Privacy policy
Last updated: 26 July 2026
Bunnys of London respects your privacy and is committed to protecting personal information entrusted to us.
This Privacy Policy explains how we collect, use, store and share personal information when you:
- visit bunnysoflondon.co.uk;
- contact our team;
- submit an enquiry or reservation request;
- subscribe to our newsletter;
- submit a review;
- apply to have a profile featured on the website; or
- otherwise interact with Bunnys of London.
This policy also explains your rights under applicable UK data-protection law.
1. Who we are
For the purposes of UK data-protection law, the data controller is:
Bunnys of London.
Correspondence address:
Berkeley Square
Mayfair
London
W1J 5BB
United Kingdom
Email: admin@bunnysoflondon.co.uk
Telephone: 07825 002242
Before publishing this policy, confirm that the legal controller name and address are accurate. If Berkeley Square is a correspondence address rather than a staffed public office, identify it as a correspondence address.
2. Scope of this policy
This policy applies to personal information processed through the Bunnys of London website and through communications with our team.
It does not govern the privacy practices of independent third-party websites, messaging platforms, payment providers or social-media services. Those organisations operate under their own privacy policies.
This website is intended only for adults aged 18 and over.
3. Personal information we may collect
Contact and enquiry information
When you contact us, we may collect:
- name or preferred name;
- email address;
- telephone number;
- messaging contact details;
- the contents of your enquiry;
- preferred contact method;
- relevant profile name or location;
- correspondence and customer-support records; and
- any other information you choose to provide.
Please do not send information that is not necessary for us to deal with your enquiry.
Reservation and transaction information
Where the website allows reservation or payment-related activity, we may collect:
- reservation details;
- requested date, time or location;
- transaction reference;
- payment status;
- billing information where required;
- refund or dispute information; and
- records required for accounting, fraud prevention or legal compliance.
Payment card information may be processed directly by an independent payment provider. Unless expressly stated otherwise, Bunnys of London does not store complete card details.
Newsletter and marketing information
If you subscribe to updates, we may collect:
- name;
- email address;
- subscription date;
- consent record;
- communication preferences;
- emails opened or links selected, where permitted; and
- unsubscribe information.
Reviews and feedback
If you submit a review or other feedback, we may collect:
- name, nickname or chosen display name;
- email address or contact details;
- relevant profile;
- review text;
- rating;
- date of submission;
- booking-verification information, where applicable;
- IP address and technical anti-spam information; and
- correspondence relating to moderation or complaints.
We may edit a review for spelling, privacy, safety or legal reasons, but we will not knowingly alter its substantive meaning.
Profile applicants and individuals featured on the website
If you apply to join Bunnys of London or have a profile featured, we may collect:
- legal and professional name;
- stage or profile name;
- date of birth;
- contact details;
- identity and age-verification documents;
- photographs and videos;
- profile biography and stated characteristics;
- preferred working areas and availability;
- rates and profile information;
- payment or bank details where required;
- communications with our team;
- contracts and consent records;
- safety, complaint or incident information; and
- other information necessary to assess, create, manage or remove a profile.
We will only collect information that is reasonably necessary for these purposes.
4. Special-category information
Some information provided for a public profile, application, complaint or safety matter may reveal special-category information. This could include information about:
- racial or ethnic origin;
- health;
- sexual orientation; or
- a person’s sex life.
Special-category information receives additional legal protection. Processing it requires both a lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9.
Where we rely on explicit consent, we will seek a clear, separate and specific statement explaining:
- the information being processed;
- the purposes for which it will be used;
- whether it will be displayed publicly; and
- how consent can be withdrawn.
Explicit consent must be affirmative, specific and capable of being withdrawn.
We may also process relevant special-category information where necessary for the establishment, exercise or defence of legal claims, or where another lawful condition applies.
Profile applicants should not provide health or other sensitive information unless it is genuinely necessary.
5. How we collect personal information
We may collect information:
Directly from you
For example, when you:
- submit a contact form;
- telephone, email or message us;
- make a reservation enquiry;
- subscribe to the newsletter;
- submit a review;
- complete an application;
- provide identity documents;
- request a correction or profile removal; or
- communicate with our team.
