Privacy Policy
As a customer, hotel’s guest or website visitor (“you” or “your”), your personal data is collected by Atera Bathhouse & Spa, with a registered office at Pandox Highlander Glasgow Opco Ltd t/a Radisson Blu Hotel Glasgow, registration n°11471650 and VAT n°302 038655, in its capacity as data controller (“we”, “us”, “our”).
Scope of this privacy Notice
This privacy notice (“Notice”) applies to you when you visit our website, make a booking for treatments, spa sessions or packages, purchase a gift voucher, or otherwise interact with Atera Bathhouse & Spa. It explains how and why we collect and use your personal data and clarifies which rights you can exercise as a data subject. Please read this Notice carefully.
Where you also stay at, or otherwise interact with, Radisson Blu Hotel Glasgow, your personal data may also be processed in accordance with the Radisson Hotels privacy centre.
We are committed to protecting your personal data with the utmost care and to processing it only in a fair and lawful manner, in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, together with any current or future act or regulation amending or replacing them (hereinafter “Applicable Data Protection Law”).
Overview of purposes, personal data and legal basis
Personal data means any information by which a natural person can be directly or indirectly identified. You may provide us with your personal data in the context of the following activities, for the corresponding purposes and based on the stated legal basis:
| Purpose | Personal Data | Legal Basis | Source |
|---|---|---|---|
| Spa bookings and appointments: to process and manage your booking or reservation for treatments, spa sessions or packages. |
|
Necessity for performance of a contract, or to take steps at your request prior to entering into a contract | Provided by you when you book online, by phone, or in person |
| Pre-treatment health and wellness consultation*: to assess your suitability for a treatment and to ensure your safety. | Health-related information you disclose in our consultation form (e.g. allergies, skin conditions, pregnancy, relevant medical conditions) | Your explicit consent (Article 9(2)(a) UK GDPR) | Provided directly by you before your treatment |
| Newsletter and promotional communications: to keep you informed of our latest news, offers, treatments and events. |
|
Consent | Provided by you when you subscribe |
| Membership and loyalty programme: to manage your spa membership. |
|
Necessity for performance of a contract; legitimate interest in managing our customer relationship | Provided by you when you join, or shared with your consent from your Radisson Rewards profile |
| Gift vouchers and retail purchases: to process purchases of gift vouchers, packages and retail products. |
|
Necessity for performance of a contract | Provided by you at the time of purchase |
| Contact form / correspondence: to handle your question or message. |
|
Necessity for performance of a contract, or to take steps at your request prior to entering into a contract | Provided by you when you fill out the contact form or reach out via email, whatsapp or phone |
| Customer feedback and reviews: to assess, evaluate and improve the services we offer. |
|
Legitimate interest to improve our services | Provided by you following your visit or treatment |
| Site safety and security: to protect the safety and security of guests, staff and premises. | CCTV images | Legitimate interest in ensuring safety and security | Collected automatically via CCTV cameras on our premises |
Where the processing of your personal data as indicated in the table above is a statutory or contractual requirement, or a requirement necessary to enter into a contract, you are obliged to provide the personal data. If you refuse, we may not be able to provide you with the relevant treatment, booking or service.
*Regarding health and wellness information, given the sensitive nature of the health information collected through our pre-treatment consultation, we only use it to assess your suitability for a treatment and to ensure your safety, and never for any other purpose such as marketing. Access to this information is limited to the therapists and staff directly involved in your treatment, and it is retained only for as long as necessary for this purpose.
Your rights as a data subject
Subject to the conditions and limitations set out under Applicable Data Protection Law, you may exercise the following data subject rights:
Right of access to your personal data
The right to request access to your personal data, to request a copy of the personal data that we collect about you and to additional information on how we process your personal data.
Right to rectification
The right to have incorrect personal data corrected or incomplete personal data we hold about you completed.
Right to data erasure (“right to be forgotten”)
The right to have your personal data deleted from our systems. It cannot always be granted due to, e.g., contractual or legal obligations. We will observe these obligations when responding to your request.
