Privacy Policy
Last updated: 16 August 2026
This policy explains how THTY TRADING AND SERVICES LTD, trading as iFoot Massage (“we”, “us”), handles personal data when you use our website, request an appointment, buy a gift card or contact us.
1. Who controls your data
The data controller is THTY TRADING AND SERVICES LTD, trading as iFoot Massage, Michalaki Kyprianou 59, Pegeia 8560, Paphos, Cyprus. Contact: thtycyprus@gmail.com or +357 95 955 666.
2. Data we collect
- Your name, phone number, email address and messages.
- Appointment details, including service, date, time, number of guests and optional requests.
- Gift-card purchaser and recipient details, personal message, order and payment status. Stripe processes card details; we do not receive your full card number.
- Communications with us by email, phone, SMS or WhatsApp.
- Basic technical, referral and advertising-measurement data when permitted by your cookie choice.
- Your cookie choice stored on your device.
3. Why we use it and our legal basis
- To take steps at your request, manage and confirm bookings, provide services and fulfil gift-card orders.
- To meet accounting, tax and other legal obligations.
- For legitimate interests such as customer service, website security, preventing misuse and understanding business performance, where your rights do not override those interests.
- With your consent, for non-essential Google Ads measurement. You can withdraw this consent at any time through Cookie Settings.
4. Health information
Please do not send detailed medical information through our online forms. You may state a general pressure preference or service request online and tell your therapist in person about relevant health concerns before treatment. If we ever need to process health data, we will do so only where necessary and with an appropriate legal basis and safeguards.
5. Who may receive data
We use service providers where needed to operate the business, including website hosting in Germany, Brevo for booking emails, Stripe for online payments, communications providers and Google for advertising measurement only according to your consent. Professional advisers or public authorities may receive data when legally required. Providers process data under their own terms and/or our instructions as applicable.
6. International transfers
Some providers may process data outside the European Economic Area. Where required, we rely on lawful transfer safeguards such as adequacy decisions or approved contractual clauses.
7. Retention and security
We keep data only for as long as needed for the purpose collected, customer service, disputes and legal or accounting requirements. We use reasonable technical and organisational measures, but no internet service can guarantee absolute security.
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction or portability of your data, object to certain processing, and withdraw consent without affecting earlier lawful processing. Contact us using the details above. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus.
9. Changes
We may update this policy when our services or legal requirements change. The current version and date will remain on this page.