Automatically
Information may be collected automatically through:
- essential cookies;
- consented analytics cookies;
- security software;
- hosting and server logs;
- anti-spam systems; and
- similar website technologies.
From third parties
We may receive information from:
- payment processors;
- messaging platforms;
- analytics or security providers;
- someone authorised to contact us on your behalf;
- professional advisers;
- publicly available sources; or
- law-enforcement or regulatory bodies where appropriate.
Where information is not collected directly from you, we will provide relevant privacy information where the law requires us to do so.
6. Why we use personal information and our lawful bases
We only process personal information where we have a lawful reason.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Operating, maintaining and securing the website | Technical information, IP addresses, server and security logs | Legitimate interests in operating a secure and functional website |
| Responding to enquiries | Contact details and correspondence | Steps taken at your request before entering into an arrangement, and legitimate interests in responding to enquiries |
| Handling reservation requests | Contact and reservation information | Steps taken at your request and, where applicable, performance of a contract |
| Processing payments, refunds and financial records | Transaction and billing information | Performance of a contract and compliance with legal obligations |
| Providing customer support | Contact details, correspondence and relevant transaction information | Contractual necessity and legitimate interests |
| Managing reviews | Review content, contact and verification information | Legitimate interests in providing reliable feedback and, where appropriate, consent |
| Sending newsletters and promotional updates | Name, email address and marketing preferences | Consent |
| Managing applications and profiles | Identity, contact, application, contract and profile information | Steps before entering into a contract, performance of a contract, legal obligations and legitimate interests |
| Publishing sensitive profile information | Profile and special-category information | Explicit consent, alongside an appropriate Article 6 lawful basis |
| Preventing abuse, fraud and security incidents | Technical, contact and transaction information | Legitimate interests and, where applicable, legal obligations |
| Handling complaints, disputes and legal claims | Relevant correspondence, profile, transaction and incident information | Legitimate interests, legal obligations and the establishment, exercise or defence of legal claims |
| Improving the website | Consented analytics and usage information | Consent for non-essential technologies and legitimate interests in service improvement |
| Complying with authorities and court orders | Information relevant to the lawful request | Legal obligation or legitimate interests, as applicable |
Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against the individual’s rights and reasonable expectations.
7. Cookies and similar technologies
The website may use cookies and similar technologies for:
- essential website functions;
- security and fraud prevention;
- remembering privacy choices;
- analytics and performance;
- embedded media;
- communications features; and
- other optional functions.
Strictly necessary technologies may operate without consent where legally permitted. Optional cookies and trackers will only be used after an appropriate choice has been made through the cookie banner.
UK cookie rules are principally governed by the Privacy and Electronic Communications Regulations 2003, as amended. The ICO requires clear information about storage and access technologies and appropriate consent where an exemption does not apply.
You should be able to:
- accept optional cookies;
- reject optional cookies;
- choose individual categories; and
- change or withdraw your choice later.
A separate Cookie Policy should identify the cookies and technologies actually used, their providers, purposes and durations.
8. Email newsletters and direct marketing
We will only send newsletter or promotional emails where we have a lawful basis to do so.
When relying on consent:
- subscription must be optional;
- consent must be given through a clear affirmative action;
- marketing consent must not be bundled with unrelated terms; and
- every marketing email must include an unsubscribe facility.
You can withdraw marketing consent at any time. We may retain a minimal suppression record to ensure that we honour your request and do not add the same address back to the mailing list accidentally.
Withdrawing marketing consent will not affect service-related communications that are genuinely necessary to respond to an enquiry or administer an existing arrangement.
9. Who we may share information with
We may share personal information, where necessary, with:
- website hosting and technical-support providers;
- cloud-storage and backup providers;
- email, contact-form and communications providers;
- payment processors;
- fraud-prevention and security providers;
- analytics and cookie-consent providers;
- accountants, insurers, legal advisers and other professional advisers;
- contractors acting under appropriate confidentiality obligations;
- courts, regulators, tax authorities or law-enforcement agencies;
- a purchaser or successor in connection with a genuine sale, restructure or transfer of the business; and
- other parties where you have instructed or authorised us to share information.
