Privacy Policy

KNOCKOUT INTERNATIONAL HOTEL, Owerri (“the Hotel”, “we”) is a hotel operating at #224 Okigwe Road, Ama Wire, Owerri, Imo State, Nigeria. For the purposes of the Nigeria Data Protection Act (NDPA) 2023 we are the Data Controller of the personal data described in this policy. This policy applies to this website, to bookings made through it, and to our KIHT Beauty Spa appointments.

We collect only what we need to make a booking or answer an enquiry. We do not collect special-category data about you unless you choose to tell us something clinically relevant, which we describe in section 5.

• Booking and contact data — your name, phone number, email address, arrival and departure dates, number of guests and room or treatment selected. Used to take the booking, verify your payment, issue your confirmation receipt and contact you about the stay.
• Payment evidence — a copy of the transfer receipt you upload, and the transfer reference you enter. Used to verify that payment has been made so we can confirm your booking.
• Government ID at check-in— we are required by law to sight a valid government-issued photo ID (National ID, International Passport or Driver’s Licence) and confirm it matches the name on the booking. We do not photograph or copy it.
• Spa health information — see section 5.
• Technical information — our web server records the ordinary technical data any web server must record, such as IP address, browser type and the pages requested, in order to keep the site secure and working.

• We do not sell, rent or trade your personal data to anyone.
• We do not run advertising networks, remarketing pixels or cross-site trackers.
• We do not use third-party analytics. There is no Google Analytics on this site and no third-party tracking script of any kind.
• We do not add hidden third-party content such as an embedded map, which would place that provider’s cookies on your device. Our “Get directions” link opens Google Maps in a new tab instead, so nothing loads from Google unless you choose to go there.
• We do not send marketing email unless you ask us to.

This site does not use advertising or analytics cookies. The only items stored in your own browser are the following, both of which stay on your device and are never sent to us:

• Your privacy choice — a single stored value recording whether you accepted or chose essential only, so we do not ask you again on every visit.
• Booking draft — if you begin a booking, the details you have typed so far are held on your device so that a phone call, a locked screen or an app switch does not erase them. It is sent to us only when you submit the booking, and it is cleared when you choose “essential only”.

You can clear or block browser storage at any time in your browser settings. Doing so will not prevent you booking, but a booking in progress may not be preserved if you close the tab.

Certain spa treatments — including chemical peels and Woods Lamp therapy — are not suitable for everyone, so we ask you to tell your therapist about any health condition, allergy, pregnancy, recent cosmetic procedure or medication that could affect your treatment. This is health data, which the NDPA treats as special-category data.

• It is visible only to the therapist treating you.
• It is never shared with any third party without your written consent, except where disclosure is required by law.
• It is never used for marketing, and it plays no part in any commercial decision about you.
• You may ask us to delete it at any time, though we may be required to retain a record of the treatment itself for clinical and tax purposes.

We share personal data only with the specific suppliers who need it to deliver what you booked, and no further:

• Supabase, our database and file-storage provider, which hosts the booking records and the payment receipts you upload. It processes data on our instructions under a written data-processing agreement.
• WhatsApp (Meta), if you choose to contact us that way. Messages you send are governed by WhatsApp’s own privacy policy as well as this one.
• Our professional advisers and authorities, where we are legally obliged to disclose.

We do not use third-party payment processors at present. Bookings are settled by direct bank transfer, which is why we ask for a copy of your transfer receipt.

• Payment receipts are stored in private, non-public file storage reachable only through a time-limited signed link after your booking is confirmed.
• Every booking record is tied to a unique reference, and a guessed reference does not grant access to a receipt.
• Our database tables are protected by Row Level Security as a second line of defence behind the application code.
• The database credential exists only on our server and is never sent to your browser.
• Booking and login endpoints are rate-limited, so automated scraping or brute-force attempts are throttled.
• All traffic is served over HTTPS with a restrictive Content Security Policy and related security headers.

Booking records and payment receipts are retained for seven years, which is the period required for tax and audit purposes in Nigeria. Contact and enquiry details that do not lead to a booking are kept for up to two years. Spa health information is retained only while needed to treat you safely and for the statutory clinical record period, after which it is deleted. When your data is deleted we remove it from our systems; backups roll off within 30 days.

You have the right to:

• be told what personal data we hold about you, and obtain a copy;
• have inaccurate data corrected;
• have your data erased, where we are not required to retain it;
• object to or restrict how we use it;
• withdraw any consent you have given;
• lodge a complaint with the Nigeria Data Protection Commission on ndpc.gov.ng.

To exercise any of these, contact us using the details in section 12. We respond within 30 days. We may need to verify your identity first, so please send a booking reference if you have one.

Our services are intended for adults. Anyone under 18 requires a parent or legal guardian to make a booking and to be present for any spa treatment. We do not knowingly collect personal data directly from children, and if you believe a child has provided us with data, contact us and we will delete it.

If we make a material change to how we handle your data, we will update this page and, where the change affects what you have already consented to, ask you again. The date of the latest revision is shown below.

For any privacy question, or to exercise a right under section 9: