top of page

Privacy Policy

Privacy Policy of ThéRâPie-Ochaya

Version 1.0, effective as of 3 July 2026

This privacy policy describes the manner in which your personal data is collected, used and protected when you interact with ThéRâPie-Ochaya, in accordance with Regulation (EU) 2016/679 ("GDPR") and the Luxembourg Law of 1 August 2018 on the protection of natural persons with regard to the processing of personal data.

 

1. Data Controller and Contact

The data controller is:

ThéRâPie S.à r.l. (operating the "ThéRâPie-Ochaya" brand) - RCS Luxembourg: B285230 - VAT: LU35753522 - Registered office: 121 Fond Saint-Martin, L-2135 Luxembourg - Establishment (customer reception): 32 rue du Curé, L-1368 Luxembourg - Website: https://www.therapie.luxe (Wix platform)

"Privacy" point of contact: Ms Samira Maaoui, manager. Contact address: mochi@therapie.luxe

ThéRâPie S.à r.l. is an SME and has not appointed a data protection officer (DPO). For any question relating to your personal data, your point of contact is the manager, at the address above.

 

2. Data Collected

Depending on your interactions with us, we may collect the following categories of data:

  • Identification and contact data: surname, first name, e-mail address, telephone number, postal address.

  • Booking data: chosen service (restaurant, MedSpa, workshop), date, time, preferences communicated.

  • Order and invoicing data: products ordered, delivery/billing address, amount, billing data.

  • Payment data: processed by our payment service provider; we do not store full payment card data.

  • Account / member area data: login credentials, history relating to membership (future Club Ochaya).

  • Contact form data: the content of your message and the contact details provided.

  • Application data: information submitted via the recruitment page (CV, cover letter, contact details).

  • Browsing and audience measurement data: data collected via cookies and Google Analytics 4, subject to your consent.

Source of the data: the data is, save in exceptional cases, collected directly from you. Certain fields are mandatory in order to provide you with the requested service (for example, to process a booking or an order); failing this, we may be unable to respond to your request. The other information is optional.

Automated decision-making: we do not carry out any solely automated decision-making producing legal effects concerning you, nor any profiling of this nature.

 

3. Purposes and Legal Bases by Processing Activity

  • Bookings (restaurant, MedSpa, workshops) via Wix Bookings: Manage and confirm your bookings. Legal basis: Performance of the contract / pre-contractual measures (Art. 6(1)(b)).

  • E-commerce store orders (Wix Stores): Process and fulfil your orders. Legal basis: Performance of the contract (Art. 6(1)(b)).

  • Invoicing and accounting: Issue invoices, comply with accounting obligations. Legal basis: Legal obligation (Art. 6(1)(c)).

  • Payments (payment service provider; Stripe for memberships of the future Club Ochaya*): Collect and secure payments. Legal basis: Performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

  • Member account / member area and future Club Ochaya (membership): Manage your account and your membership. Legal basis: Performance of the contract (Art. 6(1)(b)).

  • Contact form: Respond to your requests. Legal basis: Legitimate interest in responding (Art. 6(1)(f)) or consent (Art. 6(1)(a)).

  • Newsletter / marketing communications (Wix Ascend / SendGrid): Send you our news and offers. Legal basis: Consent (Art. 6(1)(a)), withdrawable at any time.

  • Applications (recruitment page): Assess your application. Legal basis: Pre-contractual measures / consent (Art. 6(1)(a) / 6(1)(b)).

  • Audience measurement (Google Analytics 4) and cookies: Analyse site traffic. Legal basis: Consent (Art. 6(1)(a)).

* Stripe is used for payments of memberships of the future Club Ochaya, the Wix Payments service not being available in Luxembourg.

 

4. Retention Periods

Your data is retained for the period strictly necessary for the purposes pursued:

  • Bookings: for the duration of the customer relationship, extended by the applicable limitation periods.

  • Orders: for the duration of the customer relationship, extended by the applicable limitation periods.

  • Invoicing and accounting: 10 years, in accordance with Luxembourg accounting obligations.

  • Payments: for the period necessary for the performance of the contract and compliance with legal obligations (in particular accounting, up to 10 years for supporting documents).

  • Member account / Club Ochaya: for the duration of the membership / account, then deletion or anonymisation after a period of inactivity (failing any other defined period, 3 years after the last active contact).

  • Contact form: for the period necessary to process your request, then deletion; failing any other period, approximately 1 year after the request has been processed.

  • Newsletter / marketing: until the withdrawal of your consent or your unsubscription (and, failing any activity, at the latest 3 years after the last contact).

