Privacy Policy

Last updated: 27 September 2026

Lispa Group Ltd. (“Lispa”, “we”, “us”) respects your privacy and is committed to handling personal data lawfully, fairly, securely and transparently.

This Privacy Policy explains what personal data we collect, how and why we use it, who may process it on our behalf, how long we keep it and the rights available to you under the General Data Protection Regulation (“GDPR”) and applicable Maltese data protection law.

Data Controller

The controller responsible for your personal data is:

Lispa Group Ltd.
A company registered in Malta
Email: [email protected]

Please use the email address above for privacy questions or requests concerning your personal data.

Personal data we collect

We collect information that you provide to us, information generated when you use our services and limited technical information required to operate and protect our website.

Enquiries

When you contact Lispa through our website, email or another communication channel, we may process your name, email address, area of interest, message and any other information you choose to provide.

Website contact forms are processed through Lispa’s website contact service and delivered to Lispa by Resend on Lispa’s behalf.

Bookings

When you make or request an appointment, we may process your name, email address, telephone number, selected treatment, preferred or confirmed appointment date and time, booking reference, preferences, voucher code, booking status and relevant communications.

Health and treatment-suitability information

Before or during a treatment, you may provide information about matters such as health conditions, allergies, pregnancy, injuries, medication or other circumstances relevant to treatment safety or suitability.

Health information is a special category of personal data under the GDPR and receives additional protection.

Lispa will only request or record health-related information that is reasonably relevant to assessing whether a treatment can be provided safely and appropriately.

Where Lispa records health information on the basis of your explicit consent, that processing is carried out under Article 6(1)(a) and Article 9(2)(a) GDPR.

You may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before withdrawal. Where relevant information is necessary to determine whether a treatment can safely proceed, withdrawing or declining to provide that information may mean that Lispa cannot provide the treatment.

Health or treatment-suitability information should not be used for marketing.

Digital gifts

When a digital gift is purchased, delivered or redeemed, we may process purchaser and recipient names and email addresses, the personal message supplied by the purchaser, selected gift, purchase and delivery date, voucher code, monetary value, remaining balance, redemption history and delivery status.

Where a purchaser gives us another person’s details so that Lispa can deliver a gift, the recipient’s information has been obtained from the purchaser rather than directly from the recipient.

We use that information only as reasonably necessary to create, deliver, administer and redeem the gift and to communicate with the recipient about it.

The gift recipient will be provided with access to appropriate privacy information when Lispa first communicates with them.

Membership and the Google Wallet card

If you hold a Lispa membership, we process your name (and, for a shared membership, both names), your Chapter, founding number, membership start date and status, your monthly included benefit and its use, and your visit history.

Adding your membership card to Google Wallet is optional. If you add it, the card held by Google shows your name, Chapter, founding number, membership start date, number of visits, whether this month’s included benefit is still available, and the date, time and treatment of your next confirmed visit, together with a signed code that Lispa staff scan when you arrive. Lispa updates the card when these details change and may occasionally send a short note to it, such as a reminder the evening before a visit.

Google processes the card under its own privacy terms. You can remove the card from Google Wallet at any time. When a membership ends, the card is marked inactive and its scan code is removed.

Payments and transactions

We may process payment status, transaction references, amount, date, refund status and information required for accounting, fraud prevention and customer support.

Payment-card details are handled by the applicable payment provider and are not intended to be stored by Lispa.

Where online gifting or payment functionality is enabled, Revolut may process payment information in accordance with its own applicable privacy terms.

Website, security and technical information

Our hosting, content-delivery and security providers may necessarily process technical information such as IP address, browser or device information, request information, timestamps and security events in order to deliver the website, prevent abuse and maintain security.

This essential technical processing is separate from optional analytics.

Cloudflare is used for website delivery, infrastructure and security functions.

Analytics

Where you consent to analytics cookies, Lispa may use Google Analytics 4 to understand how visitors interact with the website.

Analytics information may include pages viewed, approximate referral source, engagement information, device or browser information and related usage information.

Optional analytics are activated only after the required consent has been provided through Lispa’s cookie controls.

How we use personal data

Lispa may use personal data to respond to enquiries; create and administer bookings; provide appointment confirmations and service reminders; assess treatment suitability and safety; create, deliver, administer and redeem digital gifts; process payments and refunds; prevent fraud and misuse; maintain accounting and transaction records; respond to customer-service issues and disputes; operate, secure and improve the website and business; comply with legal obligations; and analyse website usage where analytics consent has been given.

Lispa does not sell or rent personal data.

Booking, gift or treatment information is not used for third-party advertising.

Lispa will not use your booking or gift information to send direct marketing unless there is an appropriate lawful basis and you have been provided with the required choice and information.

Legal bases for processing

Different activities rely on different legal grounds.

Contract and steps requested before entering a contract: We process information needed to administer purchases, gifts, vouchers, requested appointments, payments and the services you ask us to provide.

Legitimate interests: We may process information where reasonably necessary to answer enquiries, administer our business, provide customer support, maintain security, prevent fraud or misuse, establish or defend legal claims and improve our operations, provided that those interests are not overridden by your rights and interests.

Consent: We rely on consent for optional analytics and, where applicable, explicit consent for recorded health or treatment-suitability information falling within the special categories of personal data.

Legal obligation: We process and retain certain transaction, accounting or other records where Maltese or EU law requires us to do so.

Where consent is used, you may withdraw it at any time.

Service providers and recipients

Lispa uses carefully selected service providers to operate parts of its website and services. Depending on the functionality being used, these may include:

Google Analytics 4 for optional website analytics.

