Privacy Policy

This is the Privacy Policy for Urban Massage Limited, with registered address, Annex, Friars Bridge Court, 41 - 43 Blackfriars Road, London, England, SE1 8NZ ("Urban Massage", "us", "we" or "our"). It explains how we, as data controller, collect, use and share the information that we receive or collect about you (that may include personal information) though our website at www.urban.co and our UK App "Urban"(collectively referred to as "the Site") which you can use to book massage therapy treatments ("Massage Treatments") and purchase related goods ("Products") (collectively referred to as "the Services"), and through other interactions with us that you may have during the course of our various marketing and other activities. It also explains the rights you as a user of our Services have to control the use of your information. Personal information means any information relating to a natural person that allows that individual to be identified either directly or indirectly from that information. In this Policy we distinguish between users of the Services on whose behalf Massage Treatment bookings are made or on whose behalf Products are purchased who we refer to as "Users" and users of the Services on whose behalf we offer the Massage Treatments who we refer to as Therapists.

Please read this Privacy Policy carefully before you start using the Website.

Other applicable terms

In addition to this Privacy and Cookies Policy, our website Terms of Use also apply to your use of the Services and are, where relevant, incorporated by reference into this Privacy Policy.

1. Information we collect about you

Our primary goals in collecting information are to provide our Services to our Users and Therapists and to enable us to best respond to our Users and Therapists' requests for help or information and to improve our Services and their features and content and to promote our Services both through our website and our app and through our events, newsletters, competitions and promotions where we have your permission to do so.

• Categories of Information we collect from you:

Relating to both Users and Therapists

Identity data - information used to identify users including first name, last name, title, date of birth, gender, log in and User and Therapist password details
Contact data - postal address, email address, telephone number and mobile number
Financial data - bank accounts of Therapists in order to pay them for the Services and payment card details to manage payment for massage treatments by Users on behalf of the Therapists and purchases of Products on behalf of Retailers, We note we do not collect full card details but work with third party payment providers (see below) to processor the payment.
Technical data - internet protocol (IP) address, log in (password), browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices used by the user to access your website or app.
Marketing and communications data - User and Therapist preferences in receiving marketing from Urban Massage and any third party affiliates.
Operational data - including interaction with the Services and transcripts from calls, messages from "live chats" with both Users and Therapists,
Location data - data that is used to enable the Therapist to find the User in order to perform the treatmentand the User to check the arrival of the Therapist.
Aggregated data - data that is collected, used and shared such as statistical or demographic data for any purpose, eg. used to analyse trends, track Users' movements around the website or app and to gather information on our User base as a whole. Or, in the case of Therapists we may collect data such as number of bookings and schedule information.

Relating to Users only:

Transaction data -includes details of the Products and Services Users have purchased from the website or app. Usage data-information about how Users use the Services. This includes how you interact with the Services, for example, how long you engage with Urban Massage at a time, how often a booking is made. and which parts of the Services you interact with and the features you use.
Profile data -includes User website browsing history, demographic information such as age, gender, education level, feedback and survey responses, any information that you have made publicly available on our noticeboards or on social media networks
Work related data - We work with businesses to deliver our Services to their employees. If you are employed by one of those businesses, to use the Services you will need to sign up with us. We will collect information from you directly when you do this p and we will also be able to associate this with information provided by your employer, such as your job title.
Service Notes - we may collect information about our Service delivery for example, instructions on how to access a building. You provide this information voluntarily. We pass this information on to Therapists so that they can understand any specific access / similar requirements.
Treatment Reports – if you choose to, you can turn on Treatment Reports. This feature is only turned on with your consent and it can be turned off at any time. The Treatment Reports allow Therapists to record aftercare tips and suggestions to get you back to your best self. The reports may also include information about the treatment itself and your wellness. If you turn this feature on, Therapists that you book a treatment with will be able to see this information. If you turn this off, other Therapists will no longer be able to see such information.

Relating to Therapists only:

Assessment data - information on qualifications and certification of Therapists, trade test assessment results, contact logs data, performance and ratings data.
Profile data - Photograph, biography, treatments offered and languages spoken by Therapists and average rating obtained from our evaluation using algorithms of ratings review and feedback survey results, number of bookings and schedule information.

