Privacy policy
As of October 2026
In this privacy policy I explain which personal data I process when you visit this website, book an appointment, ask for a massage at home, buy a voucher or contact me. I also explain what I use the data for, to whom I disclose it, how long I keep it and which rights you have. It is based on the Swiss Federal Act on Data Protection (FADP).
Controller
INS SPA Thaimassage, Giratchapat Häring Spitalgasse 26 3011 Bern Switzerland
E-mail info@insspa-thaimassage-bern.ch Phone 079 697 89 98
For all questions about data protection, you can reach me at this address.
Booking
When you book an appointment online, I record your first name and last name, your e-mail address, your phone number, your address and your optional note, together with the massage you chose, the date and time, the type of price (wellness price or health insurance price) and how you pay. For a massage for two, the first name and last name of the second person are added. If you book by phone, I record the details you give me on the phone.
I use this data to carry out your appointment, to confirm it, to remind you of it and to handle changes or cancellations. After an appointment I may ask you by e-mail for a review. You can unsubscribe from these requests at any time via the link in the e-mail. If you come back, I recognise you by your e-mail address, for example so that I ask you for a review at most every two months.
I store this data in my database for as long as I need it for your appointments. What I need for my accounting, for example appointments with price and payment, I keep for ten years because the law requires it. I delete the other details as soon as you ask me to.
Health insurance and receipts
If you choose the health insurance price, I also record the name of your insurer when you book. The fact that you receive a massage with a receipt for your health insurance is information about your health and therefore sensitive personal data. I use this data only to issue the receipt for your supplementary insurance (Tarif 590) and to keep my accounts. For a massage for two, the same applies to the second person.
The receipt shows your name, your address, your date of birth, the massage with date, duration and price, and my details as a therapist, for example my EMR and ZSR numbers. I take your date of birth and, if your insurer requires it, other details such as your insurance number at your appointment, not through the website. I send you the receipt by e-mail after the massage, and you submit it to your insurer yourself. I do not pass on any information about you to your insurer unless you wish me to.
I may keep your date of birth with your customer details in my studio's protected admin area so that I can also issue a receipt for later appointments. Only someone with a special permission can see it there. In e-mails I only mention the name of your insurer. I do not pass on any information about your health insurance to Stripe or to Google.
Receipts are part of my accounts, so I keep them for ten years. I delete your date of birth and the details of your insurer in your customer details as soon as you ask me to.
Massage at home
If you ask for a massage at your home, I record your first name and last name, your phone number, your e-mail address, your address, your notes (for example on the floor, lift or parking), the massage you chose, your preferred date and, for the health insurance price, the health insurance details described above. I use them to send you an offer and to carry out the appointment. A short e-mail to the studio's mailbox also informs me of a new request.
To calculate the distance and travel time, I send only the street, postcode and town to the address search of geo.admin.ch (Swiss Confederation), which determines the coordinates. With these coordinates and your preferred date, the journey planner of opentransportdata.swiss (operated by SBB AG on behalf of the Federal Office of Transport) calculates the travel time by public transport, and the routing service OpenRouteService (HeiGIT gGmbH, Germany) may calculate the route. Your name and your other details are not transmitted. To see the connection and the fare, I may open the connection to your address in the SBB online timetable (sbb.ch).
Online payment and vouchers
If you pay online, the payment is processed by Stripe (Stripe Payments Europe Ltd., Ireland). You pay in a payment form of Stripe that appears on my website; your card and payment details go straight to Stripe. I never see your card number.
From me, Stripe only receives the name and duration of the massage, the amount, your e-mail address and an internal booking number, but no information about your health or your health insurance. From Stripe I receive the confirmation of whether and how you paid, for example with TWINT or Visa. Stripe's own privacy policy also applies to its processing.
If you choose TWINT, Klarna, Apple Pay or Google Pay, that provider also processes your details for the payment, under its own responsibility and according to its own privacy policy: TWINT AG (Switzerland), Klarna Bank AB (Sweden), Apple Distribution International Ltd. (Ireland) or Google Ireland Limited (Ireland). Klarna may check your identity and creditworthiness.
If you buy a voucher, I keep your name and e-mail address and, if you wish, the name of the person receiving it and your message, so that I can send you the voucher and recognise it when it is redeemed. For this, Stripe only receives the amount and your e-mail address. Vouchers are part of my accounts, so I keep them for ten years.
Contact form, e-mail, phone and WhatsApp
If you write to me via the contact form, I record your name, your e-mail address, your phone number if you provide it, and your message. I store your request in the protected admin area and also receive it by e-mail in the studio's mailbox so that I can reply. You receive an automatic acknowledgement. If you call me or send me an e-mail, I use your details in the same way to answer your request.
The mailbox info@insspa-thaimassage-bern.ch is hosted by Hostinger (Hostinger International Ltd., Cyprus). I also read and answer my e-mails with e-mail programs such as Gmail (Google), Outlook (Microsoft) or Apple Mail. Google and Microsoft also store the messages on their own servers for this, including in the USA.
