Depending on how you interact with us, we may collect:

• your name
• billing and delivery addresses
• email address
• telephone number
• order and transaction information
• products purchased
• customer-service correspondence
• warranty and returns information
• information you provide when completing surveys, competitions or promotions
• marketing preferences
• IP address and device information
• browser and website usage information
• cookie and consent preferences
• information required to prevent fraud or verify an order.

We do not normally receive or store your full payment-card details. Payments are processed by the relevant payment provider.

From time to time, we may invite customers to participate in optional surveys, product research or testing.

Depending on the survey, information may include demographic information, purchasing behaviour, product preferences, feedback and other information you choose to provide.

Participation is voluntary.

Where we ask questions relating to potentially sensitive matters, we will explain why we are asking and how the information will be used. You do not have to answer optional questions.

We may use your personal information to:

• process, fulfil and deliver orders
• take and manage payments
• communicate with you about your order
• process returns, refunds and warranty claims
• respond to enquiries and customer-support requests
• prevent fraud and unauthorised transactions
• improve our products and website
• understand how customers use our website
• conduct customer and product research
• manage competitions and promotions
• comply with legal, tax and accounting obligations
• send marketing where we have a lawful basis to do so.

Depending on the circumstances, we process personal information because:

Contract
We need the information to sell and deliver products to you or to take steps at your request before entering into a contract.

Legal obligation
We are required to retain or process certain information to comply with the law, including tax, accounting and consumer-protection requirements.

Legitimate interests
We may use information where it is reasonably necessary for our legitimate business interests, provided those interests do not override your rights. Examples include fraud prevention, customer service, improving products and understanding business performance.

Consent
We rely on consent where required, including for certain marketing activities and non-essential cookies.

The ICO expects a privacy notice to explain the purposes, lawful bases, recipients, retention periods, international transfers and individual rights rather than simply saying that a business complies with GDPR.

If you choose to join the Doxy Owners Club or otherwise opt in to marketing, we may send you information about Doxy products, launches, offers, events and brand news.

You can unsubscribe at any time using the unsubscribe link in our emails.

Where applicable, we may also contact existing customers about similar Doxy products where permitted by law. You can opt out at any time.

We keep records of marketing preferences so that we can respect your choices.

Consent for electronic marketing must be clear and specific and businesses should retain records showing when and how it was obtained.

Doxy 2.0 Ltd is a new company that took ownership of the Doxy brand following the administration of CMG Leisure Ltd in 2025.

As part of that transition, Doxy 2.0 Ltd obtained certain historical customer and business records required to operate the Doxy brand, maintain customer relationships and deal with relevant support enquiries.

Where historical information is no longer required for a legitimate business or legal purpose, it will be deleted in accordance with our retention practices.

Historical marketing information will only be used where Doxy 2.0 Ltd has an appropriate lawful basis to do so.

I have deliberately softened the wording here. The current dev policy says you "lawfully acquired certain customer records and marketing data" and implies previous marketing subscribers can simply continue to receive emails. screencapture-doxymassager-devb… I would not make such a broad statement unless the transfer and historical consents have been specifically checked. The ICO warns that consent originally given to another organisation cannot automatically be assumed to cover a new business.

We may share personal information with organisations that help us operate Doxy, including:

• payment providers
• ecommerce and website providers
• fulfilment warehouses
• delivery carriers
• customer-service systems
• email and marketing platforms
• analytics providers
• fraud-prevention and security providers
• accountants, lawyers and professional advisers
• government, regulatory or law-enforcement authorities where required by law.

We only provide the information reasonably required for those services.

Some providers may act as independent data controllers under their own privacy policies, particularly payment providers and delivery companies.

Doxy operates internationally and some of our service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we use appropriate legal safeguards where required, such as transfers to countries recognised as providing adequate protection or approved contractual safeguards.

You can contact us if you would like further information about the safeguards relevant to your data.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, tax, warranty, fraud-prevention and regulatory requirements.

Different information may therefore be retained for different periods.

For example:

• order and accounting information may be retained for the period required by applicable tax and accounting law
• customer-support and warranty records may be retained for as long as reasonably necessary to manage claims and maintain appropriate records
• marketing information may be retained until you unsubscribe or we determine it is no longer appropriate to retain it
• cookie consent records may be retained to demonstrate your preferences
• survey responses may be anonymised or deleted when they are no longer required for the research concerned.

Where possible, information that is no longer required in identifiable form may be anonymised rather than retained with personal identifiers.

Cookies are small files or similar technologies stored on or accessed from your device when you visit a website.

We use cookies to operate the website, remember preferences, understand website performance and, where you allow it, support analytics or marketing.

The basic UK rule is that users should be told what cookies do and why, and consent is normally required before non-essential cookies are placed.

Essential cookies are required for the website to function properly.

They may be used for:

• shopping baskets
• checkout
• account login
• website security
• fraud prevention
• remembering cookie preferences
• accessibility
• maintaining website sessions.

These cookies cannot normally be disabled through our cookie controls because the website would not function correctly without them.

With your permission, we use analytics technologies such as Google Analytics to understand how visitors use the website.

This may include information such as:

• pages viewed
• time spent on pages
• traffic source
• device and browser type
• general interaction with the website.

Analytics cookies are not activated until you provide the required consent.

Where used and where you consent, marketing technologies may help us measure advertising, understand campaign performance or show more relevant advertising.

These technologies may be operated by third-party providers and those providers may process information in accordance with their own privacy policies.

Pages may contain third-party content such as video.

Loading or interacting with embedded content may allow that provider to receive information about your device or interaction and may result in additional cookies being set.

Where consent is legally required, non-essential technologies should not load until the appropriate consent has been given.

You can accept, reject or change non-essential cookie choices through the cookie controls on our website.

You can also control cookies through your browser, although blocking essential technologies may affect how the website functions.

You can change your preferences at any time.

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal information is restricted to people and service providers who reasonably require it.

No internet-based system is completely secure, but we take reasonable steps to protect the information entrusted to us.

Depending on the circumstances and applicable law, you may have rights including:

• access to personal information we hold about you
• correction of inaccurate information
• deletion of information
• restriction of processing
• objection to certain processing
• data portability
• withdrawal of consent where processing is based on consent.

You also have an absolute right to object to the use of your personal information for direct marketing.

To exercise your rights, contact help@doxymassager.com.

We may need to verify your identity before responding.

If you have concerns about how we use your personal information, please contact us first so that we can investigate.

You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office (ICO).

Our website may contain links to websites operated by other organisations.

We do not control those websites and their own privacy policies and terms will apply.

For privacy questions or requests:

Doxy 2.0 Ltd
310 Wellingborough Road
Northampton
NN1 4EP
United Kingdom

help@doxymassager.com