How Spa Ceylon uses your data

Spa Ceylon runs this Secret Santa platform. Companies use it to run their office gift exchange, and Spa Ceylon supplies the gifts. One reason Spa Ceylon runs it is to get to know the companies and people who take part, so it can tell them about Spa Ceylon products and offers. Everyone reads and agrees to this notice when they sign up.

• About companies: the company name, the name, email and mobile number of the person who registered it, and its campaigns.
• About people: your name, email, mobile number and username, the company and campaigns you take part in, your wishlist and the preferences you share with it (such as scents, self-care, skin type and how you like to shop), your birthday month if you give it, the gifts you buy and when you collect yours.
• Gifting only: allergy and sensitivity notes, ingredients to avoid, your note to Santa and any idea you add that isn't from Spa Ceylon. These help your Santa choose and are never used for marketing.

• To run Secret Santa: confirm who you are, match you with a recipient, process gifts and arrange handover.
• For Spa Ceylon marketing: to understand our customers, to tell you about Spa Ceylon products and offers, and to show you Spa Ceylon ads on other websites and apps. Showing ads can mean sharing your email or mobile number, in a protected (hashed) form, with advertising platforms such as Google or Meta.
• We only email or text you offers if you said yes to Spa Ceylon news and offers when you joined a campaign.

• Spa Ceylon staff, for the purposes above.
• Your company's Secret Santa organisers, for the people in their own campaigns.
• Your Secret Santa sees only your display name, wishlist and preferences, never your contact details.
• We don't sell your data. Card payments are handled by the Spa Ceylon store checkout, and we never see card numbers.

Corporate admins share the names and contact details of the people they add with Spa Ceylon. Only add people who know their details will be shared with Spa Ceylon for the purposes above. Each person also sees this notice and agrees to it when they sign up.

You can ask us at any time to stop using your details for marketing, to show you what we hold, or to correct or delete it. Use the support form and choose Privacy or data request. We keep your details while they're needed for the purposes above, or until you ask us to delete them.