Privacy Policy

1. Who we are

This Privacy Policy explains how DD Brands Ltd, trading as Duck & Dry (company number 13016235, registered office 33 North Audley Street, London W1K 6ZQ) (“Duck & Dry”, “we”, “us” or “our”) collects, uses, shares and protects your personal data when you visit our salons, use our website at duckanddry.com or our mobile application (together, the “Site”), or otherwise interact with us. It also explains your rights and how to exercise them.

DD Brands Ltd is the data controller of your personal data. This policy also covers processing carried out on our behalf in connection with our affiliates and franchisees where we act as controller.

2. How to contact us

If you have any questions about this policy, your personal data or your rights, you can contact us on:

•   By email: info@duckadndry.com

•   By post: Data Protection Contact, DD Brands Ltd, 33 North Audley Street, London W1K 6ZQ

•   By phone: 020 3983 1441

3. The personal data we collect

We collect personal data that you provide to us when you visit a Duck & Dry salon, speak to us over the phone or in person, or interact with us digitally through online forms, the App, the online customer portal, email or SMS. This includes:

•   Identity data – your name and date of birth

•   Contact data – your address, email address and phone number

•   Booking and transaction data – your appointment history, treatment preferences and payment details

•   Communications data – records of your correspondence with us, including enquiries and feedback

•   Technical data – information about the device and browser you use to access the Site, your IP address, and how you use the Site (collected through cookies and similar technologies – see section 8)

We do not intentionally collect more personal data than we need for the purposes described in this policy.

4. How we use your personal data and our lawful bases

We only use your personal data where we have a lawful basis to do so under UK data protection law (the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025). The table below sets out the purposes for which we process your personal data and the lawful basis we rely on for each.

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and concluded that our processing does not unfairly affect you. You can ask us for details of these assessments, and you have the right to object at any time (see section 11). We may process your personal data under more than one lawful basis where it is used for more than one purpose – contact us if you would like details of the specific basis we rely on for a particular processing activity.

If you choose not to provide personal data that we need to perform a contract with you (for example, to manage your booking), we may not be able to provide that service.

5. Marketing

We may send you marketing about our own services, products and offers by email and SMS where you have consented, or where you are an existing customer and have not opted out. Every marketing message we send includes a simple way to unsubscribe, and you can also opt out at any time by contacting us (see section 2). Opting out of marketing will not affect messages we need to send you about your bookings.

We will not share your personal data with third parties for their own marketing purposes unless you have given us your prior consent. Where we use advertising and social media platforms (such as Meta (Facebook and Instagram) and Google ) to deliver or measure our marketing, this is described in section 8 (Cookies) and section 7 (Who we share your data with).

6. Children

Our services, website and App are designed for adults and we do not knowingly collect personal data from children under 13. Where a person under 18 receives a treatment in one of our salons, we collect the booking information from, and communicate with, their parent or guardian. In line with our obligations under the Data (Use and Access) Act 2025, where our online services are likely to be accessed by children we take account of children's higher protection needs, including their age, their ability to understand how their data is used, and their particular vulnerabilities. We do not send direct marketing to anyone we know to be under 18.

7. Who we share your data with

We will not sell, rent or lease your personal data. We share it only as described below.

Within our group

We may share your personal data with our group companies, affiliates, subsidiaries and franchisees where necessary to provide the services you have requested from us.

Service providers

We share personal data with third-party service providers who help us run our business, including hosting providers, booking and payment platforms, email service providers and SMS providers. They are bound by contractual security and confidentiality obligations and may only process your personal data on our instructions and for the specified purposes.

Advertising and analytics partners

With your consent, we use advertising and analytics tools provided by companies such as Google and Meta to measure the effectiveness of our marketing and deliver relevant advertising. See section 8 for how to manage these preferences.

Legal and business reasons

We may also disclose your personal data where we reasonably believe it is necessary to comply with a legal or regulatory obligation; to enforce our terms and conditions or other agreements with you; to protect the rights, property or safety of Duck & Dry, our staff, our customers or others; to protect someone's vital interests; or, in the event of a sale, merger, acquisition or other business transfer, to the prospective seller or buyer of the relevant business or assets.

Links to other websites

Our Site may link to third-party websites. We are not responsible for their privacy practices and encourage you to read their privacy policies before providing them with any information.

8. Cookies and similar technologies

Our website and App use cookies and similar technologies. Strictly necessary cookies are used to make the Site work and keep it secure. Analytics and advertising cookies (including pixels from providers such as Google and Meta) are only set with your consent, which you can give, refuse or withdraw at any time through the cookie banner or your cookie settings on the Site. For full details of the cookies we use and how long they last, please see our Cookie Policy at [link placeholder].

9. International transfers

Some of our service providers and advertising partners are located outside the UK, including in the United States. Where we transfer your personal data outside the UK, we ensure a similar degree of protection by transferring it only to countries covered by UK adequacy regulations (including the UK-US Data Bridge where the recipient is certified), or by using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for further details of the safeguards we use.

10. How long we keep your data

We keep your personal data only for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements. As a guide:

•   Customer account, booking and treatment records: 3 years after your last appointment or interaction with us

•   Transaction and payment records: 6 years after the end of the relevant financial year, as required by UK tax law

•   Marketing preferences and consents: for as long as you remain subscribed, plus a record of your opt-out

•   Customer service correspondence: 2 years from resolution of your enquiry

In determining retention periods, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes of processing and applicable legal requirements. When your data is no longer needed, we securely delete or anonymise it.

11. Your rights

Subject to certain limitations, you have the following rights under UK data protection law. Exercising them is free of charge, and we will respond within one month (we will let you know if a complex request will take longer):

•   Access – request a copy of the personal data we hold about you (a “data subject access request”)

•   Correction – ask us to correct incomplete or inaccurate data

•   Erasure – ask us to delete your data where there is no good reason for us to continue processing it

•   Restriction – ask us to suspend processing in certain circumstances, for example while we verify the accuracy of your data

•   Portability – receive your data in a structured, commonly used, machine-readable format, or have it transmitted to a third party, where processing is based on consent or contract and carried out by automated means

•   Objection – object to processing based on our legitimate interests, and to direct marketing at any time (we will always stop processing for direct marketing when you object)

•   Withdraw consent – where we rely on your consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal

We may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive. To exercise any of these rights, contact us using the details in section 2. We may need to request specific information from you to confirm your identity before acting on a request – this is a security measure to ensure personal data is not disclosed to someone who has no right to receive it.

12. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. If this changes, we will update this policy and put in place the safeguards required by law, including telling you about such decisions and giving you the right to make representations, obtain human intervention and contest the decision.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us using the details in section 2.  We will acknowledge your complaint within 30 days and respond without undue delay.

14. Security

The security of your personal data is important to us. We use appropriate technical and organisational measures to protect it during transmission and once received, including encryption where appropriate, access controls and industry-standard processes for detecting and responding to attempted breaches. While no method of transmission or storage over the internet is completely secure, we work to protect your data in line with applicable law and good industry practice. Please protect your own account by keeping your username and password confidential and choosing a secure password.

15. Changes to this policy

We keep this Privacy Policy under regular review and will only use your personal data for the purposes we collected it for, unless we reasonably consider that we need to use it for a compatible reason. If we make material changes to this policy, or need to use your data for an unrelated purpose, we will notify you (for example by email) and explain the legal basis that allows it. The date of the latest version is shown at the top of this policy.