• Information we may collect from you from your use of the Services

We will use this information to administer the Services and for internal operations, including troubleshooting, data analysis, testing research and statistical survey purposes. We will also use this information to measure the effectiveness of how we present content and deliver our Services and how we market and advertise. This information will also be used to allow you to participate in the interactive features of our Services, when you choose to do so. It is always your choice whether or not to provide information. If you do not provide certain information however, you may not be able to use certain features of the website or app or be provided with certain Services.

• Information we may collect from other sources or which is automatically collected

Information may be gathered from our affiliates and third-party sources including without limitation our third-party service providers (such as events, marketing services and payment providers), publicly available data, other companies and referrals.

When you visit the Website we may automatically collect additional information about you, such as the type of internet browser or mobile device you use, any website from which you have come to the Website and your IP address (the unique address which identifies your device on the internet) and your operating system, which are automatically recognised by our web server. You cannot be identified from this information and it is only used to assist us in providing an effective service on the Website and to collect broad demographic information for aggregate use.

We may from time to time collect personal details from available sources, such as LinkedIn, or from a publically available online registry to which you give your details or from your company's website to contact you in our legitimate business interests with business opportunities which we think might be required from you. In our first communication with you, we will identify if we have obtained your information which we use for these purposes from a third party source.

2. Uses made of your information

We will use the personal information described above to:

(a) identify Users and Therapists when they sign in to their account;
(b) enable us to process Users' bookings of Massage Treatments on behalf of Therapists and purchases of Products on behalf of Retailers, send confirmation of Massage Treatment bookings or confirmation of cancellations of bookings, and to enable Users and Therapists to access other information or assistance offered through the Services and which they request including but not limited to customer service requests or assistance with dispute resolution;
(c) administer User and Therapist accounts;
(d) To assess and verify qualifications and credentials of Therapists and to create and maintain profiles of Therapists;
(e) To manage and process the collection of payment of behalf of Therapists for Massage Treatments booked by Users and collection of payment on behalf of Retailers for Products purchased by Users ;
(f) analyse the use of the Services and the visits to the Site/App in order to improve our content and Services including research into our Users’ demographics and tracking of sales data;
(g) where you have not objected, send you information to Users and Therapists which we think you may find useful or which you have requested from us, including marketing communications such as emails about any improvements to the Products or Services, special offers or promotions, events, competitions, new Products or Services;
(h) where you have not objected, send you, information about any improvements to existing products or services, special offers or promotions, events or competitions, new products or services of carefully selected Business Partners. Urban Massage does not share any personal data of its Users or Therapists with any Business Partners but you may see our Business Partners name, logos and other brand references appearing in the emails which we send to you.

We may review, scan, or analyse your communications on the Urban Platform between the User and the Service provider for fraud prevention, risk assessment, regulatory compliance, investigation, product development, research, analytics, and customer support purposes. In some cases, we may also scan, review, or analyse messages to debug, improve, and expand product offerings. We use automated methods where reasonably possible. However, occasionally we may need to manually review some communications, such as for fraud investigations and customer support, or to assess and improve the functionality of these automated tools. We will not review, scan, or analyse your messaging communications to send third party marketing messages to you, and we will not sell reviews or analyses of these communications.These activities are carried out based on Urban’s legitimate interest in ensuring compliance with applicable laws and our Terms, preventing fraud, promoting safety, and improving and ensuring the adequate performance of our services.

3. Purposes and Lawful Bases for which Urban Massage uses your data

We have set out in the tables below a description of the ways we use your personal information, the category of information it comes under and the legal basis or bases which we rely on to process it, including where we are relying on our legitimate interests and identifying what those interests are. There may be more than one lawful basis on which we process your information depending on the specific purposes for which we are using the information. Where we rely on legitimate interests we are always careful to balance your privacy rights with those interests.

Please note that these are examples of the kinds of personal information we collect and of the uses we may make of it. We may from time to time collect other types of personal information including and not limited to information you voluntarily give us.

Please contact us if you need more information at info@urban.co.

