Privacy Policy

Corporate website, enquiries and business communications

Version: 3.0 Last Updated: 5^th Aug 2026

This Website Privacy Policy explains how Bodi Me Ltd collects, uses, shares, stores and protects personal data when you visit https://bodi.me, contact us, request information or a demonstration, subscribe to communications, attend an event or otherwise interact with us through the corporate website.

This policy applies only to the Bodi.Me corporate website and Bodi.Me’s own website and business-contact processing. A separate Size-Me Privacy Policy applies when Size-Me, a client portal, an integration, a pilot or an approved measurement service processes wearer or participant data.

You do not need to accept this policy as a contract. It is a transparency notice. Where consent is required, for example for certain cookies or marketing communications, we request it separately and provide a way to withdraw it.

Privacy at a glance

• The corporate website collects ordinary contact, professional, enquiry, marketing and technical information.
• Ordinary website forms do not collect Size-Me wearer data, body measurements, photographs, body scans or biometric information.
• We use personal data to operate and secure the website, respond to enquiries and demo requests, manage business communications and improve the website.
• We do not sell website personal information for money and do not use it for cross-context behavioural advertising.
• Cookie choices are available through Cookie Settings. Non-essential technologies are used only where permitted by applicable law.
• Privacy requests and complaints may be sent to info@bodi.me.

1. Who we are

Bodi Me Ltd is a company registered in England and Wales under company number 08659835. Our registered office is WeWork c/o, 30 Churchill Place, 1st–10th Floors, London E14 5RE, United Kingdom.

Website: https://bodi.me

Privacy contact: info@bodi.me, for the attention of the Privacy Lead.

For the processing described in this policy, Bodi Me Ltd is generally the controller, meaning that we decide why and how the personal data is used.

2. Scope of this policy

This policy covers personal data processed in connection with:

• the Bodi.Me corporate website and its contact or demo forms;
• sales, demonstration, partnership and general enquiries submitted through the website;
• newsletters, event invitations, surveys, feedback and other business communications;
• website analytics, security, support and legal compliance; and
• the administration of a business contact created through a website interaction.

This policy does not govern Size-Me wearer data, client portals, client-controlled uniform or retail programmes, 3D body-scanning services, recruitment, employee records or a separate research project. Those activities require their own privacy information where applicable.

The website may link to third-party websites or include third-party content. Those organisations are responsible for their own processing and privacy notices.

3. Personal data we collect through the website

Depending on how you interact with us, we may collect the following categories of personal data:

Category	Examples	Main purpose
Identity and contact	Name, business email address, telephone number, postal address where supplied, and communication preferences.	Respond to enquiries, arrange demonstrations and communicate with you.
Professional	Employer, job title, department, industry, country and professional interests.	Understand your enquiry, configure a relevant demonstration and manage business communications.
Enquiry and relationship	Messages, demo requests, meeting notes, requested services, correspondence, proposals and support records.	Respond, follow up, take pre-contract steps and maintain an accurate relationship record.
Marketing and event	Subscriptions, event attendance, campaign interactions, survey responses and records of consent, objection or unsubscribe.	Manage permitted communications, events and preferences.
Technical and usage	IP address, browser, device, operating system, language, time zone, approximate location, cookie identifiers, referral source, pages viewed, session data, logs and security events.	Operate, secure, analyse and improve the website.
Other information you provide	Information voluntarily included in a message or attachment.	Deal with the purpose for which you supplied it.

Please do not submit health information, biometric information, identity documents, payment-card data or other highly sensitive information through a general website form unless we specifically request it and provide an appropriate secure method and privacy notice.

Required fields are identified on the relevant form. If you do not provide information required to respond to an enquiry or arrange a demonstration, we may be unable to deal with the request.

4. How we obtain personal data

We may obtain personal data:

• directly from you through a website form, email, telephone call, video meeting, event or survey;
• automatically from your device through website logs, cookies and similar technologies;
• from your employer, organisation, colleague, adviser or another person who introduces you to us;
• from public professional sources and company websites; and
• from service providers supporting our website, communications, analytics, security or business operations.

Where we obtain your personal data from another source, we provide the required privacy information within the period required by applicable law, normally at the first communication or within one month, unless an exception applies.

5. How we use personal data and our lawful bases

We process personal data only for specified purposes and where an applicable lawful basis is available. The basis depends on the activity and the law that applies.

Activity	Personal data and purpose	UK/EU lawful basis
Website operation and security	Technical, usage and cookie information used to deliver the website, diagnose faults, prevent misuse and maintain security.	Legitimate interests in operating and protecting the website; legal obligations where applicable; consent for storage or access technologies where required.
Enquiries and demo requests	Contact, professional and enquiry information used to respond, arrange a demonstration and understand requirements.	Steps at your request before a possible contract; legitimate interests in responding to business enquiries.
Business communications and relationships	Contact, professional, correspondence and relevant transaction records used to communicate and administer a relationship arising from the enquiry.	Contract or pre-contract steps; legitimate interests in managing business relationships; legal obligations.
Marketing, newsletters and events	Contact, professional, preference and interaction information used for relevant news, invitations, subscriptions and campaign measurement.	Consent where required; otherwise legitimate interests in relevant business-to-business marketing, subject to your right to object.
Analytics and improvement	Usage, technical, survey and feedback information used to understand performance and improve content and services.	Consent for non-essential technologies where required; legitimate interests for aggregate analysis and improvement where permitted.
Legal, compliance and corporate matters	Relevant records used for compliance, complaints, claims, audits, insurance, due diligence and corporate transactions.	Legal obligations; legitimate interests in protecting and managing the business.

