Skip to content
DIMAK Thai Massage
Book now
Buy a gift voucher online — PDF straight to your email For loyal clients every 10th massage is on us

Privacy policy

1. Data controller

The controller of your personal data is Tanapan Promkaew, operating under business certificate No. OU432901-1 (massage studio "DIMAK Thai Massage"), Vilniaus g. 43, LT-19118 Širvintos, Lithuania. Data protection contact: dimakthai@gmail.com, tel. +370 689 88395.

2. What data we process

When you book: first name, last name, phone number, email address, date of birth (required – to make sure the service suits your age) and your note. The system keeps your visit history (date, service, duration, amount paid), your preferred massage pressure and service-related notes made by the therapist. If you give a non-Lithuanian phone number, we confirm your email with a one-time code.

3. Why we process it and on what legal basis

  • To make and manage bookings and to send confirmation, reminder and change messages by SMS and email – entering into and performing a contract (GDPR Art. 6(1)(b));
  • To check the service suits your age – performance of a contract (Art. 6(1)(b));
  • For receipts, invoices and accounting – legal obligation (Art. 6(1)(c));
  • For the loyalty programme (counting visits and rewards) and birthday greetings with a small gift – our legitimate interest in rewarding returning clients (Art. 6(1)(f)); you may object and opt out of greetings at any time;
  • For service quality and safety (therapist notes, preferred pressure) – performance of a contract and legitimate interest.

4. Health information

If you share health information in your note or with the therapist (e.g. an injury, pregnancy, contraindications), we use it only to make the massage safe and suitable for you. You provide it voluntarily and explicitly consent to its use for this purpose (GDPR Art. 9(2)(a)); you may withdraw consent at any time. Please do not share health data that is not needed for the massage.

5. Who receives the data

We do not sell your data or pass it to third parties for marketing. Only the minimum necessary data is received by our service providers (processors) acting on our instructions: the server hosting provider (EU), the SMS service (VertexSMS, EU), the email service (Resend, USA), the note translation service (DeepL, EU) and encrypted backup storage. When you buy a gift voucher, the payment is handled by Stripe as a separate controller.

Where data is transferred outside the European Economic Area (e.g. Resend, Stripe – USA), safeguards approved by the European Commission apply: standard contractual clauses or the EU–US Data Privacy Framework.

6. How long we keep data

  • Client record and visit history – while you use our services and no longer than 3 years after your last visit; after that the data is deleted or anonymised (statistics remain without personal identity);
  • Receipts, invoices and other accounting records – 10 years, as required by the Lithuanian Law on Accounting;
  • Message sending log – up to 12 months;
  • On your request data is deleted or anonymised without delay, except data we must keep by law.

7. Your rights

You have the right to access your data, rectify it, request erasure ("right to be forgotten"), restrict processing, object to processing based on legitimate interest, receive your data in a portable format and withdraw consent at any time (without affecting earlier processing). Contact us at dimakthai@gmail.com or at the studio – we will respond within 30 days. If you believe your data is processed unlawfully, you may lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, LT-10312 Vilnius, www.vdai.lrv.lt).

8. Automated decisions

We do not make automated decisions with legal effects on you and do not carry out profiling.

9. Cookies

The website uses only essential cookies (e.g. to remember your language). Marketing cookies (e.g. "Meta Pixel") are enabled only after you consent in the cookie banner; if you decline, the website works fully. You may withdraw consent at any time.

10. Buying gift vouchers

When you buy a gift voucher we also process the buyer's name and email address (to send the voucher and purchase confirmation) and, if provided, the recipient's name (printed on the voucher). We do not receive or store card details. Purchase data is kept as long as needed for accounting and voucher validity.

11. Reviews

If you leave a review, it is published on the website with the name you provide only after we approve it. We remove it on request.

12. Children's data

When booking a children's massage we also ask for the child's date of birth (required) and, optionally, the child's name. The date of birth confirms the service suits the child's age and lets the therapist prepare a suitable massage; the name is used only so the therapist can address the child. This data is provided by the booking parent or guardian, who confirms they have the right to do so. Children's data is stored with that visit record, not the client card: visit history, the loyalty programme and birthday greetings belong to the booking adult. We do not use children's data for marketing or share it with third parties. The same retention periods and the rights listed in section 7 apply.

Updated: 2026-10-06