Join SpaWise
Legal

Privacy Policy

Last updated 26 April 2026

Who we are

SpaWise is operated by Ergo Group Ltd.

This Privacy Policy explains how we collect, use, store and share personal data when you use:

  • the SpaWise website at spawise.co.uk;
  • the SpaWise mobile app;
  • SpaWise membership and complimentary access features;
  • SpaWise shopping, order and support services; and
  • related communications from us.

Data controller: Ergo Group Ltd

Registered address: Edwards Veeder, Alex House, 260-268 Chapel Street, Salford, Manchester, M3 5JZ

Privacy contact: support@spawise.co.uk

ICO registration number: ZA170125

If you have any questions about this Privacy Policy or how we use your personal data, please contact us using the details above.

Our approach to privacy

We aim to keep privacy simple and practical.

In plain English, this means we try to:

  • collect only the personal data we reasonably need;
  • use it only for the purposes explained in this policy;
  • keep it accurate and up to date where possible;
  • protect it using appropriate technical and organisational measures; and
  • keep it only for as long as we need it for those purposes, or to meet legal, tax, accounting, fraud-prevention or dispute-handling requirements.

What this policy covers

This policy applies to personal data we collect through:

  • our website;
  • the SpaWise mobile app;
  • account signup and login;
  • water-care features, including test history, planning and diagnostics;
  • membership, complimentary access and access codes;
  • referrals, wallet credit and related account features;
  • shopping, checkout and order history;
  • support and customer service; and
  • website cookies and similar technologies.

It should be read alongside our Terms and Conditions, Membership Terms, Cookie Policy, and any just-in-time privacy notices we show in the app or on the website.

The personal data we collect

Depending on how you use SpaWise, we may collect the following types of personal data.

A. Identity and contact data

  • name;
  • email address;
  • telephone number;
  • billing or delivery address;
  • account login details.

B. Account and profile data

  • account ID;
  • password and authentication metadata;
  • marketing preferences;
  • legal acceptance records;
  • membership, complimentary access or access-code status;
  • general preferences and settings.

C. Hot tub, water-care and usage data

  • tub brand, model, volume and setup details;
  • sanitiser type and related water-care preferences;
  • water-test readings and manual entries;
  • planner and history records;
  • diagnostic and recommendation history;
  • related actions taken in the app.

D. Camera, image and strip-analysis data

If you use camera or image-based features, we may process:

  • images captured from your device camera;
  • strip or colour-chart related image data;
  • image-derived reading estimates or related diagnostics.

Please see section 8 below for more detail on how image data is handled.

E. Membership, referral, wallet and access-code data

  • membership status;
  • subscription or entitlement status;
  • complimentary access periods;
  • access-code redemption data;
  • wallet credit records;
  • referral credit records;
  • referral and rewards history.

F. Shop, order and transaction data

  • basket and checkout data;
  • product selections;
  • order history;
  • delivery details;
  • transaction status and order reference data.

We do not store your full payment card details ourselves.

G. Support and communications data

  • support requests;
  • enquiries and messages you send us;
  • communication history;
  • notes relating to how we handled an issue.

H. Technical, device and diagnostic data

  • device type;
  • operating system;
  • app version;
  • browser type;
  • IP address;
  • error and diagnostic logs;
  • service performance and reliability information;
  • security and fraud-prevention data.

I. Website usage and cookie data

  • page visits;
  • navigation behaviour;
  • cookie or similar-technology preferences;
  • analytics data where enabled.

How we collect personal data

We collect personal data:

  • directly from you when you create an account, fill in forms, configure your tub, enter water-test readings, place an order, redeem an access code, contact support, or opt in to marketing;
  • automatically when you use our website or app, including through logs, cookies, device information and app diagnostics;
  • from app-store or platform providers where they confirm subscription or purchase status;
  • from payment, checkout, delivery or service providers where relevant to your order or account activity.

How we use your personal data

We use personal data to:

  • create and manage your account;
  • provide SpaWise app features and water-care recommendations;
  • store your tub setup, test history, planner and related records;
  • operate membership, complimentary access and access-code features;
  • manage referral and wallet credit records;
  • process shopping, checkout, orders and related fulfilment;
  • provide support and respond to enquiries;
  • improve product quality, reliability and safety;
  • monitor performance, investigate errors and protect our systems;
  • send service messages and, where allowed, marketing communications;
  • comply with legal, tax, accounting and regulatory obligations.

Our lawful bases for using personal data

Under UK GDPR, we must have a lawful basis for using your personal data.