Where we rely on legitimate interests, those interests are balanced against your rights and reasonable expectations. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place lawfully before withdrawal.

We do not use personal data collected through the corporate website to make solely automated decisions that produce legal or similarly significant effects.

6. Cookies and similar technologies

The website may use cookies, pixels, local storage, tags and similar storage or access technologies. These may include:

• strictly necessary technologies for security, network management, accessibility, consent management and core functions;
• preference or functionality technologies that remember settings;
• analytics and performance technologies that help us understand website use and performance; and
• marketing, social-media or embedded-content technologies, where enabled and identified.

Cookie Settings or a separate Cookie Policy should identify the technologies currently in use, their providers, purposes and durations. In the UK and EEA, we obtain consent before using technologies where consent is required. We do not treat continued browsing as consent. Where a statutory exemption permits a limited-risk technology without consent, we still provide the information and controls required by law.

You can accept, reject or change non-essential choices through Cookie Settings. Withdrawing consent does not affect processing that occurred before withdrawal. Browser controls may also block technologies, although parts of the website may not function as intended.

7. Marketing communications

We may send relevant business communications where you requested them, consented to them or applicable law otherwise permits us to do so. We identify Bodi.Me in marketing messages and provide a practical unsubscribe or objection method.

You may object to direct marketing at any time by using the unsubscribe link or emailing info@bodi.me. We will stop using your personal data for direct marketing, although we may retain limited suppression information to respect your choice.

8. When we share personal data

We share personal data only where reasonably necessary with:

• website hosting, content-delivery, security, form, CRM, email, calendar, analytics, communications and IT service providers;
• professional advisers, including lawyers, accountants, auditors, insurers and consultants;
• a customer, supplier or technology partner where necessary to respond to your request and you would reasonably expect the disclosure;
• a prospective buyer, investor, lender or adviser in connection with a financing, restructuring, merger, acquisition or sale, subject to appropriate safeguards;
• regulators, courts, law-enforcement bodies and public authorities where required by law or necessary to protect legal rights; and
• other recipients where you direct us or give valid consent.

Service providers are required by contract and applicable law to protect personal data and use it only for authorised purposes. We do not sell website personal data for monetary consideration.

9. International transfers

Bodi.Me is established in the United Kingdom. Some website, communications, analytics, security or business-support providers may process personal data in the United Kingdom, the EEA, the United States or another country.

Where international-transfer restrictions apply, we use an applicable adequacy regulation or decision, European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful safeguard, together with supplementary measures where appropriate.

You may contact us for further information about safeguards relevant to your personal data, subject to necessary confidentiality and security restrictions.

10. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, accounting, security and dispute-management requirements.

Record category	General retention period or criterion
Website and demo enquiries	Normally up to 24 months after the last meaningful interaction, unless the enquiry becomes a business relationship or a longer period is needed for support, security, legal claims or another lawful reason.
Marketing subscriptions and preferences	Until you unsubscribe or object, or normally after up to 24 months without meaningful engagement. Limited suppression records may be retained to honour your choice.
Cookie and analytics information	For the period stated in Cookie Settings or the Cookie Policy and no longer than reasonably necessary for the relevant purpose.
Website, server and security logs	Normally up to 24 months, unless needed for an investigation, security incident, fraud prevention, legal claim or legal requirement.
Business records arising from an enquiry	If an enquiry becomes a customer, supplier or contractual relationship, relevant records are retained under the applicable contract and business-record schedule, generally for the period required for contractual, accounting, tax, audit and claims purposes.
Rights requests and complaints	For as long as reasonably necessary to respond, demonstrate compliance and manage any related claim or regulatory matter.
Backups	May remain in restricted backups until overwritten under the applicable backup cycle and are not used for ordinary operational purposes.

When personal data is no longer required, we delete it, securely dispose of it or irreversibly anonymise it so that it can no longer reasonably be linked to an individual.

11. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Depending on the risk, measures may include encryption in transit and, where appropriate, at rest; access controls and authentication; logging and monitoring; backups and recovery; vulnerability management; supplier controls; and staff confidentiality and security training.

No website or transmission method can be guaranteed to be completely secure. Please avoid sending confidential or sensitive information through an unencrypted channel unless we have agreed an appropriate method.

12. Your UK and EEA data-protection rights

Subject to applicable conditions and exemptions, you may have the right to:

• be informed about how your personal data is used;
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain personal data in a portable format;
• withdraw consent where processing relies on consent; and
• complain to a competent data-protection authority.

To exercise a right or make a privacy complaint, email info@bodi.me. We may request information reasonably necessary to verify your identity and locate the relevant records. We respond within the period required by applicable law and explain any lawful refusal or extension.