  • Applications: deletion if you are not selected, at the latest approximately 1 year after the end of the recruitment process (unless you consent to extended retention).

  • Cookies and trackers: maximum lifespan of approximately 13 months; consent is renewed at the same intervals.

 

5. Recipients and Processors

Your data may be disclosed to the following recipients and processors, within the limits of their respective functions:

  • Wix.com Ltd: Host and platform of the website (Bookings, Stores, Ascend, CRM), processor

  • Twilio SendGrid: Sending of transactional and marketing e-mails via Wix Ascend, processor

  • Open-Xchange / EuroDNS: Professional e-mail service (@therapie.luxe mailboxes), processor

  • Google Ireland Ltd / Google LLC: Audience measurement (Google Analytics 4), processor

  • Stripe: Processing of payments for the future Club Ochaya, processor (and, for certain payment operations, independent data controller within the meaning of the applicable regulations)

  • Review platforms (TripAdvisor, Yelp): If you publish or respond to a review, the processing falls under their own privacy policies, separate data controllers

In addition, your data may be disclosed to the competent administrative, tax, accounting or judicial authorities where the law obliges us to do so or for the establishment, exercise or defence of legal claims.

We do not sell your personal data. The data is disclosed to third parties only to the extent necessary for the purposes described above or where the law requires it.

 

6. Transfers Outside the European Union

Some of our processors are established outside the European Union. These transfers are governed by mechanisms compliant with the GDPR:

  • Wix.com Ltd (Israel): transfer governed by the adequacy decision of the European Commission recognising an adequate level of data protection in Israel.

  • Twilio SendGrid (United States): transfer governed by the EU-U.S. Data Privacy Framework and/or by the European Commission's standard contractual clauses (SCCs).

  • Google (United States): transfer governed by the EU-U.S. Data Privacy Framework and/or the standard contractual clauses (SCCs).

  • Stripe (United States / Ireland): the processing carried out from Ireland takes place within the European Union and does not constitute a transfer outside the EU. For any portion possibly carried out in the United States, the transfer is governed by the EU-U.S. Data Privacy Framework and/or the standard contractual clauses (SCCs).

You may contact us at mochi@therapie.luxe to obtain further information on these safeguards and, where applicable, to obtain a copy of them.

 

7. Cookies and Trackers

Our website uses cookies and trackers, in particular those strictly necessary for its operation (Wix platform) and audience measurement cookies (Google Analytics 4).

Non-essential cookies (audience measurement, marketing) are placed only after your consent, obtained via the Wix cookie management banner displayed during your visit. You may at any time accept, refuse or modify your choices via this banner or your browser settings.

The lifespan of cookies is approximately 13 months maximum, after which your consent is requested again.

 

8. Your Rights

In accordance with the GDPR and the Luxembourg Law of 1 August 2018, you have the following rights over your personal data:

  • Right of access: obtain confirmation that your data is being processed and receive a copy thereof.

  • Right to rectification: have inaccurate or incomplete data corrected.

  • Right to erasure ("right to be forgotten"): request the deletion of your data under the conditions provided for by law.

  • Right to restriction of processing: request the suspension of processing in certain cases.

  • Right to object: object to processing based on legitimate interest, as well as to processing for direct marketing purposes.

  • Right to data portability: receive the data you have provided to us in a structured, machine-readable format, or have it transmitted to another controller.

  • Right to withdraw your consent at any time, where the processing is based on it (without affecting the lawfulness of the processing carried out before the withdrawal).

  • Right to issue directives relating to the fate of your data after your death.

How to exercise your rights: send your request to mochi@therapie.luxe. We may need to verify your identity before responding. We process your request within the time limits provided for by the GDPR (in principle one month, extendable depending on complexity).

 

9. Complaint to the CNPD

If you consider that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Luxembourg supervisory authority:

Commission nationale pour la protection des données (CNPD) - 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg - cnpd.gouvernement.lu

 

10. Security

ThéRâPie S.à r.l. implements reasonable and appropriate technical and organisational measures in order to protect your data against loss, unauthorised access, disclosure or alteration. These measures rely in particular on the security mechanisms of the platforms and service providers used (hosting, e-mail, payment). As no data transmission over the Internet can be guaranteed to be entirely secure, we cannot guarantee absolute security, but we strive to continuously adapt our measures to the state of the art.

 

11. Updates to the Policy

This policy may be updated to reflect changes in our processing activities or in the regulations. Any substantial modification will be indicated on our website. We invite you to consult it regularly.

Version 1.0, version date: 3 July 2026.

bottom of page