NATAS SAUNA
PRIVACY POLICY
Last updated: 24 October 2026
Business: Kokopelli Ltd., trading as Natas Sauna
Location: Sarsfields, Newbridge, Co. Kildare, Ireland
Privacy contact: Rytis@kokopelli.ie
1. WHO WE ARE
Natas Sauna is operated by Kokopelli Ltd.
We respect your privacy and are committed to protecting your personal information in accordance with the EU General Data Protection Regulation (GDPR) and applicable Irish data protection laws.
Kokopelli Ltd. is the data controller responsible for the personal information described in this policy.
2. INFORMATION WE COLLECT
Depending on how you use our services, we may collect:
Contact details: Your name, email address and telephone number.
Booking information: Appointment dates, services booked, booking history, attendance and cancellations.
Safety information: Waiver acknowledgments, age confirmation, guardian consent and any necessary health-related information.
Payment information: Transaction details, payment status, refunds and receipts.
Membership and voucher information: Membership details, voucher codes, balances, purchases and redemption records.
Website information: IP addresses, device information, cookie preferences and website usage data.
CCTV footage: Images recorded by our perimeter security cameras.
We do not require customers to create a personal website account.
3. HOW WE USE YOUR INFORMATION
We process personal information for the following purposes:
Managing bookings, memberships and vouchers: Performance of a contract.
Processing payments and providing booked services: Performance of a contract.
Maintaining accounting and tax records: Legal obligation.
Sending booking confirmations, reminders and service updates: Performance of a contract.
Managing safety waivers and necessary incident records: Legitimate interests and, where applicable, legal obligations.
Protecting premises through CCTV: Legitimate interests in security and protecting property.
Sending optional promotional emails: Consent.
Google Analytics and Meta Pixel tracking: Consent for non-essential tracking.
Where we rely on legitimate interests, we assess those interests against individuals' rights and freedoms.
Where consent is required, you may withdraw it at any time.
4. HEALTH INFORMATION AND SAFETY DECLARATIONS
For customer safety, we may collect limited information relevant to participation in sauna, ice-bath and jacuzzi activities.
Health information is specially protected under GDPR.
We will collect only information reasonably necessary for the stated safety purpose, restrict access to authorised personnel and use an appropriate legal basis and additional Article 9 GDPR condition before processing it.
Where explicit consent is the applicable Article 9 condition, we will obtain it separately and explain the consequences of withholding or withdrawing it.
We will not use health information for marketing.
5. BOOKINGS AND PAYMENTS
Customers may book online through our website and Acuity Scheduling or directly at reception.
We accept online payments and payments on site, including cash.
Online card payments are processed through the relevant payment provider. We do not intentionally collect or store full payment-card numbers in our own customer records.
Cash transactions may be recorded for accounting, financial management and tax purposes.
Booking confirmations, reminders and important booking updates are sent by email.
6. MEMBERSHIPS AND GIFT VOUCHERS
Memberships and gift vouchers may be purchased online or at reception.
We may use secure administrative records, including Google Sheets, to manage memberships, voucher balances, expiry dates and redemption history.
Access will be restricted to authorised personnel.
We will not store detailed medical declarations in these membership or voucher spreadsheets.
7. CCTV AND PREMISES SECURITY
We operate two perimeter CCTV cameras for premises security, protection of property and the investigation of relevant incidents.
The cameras are not intended to record directly inside saunas, ice baths, jacuzzis or changing areas.
CCTV recordings are normally retained for 14 days and then automatically deleted or overwritten.
Footage relating to a specific security incident, accident, investigation or legal claim may be retained for longer where necessary and lawful.
CCTV access is restricted to authorised personnel. Relevant footage may be disclosed to An Garda Siochana, insurers, legal advisers or other authorised recipients where legally appropriate.
Appropriate CCTV notices will be displayed at the premises.
8. WEBSITE COOKIES AND ANALYTICS
Our Squarespace website may use cookies and similar technologies.
