Markle, Judge. This premises liability and negligent employment action arises from the sexual assault of Nia Cleveland by a massage therapist at a spa owned by Team RTR2, LLC d/b/a Zen Massage (“Zen Massage”). The trial court granted summary judgment to Zen Massage, and Cleveland now appeals, arguing that the trial court erred by finding that the assault was not reasonably foreseeable. Cleveland also challenges the trial court’s grant of summary judgment as to her derivative claims for punitive damages and attorney fees, as well as the grant of a protective order to Zen Massage. For the reasons that follow, we reverse the trial court’s judgment as to the premises liability claim and the attendant claims for attorney fees and punitive damages; we affirm the grant of summary judgment on the negligent employment claims; and we vacate the protective order. To prevail at summary judgment under OCGA § 9-11-56, the moving party must demonstrate that there is no genuine issue of material fact and that the undisputed facts, viewed in the light most favorable to the nonmoving party, warrant judgment as a matter of law. On appeal from the grant of summary judgment this Court conducts a de novo review of the evidence to determine whether there is a genuine issue of material fact and whether the undisputed facts, viewed in the light most favorable to the nonmoving party, warrant judgment as a matter of law. (Citation omitted.) LittleThomas v. Select Specialty Hosp.Augusta, Inc., 333 Ga. App. 362, 363 (773 SE2d 480) (2015). So viewed, the record reflects that, in June 2015, Nia Cleveland went for a massage at Zen Massage, and Gary Tavares was assigned as her massage therapist.[1] At the end of the session, Tavares offered to show Cleveland some stretches, and while doing so, he inserted his fingers into her vagina multiple times. After Cleveland left the spa in a state of shock, she called the police, and then reported the assault to an employee at Zen Massage, who in turn notified one of the owners, Mary LaBroi.[2] The following day, Mary fired Tavares. Tavares was ultimately arrested for aggravated sexual battery based on Cleveland’s allegations. Cleveland filed this civil action, asserting claims for premises liability, negligent employment, punitive damages, and attorney fees pursuant to OCGA _ 13-6-11.[3] Discovery revealed that, in 2011 through 2012, there were five separate instances in which different women were sexually assaulted by another male massage therapist during their sessions at Zen Massage, and the owners were aware of these incidents. During their depositions, two Zen Massage employees testified that they had concerns about Tavares because he would boast about the way he touched female clients. Neither employee expressed their concerns to the owners, however. Mary also confirmed that she had never received any complaints about Tavares. Mary further testified that Tavares was an independent contractor, and that she screened him as she did all applicants for a massage therapist position, ensuring he had a state-issued license and a county permit, both of which require a background check, and carried his own liability insurance. Zen Massage moved for summary judgment, arguing that Cleveland’s claims were precluded because (1) Tavares was acting beyond the scope of his employment, and therefore Zen Massage could not be vicariously liable for his actions; and (2) Cleveland failed to show proximate causation because Tavares’s actions were not reasonably foreseeable to Zen Massage. The trial court granted summary judgment to Zen Massage, finding, as is relevant to this appeal, that the premises liability and negligent employment claims failed because Tavares’s criminal acts were not reasonably foreseeable, and thus there was no proximate causation linking Zen Massage to Cleveland’s injury. This appeal followed. 1. Cleveland first argues that the trial court erred by granting summary judgment to Zen Massage on its premises liability claim because a sexual assault of a spa customer by a massage therapist was reasonably foreseeable. Given the evidence before the trial court, we must agree. In Georgia, a proprietor owes its invitees a duty “to exercise ordinary care in keeping the premises and approaches safe.” OCGA 51-3-1. Although a proprietor is not charged with insuring its customers’ safety, it “is bound to exercise ordinary care to protect its invitees from unreasonable risks of which it has superior knowledge.” Fair v. CV Underground, LLC, 340 Ga. App. 790, 792 (1) (798 SE2d 358) (2017). Typically, a proprietor is insulated from liability for third-party criminal acts unless the act was reasonably foreseeable. Fair, 340 Ga. App. at 792 (1); see also Days Inns of America, Inc. v. Matt, 265 Ga. 235 (454 SE2d 507) (1995) (“Simply put, without foreseeability that a criminal act will occur, no duty on the part of the proprietor to exercise ordinary care to prevent that act arises.”). As our Supreme Court has explained, if the proprietor has reason to anticipate a criminal act, he or she then has a duty to exercise ordinary care to guard against injury from dangerous characters. Accordingly, the incident causing the injury must be substantially similar in type to the previous criminal activities occurring on or near the premises so that a