Who we are
Maison Haven Luxe Limited (RC 9512291), of 22 Emma Abimbola Cole Street, Lekki Phase 1, Lagos, is the data controller for the information described here. Questions, requests and complaints go to [data protection contact] or hello@themaisonhaven.com.
What we collect, and why
- Booking and service records — your name, phone number, the services you have had, and the notes a practitioner needs to do the next appointment properly. We cannot run an appointment book without these.
- Health and consultation information, where a treatment requires it — a health questionnaire before a first spa treatment, a consultation record in the salon, and patch-test results. This is sensitive information and it is treated as such: it is seen only by the practitioner treating you and the people who have to schedule around it, and it is never discussed in public, including in a reply to a review or a comment.
- Purchase records — what you bought, when, and how you paid. Card details are handled by our payment provider and never reach us.
- Marketing contact details, only where you have given consent.
- Website information — see cookies and measurement, below.
Marketing, and the consent behind it
We only send you marketing if you have said yes. That consent is specific, freely given, and recorded with the date and the wording you agreed to. There is no other basis on which we will market to you — the Act does not provide one, and we do not buy contact lists from anybody.
Withdrawing consent is as easy as giving it. Tell any member of staff, reply STOP to a message, or email us. It takes effect immediately and it does not affect your bookings, your prices, or how you are treated when you next walk in.
Cookies and measurement
This site uses a small number of measurement tools so we can tell which of our advertising is working. That includes advertising pixels which set cookies in your browser and report activity back to the platform concerned. You can refuse or delete these in your browser settings; the site works without them.
Our online shop, at shop.themaisonhaven.com, and our booking system, at book.themaisonhaven.com, run on separate systems and set their own cookies for the basket, your session and your appointment.
Two things on this site reach Google. Our typeface is served by Google Fonts, which means Google receives your IP address when a page loads. The map on the Visit page is a Google map, and it does not load until you press “Show the map” — if you never press it, nothing is requested from Google and no Google cookie is set by it. Pressing it shares your IP address with Google under Google’s own terms, not ours. We built it that way deliberately, so the choice is yours and so the page stays cheap to open on mobile data.
Who else sees it
Only the suppliers who need it in order to provide a service to us — our booking system, our payment provider, our delivery partners, and the consultancy that runs our marketing. Each is bound by a written contract that limits what they may do with it, as the Act requires. We do not sell your information to anyone, ever, and there is no circumstance in which we would.
How long we keep it
Service and consultation records for as long as you are a client and for a period afterwards, because a practitioner may need to know what was done to your hair or skin two years ago. Purchase and payment records for as long as tax and company law requires. Marketing contact details until you withdraw consent, and then we stop — though we keep a minimal record that you asked us to stop, so that we do not contact you again by accident.
Your rights
Under the Nigeria Data Protection Act 2023 you may ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it, object to how we are using it, and withdraw consent at any time. Ask, and we will act — we will not make you prove why. If you are not satisfied with how we have handled a request, you may complain to the Nigeria Data Protection Commission.
Security, and what happens if something goes wrong
Access is limited to the people whose job requires it. Passwords are never shared, never sent by message, and never written down where anyone can read them. If a breach occurs that is likely to affect you, we will notify the Commission within 72 hours and tell you directly.
Version 1 · September 2026 · This notice is the public summary of MH-GOV-001, our internal privacy policy. Where the two differ, the internal policy is the operative document and this page will be corrected.