1. Who we are

OREKA ("we", "us", "our") operates a wood-fired outdoor sauna experience at Borde Hill estate, near Haywards Heath, Sussex. We are the data controller for the personal information described in this policy.

Contact for privacy queries: [name/role], [email address], [postal address if applicable]

ICO registration number: [add once registered — see note]

Note: as a data controller, OREKA is likely required to pay the ICO's data protection fee and register — worth confirming this and adding the registration number here, as several comparable small sauna/wellness operators display theirs for added credibility.

If you have a concern about how we've handled your personal data, please contact us in the first instance so we can try to resolve it directly.

2. What personal data we collect

Booking and contact information

•  Name, email address, phone number

•  Booking details: date, session time, party size, booking type (community or private hire)

Payment information — processed directly by our booking platform, Periode; we do not store full card details ourselves.

Health declaration data (special category data)

•  As part of the waiver you complete before using the sauna, hot tub or cold plunge, we ask you to declare relevant health conditions (including cardiovascular conditions, pregnancy, epilepsy) and recent alcohol consumption, so our sauna host can take appropriate care during your session

•  This is treated as special category data under UK GDPR and is handled with additional safeguards — see Section 4

Communications

•  Email correspondence, including the directions and session instructions we send when you book

•  Messages sent to our WhatsApp Business number, if you contact us that way

•  Marketing/newsletter correspondence, if you've opted in separately from booking, sent via [email platform name]

•  If you get in touch via a contact form, phone, or in person (for example, at a local event), we'll collect whatever details you choose to give us to respond to you

Website data

•  Basic analytics and cookies from our website, used to understand site usage — this may include your device's IP address, browser type and version, the pages you visit, and the time and date of your visit — see our separate Cookie Notice for details

(Remove the section above if your site doesn't currently use any analytics or cookies.)

3. How and why we use your data, and our legal basis

Data- Name, contact details, booking details

Purpose- To process and manage your booking, send confirmations and directions

Legal basis - Necessary for the performance of a contract with you

Data - Payment information

Purpose - To process payment for your session

Legal basis - Necessary for the performance of a contract with you

Data - Health declaration data

Purpose - So our sauna host can take appropriate safety precautions during your session

Legal basis - Explicit consent (Article 9 UK GDPR) — see Section 4

Data - Email/WhatsApp communications

Purpose - To respond to enquiries and provide booking-related information

Legal basis - Necessary for the performance of a contract with you, or our legitimate interest in responding to enquiries

Data - Marketing emails

Purpose - To send you news, seasonal offers or updates about OREKA

Legal basis - Consent, or legitimate interest for existing customers under the PECR "soft opt-in" — see note below

Data - Website analytics/cookies

Purpose - To understand how our site is used and improve it

Legal basis - Consent (where required under PECR

4. Health declaration data — additional information

Because health information falls into a special category of data under UK GDPR, we handle it with particular care:

•  We ask for your explicit, standalone consent to provide this information as part of the booking/waiver process — this consent is separate from your general acceptance of our terms and conditions.

•  This data is used only to help our on-site host manage your session safely, and is not used for any other purpose, including marketing.

We retain health declaration data only for as long as necessary — [retention period, e.g. 12 months from your session, or until the end of the season] — after which it is securely deleted.

•  You can withdraw your consent to provide this data at any time; please note that without it, we may need to have a direct conversation with you before your session to ensure we can offer it safely, or in some cases may not be able to offer you a session.

•  Access to this data is limited to staff directly involved in running your session.

5. Who we share your data with

We share personal data with the following third parties, each acting as a data processor on our behalf:

•Periode— our booking and payment platform, for processing bookings and payments. If Periode: their privacy policy is at periode.no/privacy-policy.

• [Email platform name] — for sending booking confirmations and, where you've opted in, marketing communications.

• WhatsApp Business (Meta) — if you choose to contact us via WhatsApp. Please note WhatsApp is operated by Meta, and messages may be processed outside the UK/EEA. Meta's own privacy policy governs how they handle this data; we recommend reviewing it if you have concerns about using this channel.

We do not sell your personal data to any third party. We only share what's necessary for these providers to deliver their service to us, and we have appropriate agreements in place with each of them governing how they handle your data.

International transfers

Where any of the above providers process data outside the UK or European Economic Area (this may apply to WhatsApp/Meta), we rely on the relevant legal safeguards, such as UK adequacy regulations or standard contractual clauses, to ensure your data remains protected to UK standards.

6. How long we keep your data

We keep different types of data for different lengths of time, depending on why we hold it:

•  General booking and contact information: retained for [1–2 years, e.g.] from your last booking or contact with us, then securely deleted or anonymised, unless we're legally required to keep it longer.

•  Financial records (invoices, payment records): retained for 6 years, in line with UK tax and accounting requirements.

• Health declaration data: retained for 12 months as set out in Section 4, then securely deleted.

•  Marketing communications: retained until you unsubscribe or withdraw consent.

•  Website analytics: retained in line with our Cookie Notice.

This splits general booking/contact data from financial records, which need to be kept far longer for legal reasons — worth keeping them as separate line items like this rather than one blended retention period, since it's more accurate and easier to defend if ever questioned.

7. Your rights

Under UK GDPR, you have the right to:

•  Access the personal data we hold about you

•  Have inaccurate data corrected

•  Request deletion of your data, in certain circumstances

•  Restrict or object to our processing of your data

•  Receive your data in a portable format

•  Withdraw consent at any time, where we rely on consent (this applies in particular to health declaration data and marketing communications)

To exercise any of these rights, contact us using the details in Section 1. If you're unhappy with how we've handled your data or responded to a request, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. How we protect your data

We take reasonable technical and organisational measures to protect your personal data, including limiting access to those who need it to do their job, using reputable third-party providers with their own security safeguards, and reviewing our data handling practices periodically.

9. Children's data

Our sauna experience requires guests to be supervised appropriately if under 18. If a booking is made on behalf of a minor, or a minor's details are otherwise provided to us, we handle that information with the same care as set out in this policy, and only collect what's necessary for the booking.

10. Cookies

[If your website uses cookies or analytics: include or link to a separate Cookie Notice here, and ensure your site has a compliant consent banner. If your site currently has no tracking, you can state that directly: "Our website does not currently use cookies or tracking technologies beyond what's strictly necessary for it to function."]

11. Links to other websites

Our website and social media may contain links to other sites, such as Borde Hill or its restaurant, Isca. This policy doesn't cover how those sites handle your data, and we'd encourage you to review their own privacy policies if you visit them.

12. Changes to this policy

We may update this policy from time to time, for example if we start using a new booking or communications platform. Material changes will be reflected here with an updated date at the top of this page.

This policy was last reviewed  19th September 2026. Questions about how we handle your data can be directed to [contact details].