Privacy Policy

Body & Soul looks after your skin, and we look after the details you share with us the same way. This policy explains what we collect when you visit the salon, shop online, book, message or chat with us, why we collect it, and the choices you have. It is written to meet the New Zealand Privacy Act 2020.

Last updated: September 2026.

Who we are

Body & Soul is a beauty therapy salon at Unit 7/5 Washington Way, Sydenham, Christchurch 8011, New Zealand. We run this website, bodysoul.co.nz, including its online shop. If you have any question about your information, contact us at [email protected] or on +64 3 366 4343.

What we collect, and why

When you message us

Our contact form asks for your name, email address and message, and optionally a phone number and the reason you are writing. We use these to reply to you and for nothing else. Before it reaches us, a submission is screened for spam by Akismet, a filtering service run by Automattic, which sees the message text and technical details such as your IP address purely to score it. If you tick that you would like our newsletter, we add your email to that list (see “Newsletter” below).

When you shop online

To fulfil an order we need your name, email address, phone number, and billing and delivery addresses, along with what you bought. If you create an account we store these with your order history so you do not have to type them again. Payments are taken by Stripe or Afterpay on their own secure systems; your full card number never reaches us and we never store it. When you buy a gift voucher we also collect the recipient’s name and email address, and any message you write, purely to deliver the voucher.

When you book an appointment

Online bookings are made through Kitomba, the salon software we use to run our appointment book and client records. It collects your name, contact details and the appointment you choose, and holds your appointment history with us. Kitomba’s own privacy policy applies to how it stores that information.

When you have a treatment

Some treatments need a consultation form first. These ask about things that affect your safety and results: skin conditions, medications, allergies, pregnancy, recent procedures and similar. This is health information and we treat it with extra care. It is stored encrypted, only your therapists can read it, and we use it solely to decide whether a treatment is suitable for you, to carry it out safely and to keep a record of what was done. We will never use it for marketing. If anything from your consultation needs to be remembered next time, your therapist may add a short summary to your file in Kitomba — never your written answers, signature, email address or phone number. Before-and-after photographs are taken only with your written consent, and are never published without a separate, specific permission.

When you use live chat

Our chat is available when a therapist is online. We keep the conversation, any name or email you give us, and an approximate location (country) worked out from your connection so we can answer sensibly. After a chat ends you can ask for a copy of the transcript by email, or ask us to erase it, from within the chat window.

We only send news and specials to people who have asked for them, whether by ticking the box on our contact form or by entering your email into one of our on-site pop-up offers. Your email address is held with Mailchimp, which sends our emails. Every email has an unsubscribe link, and unsubscribing takes effect immediately.

When you browse the website

Like most websites we keep basic server logs (the address your device connects from, the pages requested, the browser used) to keep the site secure and working. We also keep simple, anonymous counts of how many people see, close or respond to an on-site pop-up offer, so we can see which offers are useful — these counts are never linked to your name, email or account. Our site does not currently run advertising trackers or profile visitors. If that changes we will update this policy first.

Cookies and similar storage

We use a small number of cookies, all of them to make the site work rather than to track you:

Shopping and account cookies remember what is in your bag and keep you signed in to your account.
Preference cookies remember choices such as the low-bandwidth “lite” version of the site, for up to a year.
Chat cookies let you return to a chat you started.
Settings stored on your device (for example light or dark mode) stay in your browser and are never sent to us.

Embedded content from other companies, such as the Google map on our contact page and Afterpay’s payment messaging, may set their own cookies under their own policies. You can clear or block cookies in your browser at any time; the shop needs its own cookies to take an order.

Who we share information with

We never sell your information, and we share it only with the companies that help us serve you, each receiving only what it needs:

Stripe and Afterpay to take payment.
Our courier receives your name, address and phone number to deliver an order.
Kitomba holds the appointment book and client records, including the short consultation summaries described above.
Mailchimp sends the newsletter to people who have subscribed.
Akismet (run by Automattic) screens contact-form messages for spam, seeing the message and technical details such as your IP address.
Our website host and email provider store the site and our mail.
Google Maps draws the map on your order confirmation page. To do that, your delivery address (or the salon’s, if you chose to collect) is sent to Google in the map’s web address; it is not sent anywhere else on the site, and the page works without the map.

Some of these companies store information outside New Zealand. We choose providers whose safeguards are comparable to those required under New Zealand law. We will also disclose information where the law requires it, for example to a court or a regulator.

How long we keep it

Orders and payments: seven years, as New Zealand tax law requires.
Treatment and consultation records: while you are a client and for seven years after your last treatment, so a future therapist can see what has been done and what to avoid, then securely destroyed.
Messages from the contact form: up to twelve months, then deleted.
Chat transcripts: until you ask us to erase them, or after twelve months, whichever comes first.
Newsletter list: until you unsubscribe.

How we protect it

The website is served over an encrypted connection, consultation records are encrypted at rest, and only the staff who need your information to look after you can see it. Card payments are handled entirely by Stripe and Afterpay, which are certified to the card industry’s security standard. No system is perfect; if we ever discover a breach likely to cause you serious harm we will tell you and the Office of the Privacy Commissioner promptly, as the Privacy Act requires.

Your choices and rights

Under the Privacy Act 2020 you can ask to see the personal information we hold about you and ask us to correct it. You can also ask us to delete information we no longer need, unsubscribe from the newsletter at any time, and close your online account. Email [email protected] and we will respond within 20 working days, usually much sooner. If you are not happy with our answer you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Under 16?

Clients under 16 need a parent or guardian to complete consultation forms and consent to treatment. Our online shop and newsletter are intended for people 16 and over.

Changes to this policy

If we change how we handle your information we will update this page and the date at the top. Significant changes will also be mentioned in the newsletter and in the salon.