Essential cookies support necessary website functions, including security and booking functionality.
With your consent, we may also use:
Google Analytics: To understand website visits, traffic and usage.
Meta Pixel: To measure advertising performance and support Facebook and Instagram advertising.
Non-essential analytics and advertising technologies will not be activated until the required consent has been obtained.
You may accept, reject or change your optional cookie preferences through our website's cookie settings.
More information about specific cookies and their duration will be provided through our cookie settings or cookie information page.
9. MARKETING COMMUNICATIONS
We send promotional emails, special offers and business news only to customers who have actively opted in.
Marketing consent is optional and separate from booking or waiver acceptance.
You may unsubscribe at any time using the unsubscribe link in a marketing email or by contacting Rytis@kokopelli.ie.
Withdrawing marketing consent will not affect your ability to book or use our services.
10. SHARING INFORMATION WITH SERVICE PROVIDERS
We may share personal information with trusted service providers where necessary to operate our business, including:
Squarespace: Website hosting and website services.
Acuity Scheduling: Appointment bookings and related customer records.
Payment processors: Secure payment transactions.
Google: Analytics and, where used, administrative spreadsheets.
Meta: Advertising measurement where consent has been provided.
Email service providers: Booking and marketing communications.
We may also disclose information to professional advisers, insurers, emergency services, regulators or law enforcement where necessary and legally justified.
We do not sell customer personal information.
Service providers are required to handle personal information in accordance with applicable data protection requirements.
11. INTERNATIONAL DATA TRANSFERS
Some technology providers may process personal information outside the European Economic Area.
Where personal data is transferred internationally, we will ensure that an appropriate GDPR transfer mechanism applies, such as an applicable adequacy decision or approved contractual safeguards.
Information about relevant safeguards may be requested using our privacy contact email.
12. HOW LONG WE KEEP INFORMATION
We retain personal information only for as long as necessary for the purposes described in this policy, taking account of applicable legal obligations and potential claims.
CCTV footage: Normally 14 days, unless lawful longer retention is necessary for an incident.
Financial and tax records: For the periods required by applicable Irish law.
Booking and waiver records: For a documented period appropriate to administration, safety, legal obligations and potential claims.
Membership and voucher records: For as long as necessary to manage the service, followed by any applicable legal retention period.
Marketing information: Until consent is withdrawn or the information is no longer required for the stated purpose.
Health information: Only for the minimum period justified by its specific safety or legal purpose.
Information that is no longer required will be securely deleted or anonymised, subject to applicable legal requirements.
13. YOUR DATA PROTECTION RIGHTS
Under GDPR, you may have the right to:
Access your personal information.
Correct inaccurate information.
Request deletion of information where applicable.
Restrict or object to certain processing.
Receive certain information in a portable format.
Withdraw consent where processing relies on consent.
Object at any time to direct marketing.
To exercise your rights, contact Rytis@kokopelli.ie.
We will respond in accordance with applicable GDPR time limits, normally within one month.
You may also lodge a complaint with the Irish Data Protection Commission at www.dataprotection.ie.
14. INFORMATION ABOUT YOUNGER CUSTOMERS
Our facilities have a minimum participation age of 16.
Customers aged 16 or 17 must be accompanied by a parent or legal guardian and comply with our guardian consent and safety requirements.
We collect only the personal information necessary to administer these bookings and safety arrangements.
15. DATA SECURITY
We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.
These measures include restricted staff access, appropriate account security and controlled access to CCTV and customer records.
No electronic system can guarantee absolute security, but we take reasonable steps to protect the information entrusted to us.
16. CHANGES TO THIS POLICY
We may update this Privacy Policy when our services, technology or legal obligations change.
The latest version will be published on our website with its updated date.
17. CONTACT US
For privacy questions, access requests, corrections or deletion requests, please contact:
Kokopelli Ltd. - Natas Sauna
Sarsfields, Newbridge, Co. Kildare, Ireland
Email: Rytis@kokopelli.ie
END OF PRIVACY POLICY