User Information

Purpose	Type of data	Lawful basis for processing
To register a new User	Identity, contact, technical	Necessary for the performance of our contract with you; in our legitimate interests in operating our Services to analyse how our Services are being used and develop these further.
To identify you as a User when you sign in to your account	Identity, Technical data	Necessary for the performance of our contract with you; in our legitimate interests in operating our Services to analyse how our Services are being used and develop these further.
To process and deliver a massage request from a User	Identity, contact, profile data, assessment data, location data, technical data, transaction data, operational data	Necessary for the performance of our contract with you; in our legitimate interests in operating our Services to analyse how our Services are being used and develop these further.
Managing collection of payment for Massage Treatments booked by Users on behalf of Therapists or Products purchased by Users on behalf of Retailers	Identity, contact, financial data, transaction data, operational data	Necessary for performance of the contract with Users, Therapists and Retailers
Assisting Users with queries and problems in live chats on site	Technical data, operational data, identity, contact	Necessary for the performance of the contract with our Users;, in our legitimate interests to resolve problems to ensure our Services run as smoothly as possible to increase User satisfaction
To administer and protect the website and app and Services (including troubleshooting, data analysis, testing and system review)	Identity, contact, technical data	In our legitimate interests to run our website, app and services, manage administration and IT services and safeguard network security
To manage our relationship with Users by sending emails to confirm bookings for Massage Treatments or cancellations of bookings or Products purchased	Identity, contact, technical data, transaction data	Necessary for the performance of a contract with the User; in our legitimate interests in maintaining and improving the running of the Services
Asking Users to complete ratings reviews and feedback surveys on Therapists and treatments received	Identity, contact, usage, , profile data	In our legitimate interests to understand how Users use, enjoy and rate the Services to ensure Massage Treatment standards are maintained
Inviting Users to take part in any promotions, events or competitions	Identity, contact, usage data, marketing and communications data	With consent where required by law in or where Users have not objected; in the legitimate interests of the business to encourage Users to use the Services
To make recommendations and suggestions to Users	Identity, contact data, usage data, profile data, marketing and communications data, aggregated data	In the legitimate interests of the business to develop and grow
To advertise and market our site and app and services to Users	Usage data, marketing and communications data, aggregated data	With consent where required by law in or where Users have not objected the case of direct marketing email communications ;in the case of analysis and evaluation of our Services and campaigns in the legitimate interests of the business to develop and grow
To send Users information about products or services, special offers or promotions, events or competitions of carefully selected Business Partners.	Identity, contact, usage, profile, marketing and communications, aggregated data	With consent as required by law, in the legitimate interests of the business to encourage Users to use our Business Partners' Products and Services
To notify Users about any changes to our website and/or app and /or Products and/or Services	Identity data, contact data	Necessary for the performance of a contract with the User and in the legitimate interests of the business in the smooth running of the Services
To notify Users of any changes to the Privacy Policy or changes to our Terms and Conditions	Identity data, contact data	Compliance with a legal obligation
To maintain a blacklist/fraud identity system	Identity data, contact data, financial data,	In the legitimate interests of the business to protect the business from fraud
To record Treatment Reports by Therapists which could from time to time include health data	Treatment report assessment data (which may includehealth data), information regarding aftercare tips, treatment specifics and wellness information	Consent is required from Users to collect Treatment Reports
To record Service Notes which are used to provide information to Therapists to deliver treatments	Information provided by users which may include access information	In our legitimate interests to provide Services that are as efficient and smooth running as possible . This information is provided voluntarily.
To gather location data on Users in order to inform the Therapists of the location in which to perform the treatment	Identity data, contact data, Location data	Necessary to fulfil the contract for services for the User, in our legitimate interests to provide Services that are as efficient and smooth running as possible . If this is collected automatically through your device, you will be asked if you permit us access to your location. We need your location in order to inform the Therapists where the treatment needs to be performed.
To provide mediation between User and Therapist in the event of a User complaint of unsatisfactory treatment	Identity, contact, assessment, financial data	Necessary to fulfil the contract for services for the User, in our legitimate interests to provide Services