reasonable person would take ordinary precautions to protect his or her customers or tenants against the risk posed by that type of activity. In determining whether previous criminal acts are substantially similar to the occurrence causing harm, thereby establishing the foreseeability of risk, the court must inquire into the location, nature and extent of the prior criminal activities and their likeness, proximity or other relationship to the crime in question. While the prior criminal activity must be substantially similar to the particular crime in question, that does not mean identical. What is required is that the prior incident be sufficient to attract the [proprietor's] attention to the dangerous condition which resulted in the litigated incident. Further, the question of reasonable foreseeability of a criminal attack is generally for a jury’s determination rather than summary adjudication by the courts. (Citations and punctuation omitted.) Sturbridge Partners, Ltd. v. Walker, 267 Ga. 785, 786 (482 SE2d 339) (1997). In sum, Cleveland must show that Tavares’s assault on her was substantially similar to the prior criminal acts, thus establishing its foreseeability; and that the owners had superior knowledge of the risk of harm she encountered. (a) Foreseeability Here, the record reveals that, within the previous four years, there had been five incidents involving a sexual assault or inappropriate touching by a male massage therapist against a female client during sessions at Zen Massage. One of the victims alleged that the therapist penetrated her vagina with his fingers– exactly the same act at issue here. Even though they did not involve Tavares, these prior acts were substantially similar in location, nature and extent as the assault on Cleveland. Sturbridge Partners, Ltd., 267 Ga. at 786; see LittleThomas, 333 Ga. App. at 368 (3) (finding five reports of sexual assaults of female patients in their hospital rooms by different male employees substantially similar to the harm suffered by the plaintiff). Therefore, there is sufficient evidence to show that the assault on Cleveland was reasonably foreseeable.[4] Sturbridge Partners, Ltd., 267 Ga. at 786 (substantial similarity of the prior acts to the present harm establishes reasonably foreseeability); Med. Center Hosp. Auth. v. Cavender, 331 Ga. App. 469, 473 (1) (771 SE2d 153) (2015) (“Foreseeable consequences are . . . those which, because they happen so frequently, may be expected to happen again.”) (citations omitted). (b) Superior knowledge “But even if an intervening criminal act may have been reasonably foreseeable, the true ground of liability is the superior knowledge of the proprietor of the existence of a condition that may subject the invitee to an unreasonable risk of harm.” (Citations and emphasis omitted.) Fair, 340 Ga. App. at 792 (1); Camelot Club Condo. Assn., Inc. v. AfariOpoku, 340 Ga. App. 618, 622 (1) (a) (ii) (798 SE2d 241) (2017). Here, the owners’ superior knowledge is indisputable. During their depositions, both owners confirmed that they knew about the similar incidents at their spa prior to Cleveland’s assault. See Rautenberg v. Pope, 351 Ga. App. 503, 506 (1) (831 SE2d 209) (2019) (owners admitted to knowledge of similar criminal acts on premises). Moreover, nothing in the record shows that Cleveland knew of any such risk. See Camelot Club Condo. Assn., Inc., 340 Ga. App. at 622 (1) (a) (ii) (no evidence that plaintiff knew of any criminal activity on the premises). As such, there is ample evidence of Zen Massage’s superior knowledge of the risk of harm. The trial court thus erred by granting summary judgment to Zen Massage on Cleveland’s premises liability claim, and we reverse.[5] 2. Cleveland next contends the trial court erred by granting summary judgment to Zen Massage on her claims for negligent hiring and retention because it was reasonably foreseeable that Tavares would sexually assault customers. We discern no error. Pursuant to OCGA § 34-7-20, an “employer is bound to exercise ordinary care in the selection of employees and not to retain them after knowledge of incompetency_._” In other words, an employer may be liable for negligently hiring or retaining an employee “only where there is sufficient evidence to establish that the employer reasonably knew or should have known of an employee’s ‘tendencies’ to engage in certain behavior relevant to the injuries allegedly incurred by the plaintiff.” Munroe v. Universal Health Servs., Inc., 277 Ga. 861, 863 (1) (596 SE2d 604) (2004). Whereas a claim for premises liability rests on an owner’s superior knowledge of the probable occurrence of the criminal act (or hazard) at issue, negligent employment claims hinge on an employer’s knowledge of a specific employee’s propensity to cause the type of harm suffered by the plaintiff. Id.; Little-Thomas, 333 Ga. App. at 363 (1), (2). (a) Negligent hiring “An employer breaches its duty of care by hiring an employee who is not accustomed to act with due care. The causation element requires showing that, given the employee’s dangerous propensities, the victim’s injuries should have been foreseen as the natural and probable consequence of hiring the employee.” (Citations and punctuation omitted.) TGM Ashley Lakes, Inc. v. Jennings, 264 Ga. App. 456, 459 (1) (a) (590 