Cloudflare for website infrastructure, content delivery and security.

Revolut for payment processing where online payment functionality is enabled.

Resend for transactional emails such as gift delivery, confirmations and service reminders.

Google Calendar for appointment availability and calendar administration where online booking functionality is enabled.

Google Wallet for the optional digital membership card, where a member chooses to add it.

Service providers may process personal data only for the purposes for which they are engaged and subject to the applicable contractual and data-protection requirements.

Personal data may also be disclosed where reasonably necessary to professional advisers, accountants, insurers, payment providers or competent public authorities, or where disclosure is required by law.

Lispa does not provide personal data to third parties for their own direct-marketing purposes.

International transfers

Some service providers or their authorised subprocessors may process personal data outside Malta or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, Lispa will use a transfer mechanism recognised by the GDPR, as applicable to the relevant provider and transfer.

This may include a European Commission adequacy decision, participation by an eligible US organisation in the EU-US Data Privacy Framework, or approved contractual safeguards such as the European Commission’s Standard Contractual Clauses.

You may contact Lispa for further information about the safeguards relevant to a particular transfer.

Cookies and consent choices

Lispa uses strictly necessary website technologies where required to operate, secure or remember choices on the website.

These may include a consent-preference record, such as lispa_consent, which remembers whether optional analytics have been accepted or declined.

Strictly necessary technologies do not require consent where the applicable legal exemption applies.

Google Analytics is optional.

If you accept analytics through the cookie banner, the relevant analytics technologies may be activated.

If you decline analytics, optional analytics cookies are not activated.

You can change or withdraw your analytics choice at any time using Review cookie preferences on the website.

Withdrawing consent is designed to be as straightforward as providing it.

Withdrawal does not affect processing that occurred lawfully before consent was withdrawn.

Data retention

Lispa does not keep personal data indefinitely. Retention depends on the purpose of the information and any applicable legal requirement.

Our standard approach is as follows.

General enquiries: ordinarily retained for up to 24 months after the last meaningful contact, unless the enquiry becomes part of a booking, transaction, complaint or legal matter.

Booking and customer-service records: ordinarily retained for up to 24 months after the relevant appointment or last interaction, except where particular information must be retained for accounting, dispute or legal purposes.

Health and treatment-suitability information: retained only for as long as reasonably necessary for treatment safety, continuity and related legal purposes and ordinarily no longer than 24 months after the last relevant treatment, unless a longer period is necessary to establish, exercise or defend a legal claim or comply with law.

Gift delivery information: retained for the period reasonably necessary to deliver, administer and support the gift and ordinarily for up to 12 months after redemption or expiry, unless part of a transaction record that must be retained longer.

Transaction, payment, voucher-redemption and accounting records: retained for the period required by applicable tax and accounting law. Certain Maltese VAT records are generally required to be retained for at least six years from the end of the relevant year.

Google Analytics data: retained for up to 14 months according to Lispa’s analytics configuration.

Consent records: retained for as long as reasonably necessary to respect your preference and demonstrate compliance with applicable data-protection requirements.

Technical and security logs: retained according to the relevant security configuration and only for as long as reasonably necessary for website operation, security, fraud prevention or investigation of an incident.

Where information is needed in connection with a complaint, investigation or legal claim, the relevant data may be retained until the matter and any applicable retention period have ended.

At the end of the applicable retention period, personal data is deleted, anonymised or securely disposed of where it is no longer required.

Data security

Lispa applies appropriate technical and organisational measures intended to protect personal data from accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access.

Access to personal data is limited according to operational need.

Because no online system can guarantee absolute security, Lispa regularly reviews the services and safeguards used to process personal data and will respond to personal-data breaches in accordance with applicable legal requirements.

Your GDPR rights

Depending on the circumstances and the legal basis for processing, you may have the right to:

• request access to personal data Lispa holds about you;
• request correction of inaccurate or incomplete data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a structured, commonly used and machine-readable format and request data portability where the legal requirements apply;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with the Information and Data Protection Commissioner in Malta.

These rights are not absolute and may be subject to conditions or exceptions provided by law.

To exercise a right, contact [email protected]. Lispa may request information reasonably necessary to verify your identity before acting on a request.

Lispa will respond within the period required by the GDPR, ordinarily within one month of receiving a valid request. That period may be extended where the GDPR permits because of the complexity or number of requests.

Automated decision-making

Lispa does not use solely automated decision-making, including profiling, that produces legal effects or similarly significant effects on customers.

Information you provide about another person

Please only provide another person’s personal information where you are entitled to do so and where it is reasonably necessary for the service requested.

This commonly applies when purchasing and sending a digital gift.

Lispa will use recipient information for the relevant gift or service and will provide appropriate privacy information to the recipient when required.

Required information

Certain information is necessary to complete a booking, payment or gift transaction.

If required information is not provided, Lispa may be unable to complete the requested transaction or service.

Health-related information is requested only where relevant to treatment suitability or safety. If Lispa cannot reasonably determine that a treatment can be provided safely, it may be necessary to postpone, adapt or decline that treatment.

Changes to this Privacy Policy

Lispa may update this Privacy Policy where its services, technology, providers or legal obligations change.

The latest revision date will always appear at the top of the policy.

Where a change materially affects how personal data is used, Lispa will take reasonable steps to bring the change to the attention of affected individuals where required.

Contact

For privacy questions, data-protection requests or concerns about how Lispa handles personal data, contact:

Lispa Group Ltd.
Email: [email protected]
Telephone: +356 7719 2359

You also have the right to contact the Information and Data Protection Commissioner (Malta) if you believe your personal data has been processed contrary to applicable data-protection law.