Calabash Spa & Salon — a member of the Speke Group

References to "we", "us" or "our" in this Privacy Policy mean Calabash Spa & Salon, operating as part of the Speke Group, with branches at Speke Apartments Wampewo and Speke Resort Munyonyo. This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how we protect it, and your rights in relation to it.

This Policy applies to both Calabash Spa & Salon branches and covers our website, our booking channels (including WhatsApp), and our in-person spa and salon services. By using our website or booking or receiving our services, you confirm that you have read and understood this Policy. If you do not agree with it, please do not use our website or services.

1. Who we are

The data controller for the purposes of the Uganda Data Protection and Privacy Act, 2019 ("the Act") is Calabash Spa & Salon, part of the Speke Group, operating from:

  • Speke Apartments Wampewo — Plot 19–21, Wampewo Avenue, Kololo, Kampala, Uganda
  • Speke Resort Munyonyo — Speke Resort and Conference Centre, Wavamunno Road, P.O. Box 446, Kampala, Uganda

Both branches share this Privacy Policy and are jointly responsible for the personal information described here, as members of the Speke Group.

2. Information we collect

2.1 Information you give us

When you make a booking, visit our spa or salon, or contact us, you may give us information such as your name, email address, phone number, date of birth, payment card details, treatment and product preferences, allergies or skin/health-related information relevant to your treatment, and any feedback you share with us.

2.2 Information we collect automatically

When you visit our website, we and our service providers may automatically collect technical information, including your IP address, browser type and version, device identifier, general location and time zone, pages visited, links clicked, and time spent on our site.

2.3 Information from other sources

We may receive information about you from other Speke Group entities, from trusted service providers (for example, our payment processor Pesapal), or from publicly available sources, where relevant to providing our services to you.

3. Cookies

Our website uses cookies to help it function properly, remember your preferences, and understand how visitors use the site. Cookies are small files stored on your device when you visit our website.

3.1 Cookies we use

  • Essential/system cookies - required for the website and booking forms to function, and to remember your basic preferences.
  • Analytics cookies - help us understand how visitors use the site so we can improve it.
  • Third-party payment cookies - our payment processor, Pesapal, may set its own cookies when you make a payment through our site. These are governed by Pesapal's own privacy policy, not ours.

You can control or delete cookies through your browser settings at any time. Blocking cookies may affect how parts of our website function.

4. How we use your information

We use your personal information to:

  • Process your bookings and provide the spa and salon services you request;
  • Process payments and protect against fraudulent transactions;
  • Communicate with you about your booking, including via WhatsApp where you have chosen that channel;
  • Send you offers, promotions or news about Calabash Spa & Salon, where you have consented to receive these;
  • Understand your preferences so we can personalise your experience;
  • Comply with our legal obligations, including health, safety and tax record-keeping requirements;
  • Keep our website and payment systems secure and prevent fraud or misuse.

Where we rely on your consent (for example, for marketing communications), you may withdraw that consent at any time by contacting us using the details in Section 10.

5. Who we share your information with

5.1 Within the Speke Group

We may share your information with other Speke Group entities where necessary to provide services you have requested, process payments, or maintain a consistent record of your preferences across our branches.

5.2 Service providers

We work with trusted third parties who perform services on our behalf, such as our payment processor (Pesapal), IT and website hosting providers, and professional advisers. These providers are only permitted to use your information to deliver the services we engage them for.

5.3 Legal and regulatory disclosures

We may disclose personal information where required by law, or to protect the rights, property or safety of Calabash Spa & Salon, the Speke Group, our customers, or the public.

5.4 Business transfers

If Calabash Spa & Salon or the Speke Group undergoes a restructuring, merger or sale, your information may be transferred as part of that transaction, subject to the receiving party agreeing to protect it consistently with this Policy.

We do not sell your personal information to third parties.

6. Where we store your information

Information collected through our website is stored on secure servers, and payment transactions are encrypted using Transport Layer Security (TLS). We maintain technical and organisational measures — including access controls, monitoring and encryption - to protect your information. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

If your information is transferred outside Uganda or the East African Community (for example, to a Speke Group entity or service provider based elsewhere), we take steps to ensure it continues to receive an appropriate level of protection, as required by the Act.

7. How long we keep your information

We keep your personal information only for as long as necessary to provide our services, meet the purpose for which it was collected, and comply with our legal, accounting and tax obligations (for example, financial records are generally kept for the period required by Ugandan law). When we no longer need your information, we securely delete or anonymise it.

8. Your rights

Under the Uganda Data Protection and Privacy Act, 2019, you have the right to:

  • Access the personal information we hold about you;
  • Request correction of inaccurate or incomplete information;
  • Request deletion of your information, subject to our legal retention obligations;
  • Object to our processing of your information, including for direct marketing;
  • Withdraw consent at any time, where processing is based on consent;
  • Request that we transfer your information to another organisation, where technically feasible.

We will respond to requests within 30 days. We may need to verify your identity before actioning a request, and in some cases an administrative fee may apply, which we will inform you of in advance.

9. Complaints

If you believe we have not handled your personal information in accordance with this Policy or the Act, you have the right to lodge a complaint with Uganda's Personal Data Protection Office (PDPO), the regulator responsible for data protection in Uganda.

10. Contacting us

To exercise any of your rights, ask a question about this Policy, or request a copy of the information we hold about you, please contact us:

  • Email: calabash@spekeapartments.com
  • Speke Apartments Wampewo - Plot 19–21, Wampewo Avenue, Kololo, Kampala   |   Spa: +256 702 711 087   |   Salon: +256 702 711 286
  • Speke Resort Munyonyo — Wavamunno Road, P.O. Box 446, Kampala |   Spa & Salon: +256 707 780 395

Please include a return address or contact details with your request so we can respond to you.

11. Children

Our services are intended for adults. Where a minor's information is provided (for example, for a children's spa or nail bar treatment), we require the consent of a parent or guardian, who remains responsible for the minor's information.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified on our website with an updated effective date above. Your continued use of our website or services after changes take effect constitutes acceptance of the updated Policy.