Therapist Information

Purpose	Type of data	Lawful basis for processing
To register a new Therapist	Identity, contact, technical	Necessary for the performance of our contract with Therapists,in our legitimate interests in operating our Services
To identify a Therapist when they sign in to their account	Identity, Technical data	Necessary for the performance of our contract with the Therapist
To assign and transmit a transmit a Massage Treatment booking to the appropriate Therapist (according to location and/or profile, rating or User choice)	Identity, contact, profile data, assessment data, location data, technical data, transaction data, operational data	Necessary for the performance of the User contract, fulfilling our contract with the Therapist by sending appropriate bookings
Managing collection of payment by Users for Massage Treatments on behalf of Therapists and management of transfer of payments to Therapists	Identity, contact, financial data, transaction data, operational data	Necessary for performance of our contract with both Therapist and User, (obligation to process payment by User and obligation to collect payment on behalf of the Therapist for Massage Treatments booked by User.
Assisting Therapists with queries and problems in live chats on site	Identity, contact, Technical data, operational data	Necessary for the performance of the contract with Therapists, in our legitimate interests to resolve problems to ensure the Services run as smoothly as possible to increase User satisfaction
To administer and protect the site and app and Services (including troubleshooting, data analysis, testing and system review)	Identity, contact, technical data	In our legitimate interests to run our website, app and Services, manage administration and IT services and ensure network safety and security
To manage our relationship with Therapists by sending confirmatory emails of bookings or cancellations with Users	Identity, contact, technical data, transaction data	Necessary for the performance of a contract with the User, necessary for the fulfilment of a contract with the Therapist, in our legitimate interests in maintaining and improving the running of the Services
To maintain profiles on Therapists including photograph(s), biography, treatments offered, languages spoken.	Identity, contact, assessment, profile data	Necessary for the performance of a contract with the Therapist and User, in our legitimate interests in maintaining and improving the running of the Services
To review Therapists use of the App and User experience with the Therapist. For example, we may analyse average ratings obtained from our evaluations, using algorithms applied to ratings and reviews. We take all of the ratings you have received from your past appointments with customers, apply a weighted rating upon them, and use this to display both in your profile and as part of the sorting algorithm when returning a list of therapists available to customers when they are searching/booking.	Number of appointments, User rating review	In our legitimate interests in maintaining and improving the quality and the running of the Services
Providing Therapists with feedback from Users including results of ratings reviews and feedback surveys	Providing Therapists with feedback from Users including results of ratings reviews and feedback surveys Identity, contact, assessment, profile data	Necessary for the performance of a contract with the Therapist, in our legitimate interests in maintaining and improving the running of the Services
Inviting Therapists to take part in any promotions, events or competitions	Identity, contact, usage data, marketing and communications data	With consent as required by law, In the legitimate interests of the business to encourage Therapists to use the Services
To advertise and market our website, app and Services	Identity, contact, Usage, marketing and communications, aggregated data	With consent as required by law, in the legitimate interests of the business to develop and grow
To send Therapists' information about products or services, special offers or promotions, events or competitions of carefully selected Business Partners.	Identity, contact, usage, profile, marketing and communications, aggregated data	With consent as required by law, in the legitimate interests of the business to encourage Therapists to use our Business Partners' Products and Services
To notify Therapists about any changes to our website, and/or app and /or Services	Identity, contact data	Necessary for the performance of a contract with the Therapist and in the legitimate interests of the business to ensure the smooth running of the Services
To notify Therapists of any changes to our Privacy Policy or changes to our contract terms and conditions	Identity, contact data	Compliance with a legal obligation
To maintain a blacklist/fraud identity system	Identity, contact, financial data,	In the legitimate interests of the business to protect the business from fraud
To gather location data on Therapists to share with Users to inform them as to when the Therapist may arrive to deliver the Treatments	Identity data, contact data, Location data	Necessary to fulfil the contract for Services for the User, in our legitimate interests to provide Services that are as efficient and smooth running as possible
To record Treat Reports if a User enables this feature, some Therapist personal data will be captured against this Treatment report.	Identity data	Necessary to fulfil the contract for Services for the User, in our legitimate interests to provide Services that are as efficient and smooth running as possible If this is collected automatically through your device, you will be asked if you permit us access to your location.
To provide mediation between User and Therapist in the event of a User complaint of unsatisfactory treatment	Identity, contact, assessment, financial data	Necessary to fulfil the contract for services for the User, in our legitimate interests to provide Services
To monitor correct use by Therapists of our proprietary technology and Users' personal data	Identity, contact, technical, usage data	In our legitimate interests to monitor correct use of our proprietary technology and Users' personal data and for record-keeping purposes

