Privacy policy

Last updated: 12 October 2026.

This notice explains how Shaantha Wellness handles personal data when you visit shaanthawellness.com or contact us about a massage.

Who is responsible

The data controller is Tabea Christiane Both, a self-employed practitioner trading as Shaantha Ayurvedic Massage & Wellness Sagres, based at Rua da Botelha, 8650-359 Sagres, Portugal.

For privacy questions or to exercise your rights, contact us on WhatsApp at +351 938 132 927.

Visiting this website

This website is hosted by Cloudflare, Inc., which processes IP addresses and technical request information to deliver and protect the website, including when you decline optional analytics. Our purpose and legitimate interest are to keep the website available and secure. Cloudflare retains service information according to the purposes and criteria described in its privacy policy and data processing terms.

Our website's fonts and photographs are served with the website. Visiting a page does not request fonts from Google's font service.

We use browser storage to remember your analytics choice in shaantha-consent. When you make a new choice, we also store its date and the notice version in shaantha-consent-receipt. These records support your privacy settings, rather than track your browsing, and remain in your browser until you change your choice or clear the website's storage. An existing saved choice is retained without recording it as a new consent. You can change your choice through Cookie settings.

Optional analytics

If you choose Accept, we load Google Analytics to understand which pages visitors read and which website links they use. The information can include page visits, approximate location, device/browser information and identifiers held in analytics cookies. Clicking a WhatsApp link may be counted as a contact-link click; it does not tell us whether you complete a booking.

The legal basis for this analytics processing is your consent. You can browse and contact us without accepting. Before you accept, or if you decline, our website does not load the analytics tag or send analytics requests to Google.

Analytics is provided by Google Ireland Limited under its data processing terms. Its _ga cookie distinguishes visitors, and _ga_56DW565S7C stores session state. The website tag configures analytics cookies to expire after 180 days; their expiry may be renewed on a later visit while you continue to allow analytics. Both cookies are set only after you accept Analytics. The website tag has advertising features and Google Signals disabled, and the Analytics property disables advertising personalisation in all regions.

Our Analytics account also enables modelling contributions and business insights, technical support and business recommendations. Google describes modelling contributions as aggregated and de-identified measurements used for industry insights. Its support staff may access Analytics data when needed to resolve technical issues, and its business recommendations use account information to provide insights, offers and optimisation advice. See Google's explanation of these sharing settings. The separate Google products and services sharing option is disabled.

The Analytics account retains event-level data for 14 months and user-level data for 14 months. The user retention period restarts when new user activity occurs. These settings do not apply to standard aggregated reports. We retain those reports for historical comparisons while we use Analytics to evaluate this website. Cookie expiry and Analytics account retention are different settings.

You can withdraw your consent through Cookie settings by choosing Reject. We stop further analytics collection and remove analytics cookies that our website can access. Withdrawing consent does not change the lawfulness of processing that took place before withdrawal. Contact us if you wish to request deletion of data already held. See Google's information about Analytics data.

Location and external links

The location image is hosted with this website. Viewing it does not connect your browser to Google Maps or load an embedded map. Choosing Open in Google Maps takes you to Google's external website, where Google's privacy policy applies.

Contacting us and making a booking

We use a standard WhatsApp account to reply to appointment enquiries and arrange bookings. When you message us, we receive the details you send, such as your name, phone number, message and requested appointment. We use this information only to reply and arrange your appointment, not for marketing or other purposes. The legal basis is taking action at your request before a contract, or performing our contract with you.

Providing contact and appointment details is your choice. If you do not provide the information needed for an appointment, we may be unable to reply or arrange it. We delete appointment chats from our WhatsApp history 30 days after the appointment, unless an unresolved issue justifies keeping the relevant messages for longer. In that case, we keep them only for as long as needed to resolve the issue or meet an applicable legal obligation. For enquiries that do not result in an appointment, we delete the chat 30 days after the last message. We do not make WhatsApp backups.

WhatsApp Ireland Limited provides the service in the European Region and also processes information for its own purposes under its EEA privacy policy. Its policy does not replace our responsibility for the messages and records we receive.

We do not request health information through WhatsApp. Health-related details are discussed directly during your consultation. Please avoid sending sensitive health information when arranging an appointment.

Recipients and international transfers

Only Tabea accesses appointment chats and manages bookings. We do not share those chats or booking details with other people. The providers described above process information necessary to operate their services.

These providers use international infrastructure and may process information outside the European Economic Area, including in the United States. Google states that it uses the EU–US Data Privacy Framework for covered transfers to Google LLC in the United States, and standard contractual clauses for other relevant transfers, as explained in its transfer information and processing terms.

Cloudflare uses international infrastructure. It states that covered transfers to the United States rely on the EU–US Data Privacy Framework and that relevant other transfers use standard contractual clauses, as described in its privacy policy and data processing terms.

WhatsApp's EEA privacy policy describes covered transfers to WhatsApp LLC and Meta Platforms, Inc. in the United States under the Data Privacy Framework, and standard contractual clauses for other transfers, including to the United States, United Kingdom and Singapore. The linked provider notices explain the safeguards and how to obtain further information or copies. You can also contact Tabea using the privacy contact above.

Your rights

Depending on the processing, you can request access, correction, deletion, restriction or portability of your personal data, and object to processing where that right applies. Contact the privacy contact above. We may ask for proportionate additional information if we reasonably need to confirm your identity.

You may also complain to Portugal's Comissão Nacional de Proteção de Dados (CNPD).

Tabea handles appointment requests personally. We do not use automated decisions to approve or refuse your booking.

If we materially change how we use personal data, we will update this notice and request new consent where required.