Privacy Statement

We collect personal information that is reasonably necessary to provide our services, process your orders and enhance your experience. This may include:

• Identity information — name, date of birth, gender
• Contact information — email address, phone number, postal address
• Transaction information — purchase history, payment details, booking records
• Health information — relevant medical or skin conditions disclosed for treatment safety (collected only with your consent)
• Loyalty information — mySpa Rewards membership details, points balance, preferences
• Technical information — IP address, browser type, device information, cookies

We collect information directly from you, through our website, in-spa consultations, booking systems, and through our mySpa Rewards programme.

We use your personal information for the following purposes:

• Processing and fulfilling spa bookings and product orders
• Providing personalised treatment recommendations
• Communicating appointment reminders, order updates and delivery notifications
• Sending marketing communications (only with your consent)
• Improving our services, website and guest experience
• Complying with legal and regulatory obligations

We will not use your personal information for purposes other than those described here without your consent.

Our website uses cookies and similar technologies to:

• Remember your preferences and shopping cart
• Analyse website traffic and usage patterns
• Improve website performance and user experience
• Provide relevant content and recommendations

You can manage cookie preferences through your browser settings. Disabling cookies may affect some website functionality.

We use analytics services to understand how visitors interact with our website. This data is aggregated and does not personally identify you.

We do not sell your personal information to third parties. We may share your information with trusted service providers who assist us in operating our business:

• Payment processors — to securely process transactions
• Delivery partners — to fulfil product orders
• Email and SMS providers — to send communications you have consented to
• Booking system providers — to manage spa appointments
• Analytics providers — to improve our website and services

All third-party providers are required to protect your information and use it only for the purpose for which it was shared.

We take reasonable steps to protect your personal information from misuse, loss, unauthorised access, modification and disclosure. Our security measures include:

• Encrypted data transmission (SSL/TLS) across our website
• Secure payment processing through PCI-compliant providers
• Access controls limiting who can view personal information
• Regular security reviews and updates

While we take all reasonable precautions, no method of electronic storage or transmission is completely secure. We encourage you to protect your account credentials.

Under the Australian Privacy Principles, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request correction of inaccurate or outdated information
• Opt out — unsubscribe from marketing communications at any time
• Complaint — lodge a complaint if you believe your privacy has been breached

To exercise any of these rights, please contact our privacy team at concierge@stephanies.com.au or call 1300 DAYSPA.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

• Transaction records — retained for 7 years as required by Australian taxation law
• Booking history — retained for the duration of your client relationship
• Marketing preferences — retained until you opt out or request deletion

When information is no longer required, it is securely deleted or de-identified.

We may update this privacy statement from time to time to reflect changes in our practices or legal requirements. The most current version will always be available on this page.

Where changes are significant, we will take reasonable steps to notify you, such as by email or a notice on our website.

Last updated: July 2026