4. How we may share your Information

In order to provide the Services, we may share the information Users provide with Therapists to assist them in the providing the Massage Treatments booked by Users.
In order to provide the Services, we may share the information Therapists provide to Users to assist them in selecting a Therapist to book a Massage Treatment with.
We may share the information you provide or that we otherwise collect through your use of the Services (including, where applicable, personal information) to carefully selected third-parties including affiliates, consultants and contractors who support our business and operations including, inter alia, processing transactions, fulfilling requests for information or assistance, receiving and sending communications,[,analysing data, providing other support services such as advertising, PR, events related services and other web related services such as web hosting and web-monitoring services including analytics providers and search information providers. These third parties will keep the information confidential and to use it only to the extent necessary to provide the applicable service(s) or as otherwise permitted or required by law. Some examples of key service providers we work with include Google (cloud storage, analytics, and advertising services), Amazon Web Services (storage), Salesforce (customer relationship management and analysis), Iterable (marketing services) and Facebook (marketing services).
In some cases, we work in partnership with other carefully selected companies, Business Partners, and from time to time, with your consent, we may send you information about these third-party Business Partners' selected products or services in our communications with you. We do not share your personal data with these third parties directly.
We may disclose aggregate statistics about visitors to the Website in order to describe our services to prospective partners, advertisers, sponsors and other reputable third parties and for other lawful purposes.
In the event that we undergo re-organisation, or are sold to a third party, you agree that any personal information we hold about you may be transferred to that re-organised entity or third party.
We may disclose your personal information if legally entitled or required to do so (for example if required by law or by a court order or if we believe that such action is necessary to prevent fraud or cybercrime or to protect the Site or Service, or the rights, property or personal safety of any person).
If you choose to connect the Services to Apple Health, information regarding your used of the Services for example which treatment you had and frequency may be recorded. You control if you want to share this data with Apple Health and Apple Health will handle the information in accordance with their own privacy policy. Please review this and your Apple Health settings for more information.

5. Information you may collect as a User or Therapist

If you are a Therapist, you are responsible for ensuring that you comply with applicable data protection law in respect of any personal information that you collect about Users in the course of your provision of the Services. Urban Massage does not accept any responsibility for this processing of personal data.

If you are a User, you are responsible for any misuse of personal information that you may collect in the course of your receipt of the Services. Urban Massage does not accept any responsibility for this processing of personal data.

6. Cookies and similar technology

The Site also uses cookies or similar technology to collect information about your access to the Site. Cookies are small text files that include a unique reference code that a website transfers to your device to store and sometimes track information about you. A number of cookies we use last only for the duration of your web session and expire when you close your browser. Other cookies are used to remember you when you return to the Site and will last for longer. For more information on the cookies we use, how we use them and how to disable them please see our Cookie Policy.

7. Public forums

The Site may, from time to time, make chat rooms, message boards, news groups and/or other public forums available to Users and Therapists. Any information that is disclosed in these areas becomes public information and you should exercise caution when using these and never disclose your personal information.

8. Child safety

Protecting the safety of children when they use the internet is very important to us. Our Site and Services are not intended for nor directed towards children and we do not knowingly collect personal information from children. If you believe that your child may have provided us with personal information without your consent, you may alert us at info@urban.co.

9. External links

The Site may, from time to time, contain links to external websites. Clicking on those links or enabling those connections may allow third parties to collect or share information about you. We have no control over these third parties and we are not responsible for the content of such websites or for the privacy policies or practices of such third parties. You should review the privacy policy of any third party website carefully that you visit.