SE2d 807) (2003). Here, the record is devoid of any evidence that establishes that Zen Massage knew or should have known of Tavares’s dangerous propensities. Tavares received his massage therapist license two years prior to the incident at issue, and was required to pass a criminal background check as part of the licensing and permitting process. The owners relied on these background checks, and required Tavares to perform a practical massage prior to hiring him. Cleveland points to no evidence that the owners were required to carry out a more extensive vetting process when they hired him, or that they would have found any cautionary information had they done so. See Little-Thomas, 333 Ga. App. at 365 (1) (no evidence to show that employer would have discovered employee’s propensities to inflict the harm suffered by plaintiff had it performed a more rigorous pre-hiring investigation); compare TGM Ashley Lakes, Inc., 264 Ga. App. at 459 (1) (a) (question of fact whether employer should have inquired into errant employee’s criminal background where manager knew of his previous incarceration). Notably, Tavares received no public reprimands against his license prior to his employment at Zen Massage. Because the evidence was “plain and palpable” that Zen Massage’s hiring practices were reasonable, the trial court did not err in granting summary judgment to it on the negligent hiring claim. Little-Thomas, 333 Ga. App. at 365 (1). (b) Negligent retention Similarly, Cleveland’s negligent retention claim fails because the evidence of record is insufficient to show that Zen Massage had the requisite knowledge of Tavares’s dangerous propensities after he was hired. Cleveland points to the deposition testimony of Tavares’s coworkers in which they expressed their discomfort due to his “weird,” “cocky” demeanor and his boasts about the manner in which he touched his female clients. However, Tavares never admitted to his coworkers that he inappropriately touched his clients; rather, he gave the “impression” that he did so by his gestures mimicking his technique. Notably, the coworkers discussed their concerns only amongst themselves, and never informed the owners. Moreover, there is no evidence that any customer complained about Tavares prior to the incident at issue here. As such, there is no basis to support Cleveland’s contention that Zen Massage knew or should have known of Tavares’s dangerous propensities. Compare Harper v. City of East Point, 237 Ga. App. 375, 377 (2) (515 SE2d 623) (1999) (trial court erred by granting summary judgment to the city because prior reports of police officer’s increasingly deviant behavior raised a question of fact as to its constructive knowledge of his propensities to commit bad acts), disapproved of on other grounds by Munroe, 277 Ga. at 864 (1). Nonetheless, Cleveland contends that the employees’ concerns about Tavares’s dangerous propensities are imputed to Zen Massage under an agency theory. For this proposition, Cleveland relies primarily on Millan v. Residence Inn By Marriott, Inc., 226 Ga. App. 826 (487 SE2d 431) (1997). But, in that case, we found that there was a question of fact as to whether the hotel had notice of its patron’s deviant behavior where hotel employees received complaints from guests about him, and one employee had even been assaulted herself by him. Id. These facts are distinct from the case at hand. Although the employees in Millan witnessed or suffered the inappropriate behavior, Tavares’s coworkers only had “concerns” and “impressions” about him. Simply put: hunches, impressions, and innuendo are insufficient to raise a question of fact as to Zen Massage’s constructive knowledge of Tavares’s dangerous propensities. Compare id.; see St. Jude’s Recovery Center, Inc. v. Vaughn, 354 Ga. App. 593, 595-596 (2) (841 SE2d 108) (2020) (evidence insufficient to raise question of fact as to reasonable foreseeability of the rape of the facility’s resident where other female residents only encountered catcalls and verbal harrassment from third parties outside the facility, and generally felt it unsafe to walk outside after dark). Accordingly, the trial court properly granted summary judgment to Zen Massage on Cleveland’s negligent employment claims, and we affirm. 3. In light of our decision in Division 1 that the premises liability claim survives summary judgment, we agree with Cleveland that her claims for punitive damages and attorney fees also survive. See Stephen A. Wheat Trust v. Sparks, 325 Ga. App. 673, 682 (7) (754 SE2d 640) (2014) (derivative claims for punitive damages and attorney fees survive summary judgment where underlying tort survived). Accordingly, we reverse the trial court’s grant of summary judgment on these claims. 4. Finally, Cleveland challenges the trial court’s grant of a protective order regarding certain depositions that were noticed for times when counsel for Zen Massage were unavailable. Zen Massage does not respond to this argument. Because the trial court’s decision was based on its award of summary judgment as to all claims, in light of our ruling with regard to the premises liability claim and its derivative claims, we vacate the grant of the protective order. Judgment affirmed in part, reversed in part, and vacated in part. Reese, P. J., and Colvin, J., concur.