Under the UK data-protection complaints procedure, we provide an electronic method for raising a complaint, acknowledge the complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.

United Kingdom residents may complain to the Information Commissioner’s Office. EEA residents may complain to the data-protection authority where they live or work, or where the alleged infringement occurred.

Where Article 27 of the EU GDPR requires Bodi.Me to appoint an EU representative for the relevant processing, the representative’s contact details will be made available in this policy or through the relevant website notice.

13. Additional information for California residents

This section supplements the rest of the policy for California residents. The California Online Privacy Protection Act applies to commercial websites that collect specified personally identifiable information from California consumers. The CCPA provisions below apply only where Bodi.Me qualifies as a “business” for the relevant processing.

13.1 California online privacy disclosures

The categories of information collected through the website and the categories of third parties with whom it may be shared are described in sections 3 and 8. You may request access to or correction of information by emailing info@bodi.me. Material changes are described by updating the “Last updated” date and, where appropriate, by an additional website or direct notice.

Legacy “Do Not Track” signals: because there is no uniform technical standard for legacy browser Do Not Track signals, the website does not currently respond to those signals. Where applicable law requires us to recognise a valid opt-out preference signal, including Global Privacy Control, we will process the signal as required.

Third-party tracking: analytics, social-media or embedded-content providers may collect information about online activity over time and across websites when their technologies are enabled. The current providers, purposes and available choices should be identified in Cookie Settings or the Cookie Policy.

13.2 California categories and purposes

During the preceding 12 months, the website may have collected and disclosed the following categories for the business purposes described below:

California category	Examples and sources	Purpose and recipient categories	Sold or shared
Identifiers	Name, email, telephone number, IP address and online identifiers; from you, your organisation and website technologies.	Enquiries, communications, security and administration; disclosed to hosting, CRM, email, security and professional-service providers.	Not sold. Not shared for cross-context behavioural advertising.
Professional or employment-related information	Employer, job title, department, industry and professional interests; from you, your organisation or public professional sources.	Demos, business communications and relationship administration; disclosed to service providers and relevant business partners.	Not sold or shared for cross-context behavioural advertising.
Internet or electronic activity	Browsing, referral source, browser, device, cookie, interaction and log data; from website technologies.	Website operation, analytics, security and campaign measurement; disclosed to hosting, analytics and security providers.	Not sold. Any legally regulated tracking choice is provided through Cookie Settings.
Approximate geolocation	Country, region or approximate location inferred from IP address.	Localisation, analytics, security and compliance; disclosed to technical service providers.	Not sold or shared for cross-context behavioural advertising.
Commercial or enquiry information	Services considered, demo requests, messages and relationship history; from you and our records.	Respond to requests and administer a possible relationship; disclosed to service providers and advisers.	Not sold or shared for cross-context behavioural advertising.
Preferences and inferences	Communication preferences, survey feedback and inferred business interests based on interactions.	Relevant communications and service improvement; disclosed to communications and analytics providers.	Not sold or shared for cross-context behavioural advertising.

We do not intentionally collect sensitive personal information through ordinary corporate website forms. Please do not submit sensitive information unless we specifically request it through an appropriate secure process.

13.3 California rights where the CCPA applies

Where the CCPA applies to Bodi.Me for a particular activity, California residents may have rights to know and access personal information, correct inaccuracies, request deletion, opt out of sale or sharing, limit certain uses of sensitive personal information, use an authorised agent and receive equal service and pricing when exercising a right, subject to statutory exceptions.

Submit a California privacy request by emailing info@bodi.me with the subject “California Privacy Request”. We may verify identity and authority using information reasonably related to the request. If the CCPA requires an additional designated request method for the relevant activity, that method will be provided in the website notice or request form.

Bodi.Me does not sell website personal information for money. We do not use website personal information for cross-context behavioural advertising. If these practices change, we will update this policy and provide the legally required notice, opt-out link and preference-signal handling before the change takes effect.

14. Children

The corporate website is intended for business users and is not directed to children under 16. We do not knowingly collect personal data through the corporate website from children under 16. If you believe that a child has provided information through the website, contact info@bodi.me so that we can review and take appropriate action.

15. Third-party websites and embedded content

The website may link to or display content from third-party websites and platforms. Those organisations control their own processing. We recommend reviewing their privacy information before providing personal data or enabling external content. Bodi.Me is not responsible for the privacy practices of an independent third party.

16. Contacting us and making a complaint

Bodi Me Ltd, WeWork c/o, 30 Churchill Place, 1st–10th Floors, London E14 5RE, United Kingdom. Company number: 08659835.

Privacy contact: info@bodi.me, for the attention of the Privacy Lead.

We operate an internal privacy-complaint process. We acknowledge a data-protection complaint within 30 days, investigate it appropriately and communicate the outcome in accordance with applicable law. You retain the right to contact a regulator at any time.

Changes to this policy. We review this Website Privacy Policy at least once every 12 months and whenever our website, suppliers, business practices or legal obligations materially change. The current version will show the revised date, and material changes will be communicated where required before a new or incompatible use begins.