10. Payment processing

All payments transactions made through the Services are conducted through our payment providers, Braintree (owned by PayPal), Checkout.com and Shopify. You will be providing credit or debit card information directly to these providers who process payment details, encrypting your credit/debit card information and authorising payment. If you use Braintree or Checkout.com to process your payment, you will stay on our Site / App but will provide your information directly to the payment providers, we only see a tokenised version of the information. If you make a payment using Shopify, you will be directed to Shopify's own website. The processing of your payment information is done so in accordance with these third parties' own privacy policies and terms :

https://www.braintreepayments.com/en-gb/legal/braintree-privacy-policy

https://www.checkout.com/legal/privacy-policy

https://www.shopify.com/legal/privacy

11. Security

We place great importance on the security of all personal information associated with both Users and Therapists. We have implemented appropriate technical and organisational measures to ensure the security of your information and to protect any personal information that is transmitted, stored or otherwise processed against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. In addition, we limit access to this information to only those employees, agents, contractors and other third parties who have a business need to know. They will only process it on our instructions and they are subject to a duty of confidentiality.
The safety and security of your personal information also depends on you. Where you have a secure log in and or password for access to certain parts of our Site you are responsible for keeping your log in and/or password confidential. We ask you not to share your log in details or password with anyone. We also urge you to be careful about giving out information in public areas of the Site like message boards. The information you share in public areas may be viewed by any user of the Site or the Services. It is also advisable to close your browser when you have finished your user session to help ensure others do not access your personal information.
Unfortunately, no electronic data transmission over the internet or storage of information can be guaranteed to be completely secure or error free and we therefore cannot warrant or guarantee the security of information you submit via the Site or Service transmitted to our Site or Service and any such submission is at your own risk.

12. Data storage and international transfers

Information that you submit via the Services is sent to and stored on secure servers located inside and outside the European Economic Area (“EEA”), for example in the United States. Where we transfer your information outside the EEA in this way, we will take steps to require that that your privacy rights continue to be protected. By way of example, and as mentioned above, we work with key service providers such as Google, Facebook, Amazon Web Services and Salesforce and we have signed data processing addendums which reflect data transfer mechanisms to provide adequate protection to the personal data transferred outside the EEA.If you would like further information on this, please do contact us.

13. Opting out

Where we have your consent, or where you have not objected to receiving (as applicable) we will use your personal information to send you marketing and promotional communications by email about our products/services or to send you feedback surveys and ratings review requests on treatments provided, you. As mentioned above, where we partner and work with carefully selected Business Partners, our email communications may also contain information from our Business Partners.

You can object to further marketing communications at any time by clicking on the unsubscribe link included in each such communication or notify us by email at info@urban.co.

14. How long we keep your information

We need to retain your information (including your personal information, where applicable) for as long as you remain an active user of the Services in order for us to meet our contractual obligations to you, and for such longer periods as are legally required or permitted.

We may need to retain certain personal information even once a User account has been closed for differing periods, depending on the category of personal information concerned, for example, to enforce our terms, for fraud prevention, to identify, issue or resolve any legal claims, for proper record-keeping purposes and/or as required for our business operations or by applicable law.

We may also retain certain personal information following any objection indicated by you to receiving Urban Massage marketing communications for the purpose of ensuring that your wishes continue to be respected and we do not to contact you further.

We may also retain aggregated information beyond this time for research purposes and to help us to develop and improve Services. You cannot be identified from aggregate information retained or used for these purposes.

15. Your rights

You have the right under certain circumstances:

To be provided with a copy of your personal information held by us;
To request the rectification or erasure of your personal information held by us;
To request that we cease processing your personal data in certain circumstances
To object to our processing of personal data for the purposes of sending you direct marketing emails;
To request that we restrict the processing of your personal information while we verify or investigate your concerns;
To request that your information be transferred to a third party;
To withdraw consent where your personal information has been processed on this basis. You have the right to withdraw that consent without detriment by emailing us at info@urban.co or by clicking on the unsubscribe link found at the bottom of our emails;

If your request or concern is not satisfactorily resolved you may approach the local data protection authority (see http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.html). In the UK this is the Information Commissioner (https://ico.org.uk/).

16. Changes to this Privacy Policy

We may change this Privacy Policy from time to time. If a revision is material we shall notify you before they take effect either through the Site or by sending you a notification (as required). Any such material changes will only apply to personal information collected after the revised Privacy Policy takes effect.

17. Contact us

Please submit any questions or concerns regarding our Privacy Policy or any questions about the security of our Site or Services to:

by email
info@urban.co; or
by post
Giles Williams
Re: Privacy Policy
Annex
Friar's Bridge Court
41-43 Blackfriars Road
London SE1 8NZ.

This Privacy Policy was last updated on 4 July 2018

Urban