Right to object
The right to object to the processing of your personal data if the processing is based on our legitimate interest or on grounds of public interest. We will stop processing unless we can demonstrate compelling legitimate grounds for further processing or for the exercise of legal claims.
You may also object where we process your data for direct marketing purposes, in which case your personal data will no longer be processed for these purposes.
Right to withdraw your consent
For the processing of your personal data collected by us with your consent (e.g. the newsletter or your pre-treatment consultation), you may withdraw your consent at any time. However, withdrawing your consent does not affect the lawfulness of the processing based on consent before its withdrawal.
Right to restriction of processing
In certain cases, you have the right to obtain the restriction of the processing of your personal data. If you successfully exercise this right, we will continue to store your data, but we will limit its use. We only have to fulfil these requests in specific cases, as stipulated by law.
Right to data portability
The right to obtain the personal data concerning you processed by us in a structured, commonly used and machine-readable format and/or to have such data transmitted or copied to another controller.
The above rights can be exercised free of charge by sending an e-mail to privacypandox@cranium.eu. Subject to legitimate exceptions under Applicable Data Protection Law, we undertake to respond to your request within one month of receipt. We may first request additional information to confirm your identity and to ensure that the request comes from you.
Right to lodge a complaint
If you believe that we are infringing your data protection rights, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
telephone +44 303 123 1113
https://ico.org.uk/make-a-complaint/
Sharing your information
We refrain from disclosing or selling your personal data to third parties, and from publicly disclosing your personal data, except in the following specific cases:
- personal data may be shared with Radisson Blu Hotel Glasgow, where necessary for the provision of your treatment, booking or loyalty programme, or for guest service coordination;
- personal data may be shared with external service providers to which we have outsourced certain processing activities. In any case, they are limited to processing your personal data in accordance with our instructions and, where necessary, a data processing agreement is concluded so that they are obliged to comply with all obligations required by Applicable Data Protection Law;
- if required by applicable laws or regulations.
International transfers
We will comply with Applicable Data Protection Law in terms of providing adequate protection for the transfer of personal data to recipients located outside the United Kingdom.
In case we transfer your personal data to a third country or international organisation, we will make sure that your personal data is either transferred to countries deemed to offer an “adequate” level of protection under UK adequacy regulations, or, alternatively, we will put in place appropriate safeguards with the entity receiving your personal data (e.g. the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or binding corporate rules), taking into account additional requirements regarding international transfers such as supplementary measures, to ensure that your personal data remains protected in accordance with Applicable Data Protection Law.
If you wish to receive more information or a copy of these safeguards, please contact us at the following e-mail address: privacypandox@cranium.eu
Retention of your personal data
We will retain your personal data for no longer than is strictly necessary to fulfil the purposes for which we received it. Retention periods differ depending on the type of processing activity and the purpose for which the personal data was collected.
Personal data that we collect based on your consent is retained for as long as your consent remains valid.
In all cases, personal data may be retained for a longer period if there is a legal or regulatory reason to do so, or for a shorter period if you object to the processing of your personal data and there is no longer a legitimate reason to retain it. We guarantee that your personal data will be deleted or anonymised once the applicable retention period has expired.
If you wish to receive more information about the retention periods we apply, please contact our DPO at the following e-mail address: privacypandox@cranium.eu
Contact details
CRANIUM has been appointed as Data Protection Officer in accordance with Articles 37-39 UK GDPR.
If you have any comments or questions about the information in this Notice, or any other issues relating to our processing of your personal data, please contact the DPO at: privacypandox@cranium.eu
Changes to our Privacy Notice
We may amend or update this Notice from time to time to reflect changes in our practices regarding the processing of your personal data, or changes in applicable law. We will do so by posting the updated version on Atera website. When we publish changes to this Notice, we will update the date and version number. Significant changes will be notified on our homepage. Nevertheless, we encourage you to regularly read this Notice.
September 2026 – Version 1.0