Lawful basis summary

Account creation and app operation

Examples: creating your account, signing you in, storing your settings

Lawful basis: Contract

Water-care recommendations and history

Examples: storing tub setup, test history, planner records, diagnosis history, recommendations

Lawful basis: Contract; Legitimate interests

Membership and subscription administration

Examples: checking entitlement status, restoring purchases, managing subscription state

Lawful basis: Contract; Legal obligation where relevant; Legitimate interests

Wallet, referral and access-code administration

Examples: referral credits, wallet records, complimentary access, code redemption

Lawful basis: Contract; Legitimate interests

Shop, checkout and order fulfilment

Examples: basket, checkout, order history, delivery handling

Lawful basis: Contract; Legal obligation

Support enquiries

Examples: handling questions, support tickets and follow-up communications

Lawful basis: Contract where support relates to a service request; Legitimate interests

Diagnostics, security and fraud prevention

Examples: logs, monitoring, abuse prevention, troubleshooting

Lawful basis: Legitimate interests; Legal obligation where applicable

Marketing communications

Examples: emails or promotions where you choose to receive them

Lawful basis: Consent, and where allowed by law, legitimate interests or soft opt-in

Cookies and website analytics

Examples: non-essential cookies, traffic analysis, website improvement

Lawful basis: Consent for non-essential cookies; Legitimate interests for strictly necessary technologies

Legal, accounting and regulatory compliance

Examples: records retention, tax, bookkeeping, dispute handling

Lawful basis: Legal obligation; Legitimate interests

Contract

We rely on contract where we need your data to provide the services you ask us for, such as:

  • creating and maintaining your account;
  • providing the app and website services;
  • showing your history and recommendations;
  • managing shopping, orders and membership-related features.

Legitimate interests

We rely on legitimate interests where this is reasonably necessary for running, improving and protecting SpaWise, including:

  • improving product quality and user experience;
  • monitoring reliability and performance;
  • investigating bugs or misuse;
  • keeping services secure;
  • administering support;
  • preventing fraud and abuse;
  • internal reporting and service operations.

Where we rely on legitimate interests, we consider the impact on your rights and freedoms and seek to use your data in a fair, proportionate and privacy-conscious way. Where appropriate, we carry out and document legitimate interest assessments.

Consent

We rely on consent where required, including for:

  • non-essential cookies and similar technologies; and
  • marketing communications where consent is needed.

You can withdraw consent at any time. This does not affect processing already carried out before withdrawal.

Legal obligation

We rely on legal obligation where we need to keep or use data to meet legal, regulatory, tax, accounting or consumer-law requirements.

Camera and image processing

SpaWise may allow users to use the device camera to scan test strips or colour charts for water-level estimates and related guidance.

How this currently works

At present, image-based strip or colour analysis is intended to be processed on the device in order to support water-testing features. The resulting readings, diagnostics and related guidance may then be sent to and stored by our backend so we can provide recommendations, history and related app functionality.

Current position on image storage

At present, SpaWise does not currently routinely retain the underlying strip-analysis images themselves as part of normal operation. Instead, the image is used to help generate the result, and the resulting water-test data, diagnosis and guidance may be stored.

If this changes in future and SpaWise begins storing the actual strip-analysis images themselves, we will update this Privacy Policy to explain:

  • what images are stored;
  • why they are stored;
  • where they are stored; and
  • how long they are kept.

If images are retained in future

If we ever retain user-generated strip-analysis images in future, we would only do so where reasonably necessary for:

  • the feature you are using;
  • history or continuity within the app;
  • support and troubleshooting;
  • safety, fraud prevention or abuse prevention.

Marketing

If you opt in to receive marketing from us, we may send you:

  • product updates;
  • membership or club information;
  • offers or promotions;
  • relevant service-related news.

You can opt out at any time by:

  • using the unsubscribe link in an email;
  • adjusting your settings where available; or
  • contacting us at support@spawise.co.uk.

We do not send marketing just because you downloaded the app.

Cookies and similar technologies

Our website may use cookies and similar technologies to:

  • make the site work properly;
  • remember your preferences;
  • help us understand how the site is used;
  • improve performance and user experience; and
  • support analytics and marketing where you have consented.

For more detail, please see our Cookie Policy.

We will ask for consent where UK cookie rules require it, especially for non-essential analytics, advertising or similar technologies.

Third parties and service providers

We use third-party providers to help us run SpaWise. Depending on the feature, these may include:

Platform and subscription providers

Apple / App Store: for in-app subscriptions and app-store purchase flows.

RevenueCat: for subscription and entitlement administration, including subscription-status handling and purchase validation support.

Hosting and infrastructure

Render: used for hosting and infrastructure services for SpaWise backend and admin environments, where applicable.

Payments and checkout

Stripe: used for checkout and payment processing for website purchases where Stripe-powered checkout flows are used.

Storage

Amazon S3: used for cloud object storage and related operational file or asset storage where applicable.

Communications

Email and communications providers: used for support, service-related messages and transactional emails.

Other provider categories

We may also use carefully chosen providers for:

  • diagnostics and reliability monitoring;
  • delivery, logistics or fulfilment support;
  • professional services such as legal, insurance, accounting or audit support.

We only share data with third parties where there is a valid reason to do so and appropriate contractual or legal safeguards are in place.

We do not sell your personal data.

Apple, app-store and platform purchases

Where you purchase a subscription or digital entitlement through Apple or another app-store platform:

  • the purchase is handled by that platform;
  • the platform may act as an independent controller for its own processing;
  • SpaWise receives subscription or purchase-status information needed to manage access, entitlement and support;
  • SpaWise does not receive or store your full payment card details from Apple's purchase systems.