If you write to me via WhatsApp, the message goes through WhatsApp (WhatsApp Ireland Limited, Ireland, a Meta company). WhatsApp processes your phone number and other details under its own responsibility, also in the USA. If you do not want this, call me or send me an e-mail.
I keep requests for as long as I need them for my answer and any follow-up questions, and delete them afterwards.
Automatic e-mails
I send confirmations, reminders, offers, vouchers and the other automatic e-mails of this website via the service Resend (Plus Five Five, Inc., USA). For this, Resend receives your e-mail address and the content of the message and processes them in the USA.
For every e-mail I record whether it was delivered or whether delivery failed, so that I can reach you if there is a problem. I do not measure whether you open an e-mail or click a link in it.
Hosting and database
This website is operated by Vercel Inc. (USA). Bookings and forms are processed on servers in Frankfurt (Germany). The database is hosted by Neon (Neon, LLC, USA, a Databricks company) on servers in Frankfurt. When you visit the website, technical access data such as your IP address, the time, the page requested and your browser are processed in logs so that the website runs securely. Vercel deletes these logs after a short time.
Map and links to other services
On the contact page I show a map from Google Maps (Google Ireland Limited, Ireland). It loads with the page. In doing so, data such as your IP address is transmitted to Google, and Google may set cookies and also process the data in the USA.
The fonts, images and scripts of this website come from the website itself or from my hosting provider Vercel; there is no connection to Google Fonts. Links to other services, for example to WhatsApp, Instagram, Facebook or my Google profile, are simple links. Only when you click on them do you reach the respective provider, whose terms then apply.
Cookies and browser storage
One cookie that stores your choice of language is technically necessary. As long as the website can only be reached as a password-protected preview, a cookie for this password is added.
After a booking or request, your browser keeps your name, e-mail address, phone number and address in the local storage of your device, so you do not have to enter them again next time. Details about your health insurance and your AHV number are never stored there. These details stay on your device. You can remove them at any time with «Clear details» in the booking or in your browser settings.
In my studio's protected admin area, cookies for the login and for settings are added. They are not set when you visit the website or book.
Visitor statistics
For visitor statistics without cookies I use Vercel Web Analytics (Vercel Inc., USA). It counts page views without identifying anyone and without recognising you from one day to the next.
Search engines
I use Google Search Console (Google Ireland Limited, Ireland) and Bing Webmaster Tools (Microsoft Ireland Operations Limited, Ireland) to see how this website appears in search results and whether Google and Bing can read it without errors. These services show me aggregated data from searches, for example search terms and clicks. They do not receive any data about your visit to this website through this.
Protection against misuse
So that my forms are not misused for spam or fake bookings, I count bookings, requests and queries of the booking calendar per IP address. These counters are not linked to any booking or person, are not used for anything else and are deleted after about one day.
When you submit a form, the service Vercel BotID (Vercel Inc., USA) also checks in the background whether the request comes from an ordinary browser and not from an automated program. For this, technical details about the browser and the connection, including the IP address, are transmitted to Vercel. You do not have to click anything.
Data abroad
I process your data in Switzerland and disclose it to the service providers mentioned as far as each purpose requires. Some process it in the EU: Hostinger (Cyprus), Stripe, Google, Microsoft and WhatsApp (Ireland), Klarna (Sweden), OpenRouteService (Germany) and the servers of Vercel and Neon in Frankfurt. According to the Federal Council, the EU states offer an adequate level of data protection.
In the USA, data may be processed by Vercel, Neon, Stripe, Google, Microsoft and Meta (WhatsApp). These companies are certified under the Swiss-U.S. Data Privacy Framework, which the Federal Council has recognised as adequate. Resend is not certified; here I rely on the standard contractual clauses of the European Commission, recognised by the FDPIC.
How long I keep data
I keep personal data only for as long as I need it for the respective purpose or the law requires it. I keep appointments with price and payment, receipts and vouchers for ten years because the law requires it for accounting. I delete your customer details, for example your phone number, notes and date of birth, when you ask me to or when I no longer need them.
Data security
I protect your data with technical and organisational measures: the website can only be reached encrypted (HTTPS), the admin area only with a personal login and with rights according to each task, and I only store any AHV number in encrypted form. Risks in transmission over the internet can, however, never be ruled out entirely.
Your rights
You have the right to receive information about your personal data and to have incorrect data corrected and your data deleted. You can also ask me to give you your data in a common electronic format or to transfer it to another provider, and you can object to processing, for example to requests for a review. To do so, write to me at info@insspa-thaimassage-bern.ch. So that I do not hand your data to anyone else, I may ask you to prove your identity. I delete your data promptly unless the law requires me to keep it.
If you do not agree with my answer, you can contact the Federal Data Protection and Information Commissioner (FDPIC).
Changes
I adapt this privacy policy when the website or my procedures change. The version published on this website applies.