Privacy policy

What we collect

When you book a treatment we collect your name, telephone number or email address, the treatment and time you have chosen, and any notes you give us.

If you volunteer health information — pregnancy, an injury, recent surgery, a cardiac condition — we record it because your therapist needs it to treat you safely. We do not ask for information we do not need.

Why we hold it

To deliver the treatment you booked, to contact you about your appointment, and to keep a record of what treatment you have received in case you return.

We do not sell your data, and we do not use it for marketing unless you have explicitly asked us to.

Legal basis for each purpose

We process your data on these grounds. Bookings and appointment records: to carry out the treatment you asked for (performance of a contract). Health information you choose to share: your explicit consent, which you can withdraw at any time. The newsletter: your consent. Replies to enquiries sent through the contact form: your consent, given by ticking the box. Records we are legally required to keep: a legal obligation. Running and securing this website (hosting, the map): our legitimate interest in providing a working and secure site.

Analytics cookies and marketing cookies (advertising measurement and personalised ads) are set only with your consent; without it they stay off. The cookieless signals that Google tags send before you choose are described in the Cookies section.

Who else sees it

We share personal data only with the service providers below, each for a defined purpose.

Acuity Scheduling (Squarespace, USA) handles online bookings on our behalf and stores your appointment details on servers outside Bosnia and Herzegovina.

Cloudflare provides the hosting and content delivery network for this website. It processes technical request data, such as your IP address, on our behalf so that the site can be delivered and protected.

Our website uses Google Tag Manager and, through it, Google Analytics and Google Ads (account AW-472734301), provided by Google Ireland Limited. Data may be transferred to Google LLC in the United States. Google Analytics measures how the site is used. Google Ads measures how well our advertising works and, if you allow marketing cookies, can show you personalised ads (remarketing). This happens only as described in the Cookies section below.

Transfers to the United States

Google, Cloudflare and Acuity Scheduling (Squarespace) may process data in the United States. For such transfers these providers rely on safeguards such as the EU–U.S. Data Privacy Framework or standard contractual clauses; the safeguard that applies is set out in each provider’s own privacy notice.

Newsletter

The newsletter form in the footer collects one thing: your email address. You must tick the consent box before you can subscribe, and that consent is why we may email you. We plan to send one email a month about new treatments, member offers and gift-voucher dates.

Your address is kept on our newsletter list with AWeber Communications in the USA, which acts as our processor and sends the emails. It stores your email address, the date and time you signed up, the page you signed up on, your language and the version of the consent wording you agreed to. You can unsubscribe at any time with the link in every email, or by calling or messaging +387 61 018 784; withdrawing consent does not affect anything sent before.

The newsletter form uses Cloudflare Turnstile to block automated sign-ups. It processes technical data such as your IP address and browser signals to tell people from bots, and it sets no tracking cookies. When you subscribe, we record the date and time, the page you signed up on, your language and the version of the consent wording you agreed to, as proof of your consent.

Contact form

The contact form asks for your name, optionally a phone number and email address, what your enquiry is about and your message. You tick a box to agree that we may use these details to reply.

Today the form is not connected to a mail handler or CRM, so nothing you enter is sent or stored. To reach us, please call or message +387 61 018 784. Once the form is connected, the details will be used only to answer your enquiry.

Map on the contact page

The contact page shows a map from OpenStreetMap, a service run by the OpenStreetMap Foundation. When the page loads, your browser requests the map from the Foundation’s servers, so it receives your IP address and standard browser information. We send it nothing else.

The “Get directions” link leads to Google Maps, which has its own privacy policy and is only loaded if you click the link.

How long we keep it

Appointment records are kept while you remain an active guest and for a reasonable period afterwards so we can honour the member offer and any follow-up treatment.

You can ask us to delete your record at any time. We will do so unless we are legally required to keep it.

Your rights

You have the right to access the data we hold about you, to have it corrected, to have it erased, to restrict how we use it, to receive it in a portable format and to object to our processing of it. Where we rely on your consent (health information, the newsletter, cookies) you can withdraw it at any time; this does not affect anything done before. Call or message +387 61 018 784 and we will deal with it.

You also have the right to complain to a supervisory authority. In Bosnia and Herzegovina that is the Agencija za zaštitu ličnih/osobnih podataka u Bosni i Hercegovini (the Personal Data Protection Agency of Bosnia and Herzegovina, azlp.ba). If you are in the European Union you may also complain to the data protection authority in the country where you live or work.

Cookies

We use three kinds of cookies. Necessary cookies keep the site working. They include our own cookie, gls_consent, which stores your choice for up to 12 months; we ask again after that, or sooner if the categories change. Some browsers, Safari in particular, delete cookies that a site’s own scripts set after a few days, so you may be asked again sooner.

Analytics cookies come from Google Analytics. They tell us which pages are visited, on what kind of device and browser, and roughly from where, using cookies such as _ga. Marketing cookies come from Google’s advertising services. They let Google measure how well our ads work and, because there is a single Marketing switch, also show you personalised ads (remarketing) based on your visit to this site. They are off unless you allow them. Every cookie and browser-storage item is listed in the table below.

Google Tag Manager loads on every visit, shortly after the page has finished loading, and follows Google Consent Mode. Until you consent, Google tags set no analytics or advertising cookies. They do send cookieless signals that include your IP address, the page address and, if you came from an ad, the ad-click identifier. Your choice takes effect straight away.

You can change or withdraw your choice at any time with the “Cookie settings” link at the bottom of every page. Withdrawing removes the Google cookies and stored values that this site can reach, and does not affect processing that took place before.

The fonts on this site are served from the site itself, so no request goes to a font provider.

Cookies marked “third party” are set by Google on its own domains, not on this website. The “Cookie settings” link cannot delete them, so if you withdraw your consent, clear them in your browser settings. Lifetimes are the maximum the provider states and can change.

Contact us about privacy

GoodLife Spa, Dalmatinska 1, 71000 Sarajevo, Bosnia and Herzegovina. Telephone, WhatsApp and Viber: +387 61 018 784.

This is a prototype policy prepared as part of a redesign and still requires legal review against the applicable data protection law before publication.