SpaWise uses RevenueCat to help administer subscription and entitlement status. RevenueCat helps us understand whether a subscription or entitlement is active, expired, restored or otherwise valid for access purposes.

If you buy physical goods or services through SpaWise website checkout flows, payment processing is handled by Stripe under its own privacy terms and legal obligations.

Sharing personal data

We may share personal data with:

  • hosting and cloud infrastructure providers;
  • payment and checkout providers;
  • app-store and subscription-service providers;
  • storage providers;
  • email and communication providers;
  • fulfilment and delivery partners;
  • diagnostics, maintenance and service providers;
  • regulators, courts, law enforcement or other authorities where required;
  • professional advisers such as lawyers, accountants, auditors and insurers;
  • a buyer, investor or successor organisation if our business is reorganised, sold or transferred, subject to appropriate protections.

We only share the personal data that is reasonably necessary for the relevant purpose.

International transfers

Some of our service providers may process personal data outside the UK.

When that happens, we take steps to make sure your personal data still receives appropriate protection. Depending on the circumstances, this may include relying on:

  • a country that benefits from UK adequacy regulations;
  • the UK International Data Transfer Agreement (IDTA);
  • the UK Addendum to the EU Standard Contractual Clauses; or
  • another legally approved safeguard.

If you would like more information about international-transfer safeguards relevant to SpaWise, please contact us.

Data retention

We keep personal data only for as long as we reasonably need it for the purposes described in this policy, including legal, tax, accounting, fraud-prevention, security and dispute-handling purposes.

Our current retention approach is broadly as follows:

  • Account and profile data: while your account is active and for a reasonable period afterwards unless deleted sooner.
  • Tub setup, water-care history and planner records: while your account is active and for a reasonable period afterwards unless deletion is requested and we no longer need the data.
  • Membership, referral, wallet and access-code records: while needed to administer access, credits, disputes, audit trails and misuse prevention.
  • Support requests and support communications: usually for support, service-improvement and issue-resolution purposes for up to 24 months, unless a longer period is required for an open issue, dispute or legal need.
  • Order, tax and accounting records: for as long as required by law, usually up to 6 years after the relevant transaction or accounting period.
  • Marketing records: until you opt out, withdraw consent, or we no longer need the records for compliance purposes.
  • Technical and security logs: for shorter operational periods unless they are required for investigation, safety, fraud prevention or legal protection.
  • Image-derived data, readings and related diagnostics: only for as long as reasonably necessary for the relevant feature, history, diagnostics, support or safety purpose.

At present, because SpaWise is not currently intended to routinely retain the underlying strip-analysis images themselves as part of normal operation, this policy does not set a fixed image-retention period for stored user images. If that changes in future, we will define and publish a specific retention approach.

Where we cannot apply a fixed period, we decide retention based on:

  • what the data is;
  • why it was collected;
  • whether we still need it;
  • whether the law requires us to keep it; and
  • whether it may be needed to establish, exercise or defend legal claims.

Account deletion

You may be able to request deletion of your account through the app or by contacting us.

When you delete your account, we will delete or anonymise personal data that we no longer need. However, we may keep limited information where necessary for:

  • legal compliance;
  • tax and accounting;
  • fraud prevention;
  • security and abuse prevention;
  • dispute resolution;
  • enforcing our legal rights.

This means some order, transaction, security or audit records may need to be retained even after account deletion.

Security

We use appropriate technical and organisational measures designed to protect personal data, including access controls, environment management, secure service configuration, and operational monitoring.

However, no system can be completely secure, and we cannot guarantee absolute security.

Personal data breaches

We maintain procedures for identifying, investigating and responding to suspected personal data breaches.

Where required by law, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of a notifiable breach.

Where a breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay.

Children

SpaWise is intended for users aged 18 and over.

We do not knowingly collect personal data from children.

If you are a parent or guardian and believe a child has provided personal data to us, please contact us at support@spawise.co.uk and we will investigate and, where appropriate, delete that data.

Your rights

Under UK data protection law, you may have the right to:

  • access your personal data;
  • ask us to correct inaccurate data;
  • ask us to delete data in some circumstances;
  • ask us to restrict processing in some circumstances;
  • object to certain uses of your data;
  • request portability of data you provided to us in certain cases;
  • withdraw consent where we rely on consent.

To exercise your rights, contact us at support@spawise.co.uk.

You also have the right to complain to the ICO if you are unhappy with how we handle your personal data. More information is available at ico.org.uk.

Data protection contact

If you have a privacy or data protection question, or if you want to exercise your rights, please contact:

Ergo Group Ltd

Registered address: Edwards Veeder, Alex House, 260-268 Chapel Street, Salford, Manchester, M3 5JZ

Email: support@spawise.co.uk

ICO registration number: ZA170125

Third-party links and services

Our website or app may link to third-party services, websites, platforms or payment environments. Those third parties have their own privacy notices and practices, and we are not responsible for them.

We encourage you to read their privacy information before providing personal data to them.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in SpaWise, the law, or our data practices.

When we do, we will update the "Last updated" date above. Where appropriate, we may also give additional notice through the website or app.