Privacy Policy

Last Updated: 29 January 2026

BODIES (“we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (https://dna.bodiesclo.com) and use our services, including our NFC event management system.

1. IDENTITY OF THE DATA CONTROLLER

BODIES is the data controller responsible for your personal data.

Trading as: BODIES

Company Name: BODIES CLO LTD (Company No. 14309248)

Registered Address: 84 Vaughan Way, Leicester, LE1 4SH, United Kingdom

Email: [email protected]

Data Protection Inquiries: For any questions regarding this policy or to exercise your data rights, please contact us at the email address above.

2. THE DATA WE COLLECT

We collect and process personal data in two main categories:

• Order & Identity Data: When you make a purchase or register an account, we collect your name, billing address, shipping address, payment information (processed via secure third-party gateways), email address, and phone number.
• Technical & Usage Data: We automatically collect your IP address, browser type, time zone, and information about how you interact with our site via cookies, log files, and web beacons.

3. LAWFUL BASIS FOR PROCESSING

Under the UK GDPR, we must have a “lawful basis” to process your data. We rely on the following:

• Performance of a Contract: We process your Identity and Order Data to fulfill orders, process payments, and deliver products/services.
• Legitimate Interests: We process Technical Data to improve our website, prevent fraud, and optimise our marketing efforts.
• Consent: We rely on your explicit consent for non-essential cookies and for sending marketing communications (which you can withdraw at any time).
• Legal Obligation: We may process data to comply with tax, accounting, or law enforcement requirements.

4. DATA RETENTION PERIODS

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for:

• Order Information: We retain this for a period of up to 6 years following the end of the financial year in which the transaction occurred to comply with UK tax and accounting laws.
• Marketing Data: We keep your contact information until you opt-out or unsubscribe.
• Technical Data: Analytics data is generally anonymized or deleted after 26 months.

5. YOUR DATA SUBJECT RIGHTS

If you are a resident of the UK or the European Economic Area (EEA), you have the following rights:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): You can ask us to delete your data where there is no good reason for us to continue processing it.
• Right to Restrict Processing: You can ask us to suspend the processing of your data.
• Right to Data Portability: You can request the transfer of your data to you or a third party in a structured format.
• Right to Object: You can object to our processing of data where we are relying on a legitimate interest.
• To exercise any of these rights, please contact us at [email protected].

6. THIRD-PARTY DATA TRANSFERS

We share your information with trusted third parties to help us operate:

Service Providers: We use Hostinger for web hosting and Google Analytics for site optimisation.

International Transfers: Your data may be transferred to and processed in countries outside the UK/EEA (such as the USA). We ensure these transfers are protected by standard contractual clauses or adequacy decisions to ensure your data remains protected.

7. COOKIE CONSENT

Our website uses cookies. You have the right to refuse non-essential cookies via our Cookie Banner. For detailed information on the cookies we use, please see our Cookie Policy.

8. CHILDREN’S PRIVACY

Our services are not intended for individuals under the age of 13. We do not knowingly collect data from children. If we discover we have collected data from a child under 13, we will delete it immediately.

9. HOW TO COMPLAIN

If you are unhappy with how we use your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• ICO Website: https://www.ico.org.uk
• Organisation name: Bodies Clo Ltd
• Reference: ZB546130

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. ADDENDUM: NFC & GEOLOCATION DATA

10.1 Introduction to the BODIES Event System

Our website and mobile application utilise secure Near Field Communication (NFC) technology and proprietary cryptographic verification to track event attendance, manage staff, and prevent counterfeiting. When an BODIES is scanned using our web-based scanner, we collect specific technical and personal data to create a secure audit trail.

10.2 Data Collected During an NFC Scan

When an authorised Event Manager scans an attendee’s BODIES, our system securely collects and stores the following information:

• Hardware & Cryptographic Data: The physical UID (serial number) of the NFC tag and its encrypted payload to verify authenticity.
• Identity Data: The resolved Ultimate Member display name and profile URL of the Attendee (the person wearing the tag) and the Event Manager (the authorised user performing the scan).
• Event Data: The custom name of the event, date, and exact timestamp of the scan.
• Geolocation Data: The precise GPS coordinates (Latitude and Longitude) of the device performing the scan at the exact moment the tag is recorded.

10.3 Geolocation Consent and Processing

Precise location data is collected to verify where a scan took place, ensuring physical presence at an event and preventing fraudulent check-ins.

For Event Managers/Scanners: Location data is only captured if you explicitly grant your web browser permission to access your device’s GPS when initiating the “RECORD BODIES” function. If you deny this permission, the scan will proceed, but the location data will not be recorded.

For Attendees: By tapping your BODIES to an authorised scanner, you acknowledge that the time, date, and location of that physical interaction are being recorded by the Event Manager.

10.4 Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), our lawful bases for processing this data include:

• Consent: Obtained from the Event Manager via device-level browser prompts prior to accessing GPS hardware.
• Legitimate Interests: To provide event organisers with accurate attendance metrics, secure physical premises, and maintain cryptographic proof against cloned or counterfeit tags.

10.5 Data Sharing and Third-Party Access

Attendance data—including attendee names, timestamps, and physical locations—is compiled into secure CSV reports. These reports are accessible strictly to the authorised Event Managers who conducted the scans or authorised system administrators. Event Managers who download these CSVs act as independent Data Controllers for that downloaded data and are subject to their own UK GDPR compliance obligations.

10.6 Data Retention and Security

We do not hold attendance data indefinitely. Event tracking data is stored securely in our encrypted database using strict role-based access controls. Authorized administrators have the ability to permanently purge event data from our active databases using our custom “Delete Event Data” protocol once the data is no longer necessary for audit or reporting purposes.

10.7 Your Rights (Right to Erasure)

Under UK GDPR, both Attendees and Event Managers have the right to request access to, correction of, or the permanent deletion of their attendance and location records. If you wish to exercise your “Right to be Forgotten” and have your scan history permanently removed from the BODIES database, please contact us at [email protected]

Payments with stripe:

1. Payment Processing and Financial Data

We use Stripe as our third-party payment processor to facilitate tipping transactions between users. Tippers: When you send a tip, your payment card information is collected and processed directly by Stripe. BODIES does not see, collect, or store your credit card numbers, CVVs, or full payment details on our servers. Recipients: When you connect a Stripe account to receive tips, you are providing your personal and financial identity information directly to Stripe for verification and payout purposes.

2. Data We Collect and Store

To facilitate the tipping service, we collect and store limited metadata: Stripe Account ID: We store the unique Stripe identifier (e.g., acct_…) for users who have connected their accounts to route payments correctly. Transaction Metadata: We may record the date, time, and amount of tips for the purpose of providing transaction history to our users and for platform fee auditing.

3. Data Sharing with Third Parties

To provide the tipping service, we share certain information with Stripe: When you click “Connect with Stripe,” we share your BODIES identity and email address with Stripe to initiate their secure OAuth onboarding flow. Payment information is shared with Stripe to process transactions, calculate tiered platform fees, and distribute funds. For more information on how Stripe handles your data, please refer to the Stripe Privacy Policy.

4. International Data Transfers

Payment processing via Stripe may involve the transfer of your data to servers located outside of the UK or the European Economic Area (EEA). Stripe maintains high-level security standards and legal frameworks to protect your data during these transfers.