data
- Erasure — ask us to delete your data (subject to legal retention obligations)
- Restriction — ask us to limit how we use your data
- Portability — request your data in a portable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — for any processing based on consent (e.g. marketing emails)
To exercise any of these rights, email us at relax@ydianespa.com. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus: dataprotection.gov.cy.
7. Cookies
Our website does not use tracking cookies or analytics. The only storage used is functional — for example, remembering your language preference or cart contents while you browse. This data stays in your browser and is never sent to us.
8. Changes to this policy
We may update this policy from time to time. The date at the top of this page reflects when it was last revised. Continued use of our website after a change constitutes acceptance of the updated policy.
9. Contact
For any questions about this policy or how we handle your data:
- Email: relax@ydianespa.com
- WhatsApp: +357 99 424 441
- Address: Elysia Park Resort, Paphos, Cyprus