Service providers are only permitted to process information for agreed purposes and must protect it appropriately.
We do not sell personal information to advertisers or data brokers.
10. WhatsApp, Telegram and other third-party platforms
If you contact us using WhatsApp, Telegram or another external platform, that provider may independently process information such as:
- your telephone number or username;
- message content;
- device information;
- IP address; and
- communications metadata.
Your use of those platforms is also governed by the provider’s own privacy policy and settings. Avoid sending identity documents, payment details or other sensitive information through an external messaging service unless specifically requested and an appropriate secure process has been agreed.
11. International transfers
Some service providers may process information outside the United Kingdom.
Where personal information is transferred internationally, we will take appropriate steps to protect it. Depending on the destination and provider, these may include:
- a UK adequacy regulation;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved contractual clauses; or
- another legally recognised safeguard.
You may contact us for further information about the safeguards relevant to your information.
12. How long we retain information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, tax, accounting and dispute-resolution requirements.
Our standard retention periods are:
| Record | Standard retention period |
|---|---|
| General website enquiries | Up to 12 months after the enquiry is resolved |
| Reservation and customer-support records | Up to 24 months after the last interaction, unless needed for a dispute or legal obligation |
| Financial and accounting records | Up to 6 years, or longer where legally required |
| Newsletter information | Until consent is withdrawn or the subscription becomes inactive under our retention procedure |
| Suppression records | For as long as reasonably necessary to honour an unsubscribe request |
| Reviews and moderation records | While the review is published and normally up to 24 months after removal |
| Unsuccessful profile applications | Normally up to 6 months after the application decision |
| Active profile and contractual records | For the duration of the relationship and afterwards where required for legal, tax or contractual purposes |
| Identity and age-verification records | Only for as long as required for verification, safety, legal or contractual purposes |
| Security and server logs | Normally between 30 days and 12 months, depending on the purpose and risk |
| Cookie and analytics information | According to the duration shown in the Cookie Policy and consent tool |
HMRC requirements can require certain business and VAT records to be retained for six years.
We may retain information for longer where:
- required by law;
- needed for an ongoing complaint or legal claim;
- necessary to prevent fraud or protect safety; or
- a relevant authority requires preservation.
When information is no longer needed, it will be deleted, anonymised or securely destroyed.
13. How we protect personal information
We use reasonable technical and organisational safeguards appropriate to the nature of the information and the risks involved.
These may include:
- encrypted website connections;
- access controls;
- strong authentication;
- restricted administrative access;
- software updates and security monitoring;
- backups;
- malware and intrusion protection;
- staff or contractor confidentiality requirements;
- data-minimisation procedures; and
- incident-management processes.
No online system is completely secure. You should use care when sending information online and avoid including unnecessary sensitive details in messages.
To report a suspected privacy or security issue, email:
14. Your data-protection rights
Depending on the circumstances, you may have the right to:
- be informed about how your information is used;
- request access to personal information held about you;
- ask us to correct inaccurate or incomplete information;
- request deletion of information;
- request restriction of processing;
- receive certain information in a portable format;
- object to processing based on legitimate interests;
- object to direct marketing at any time;
- withdraw consent where processing is based on consent; and
- raise concerns about automated decision-making.
These rights are not absolute and may be subject to legal exemptions.
We normally must respond to a valid rights request within one calendar month. Complex requests may permit an extension in accordance with the law.
To exercise a right, email:
We may request proportionate information to confirm your identity before acting on a request.
Withdrawing consent does not make processing carried out before withdrawal unlawful.
15. Profile correction, removal and withdrawal of consent
An individual featured on the website may contact us to request:
- correction of inaccurate profile information;
- updating of photographs, availability or location;
- removal of profile content;
- withdrawal of consent for specified sensitive information;
- correction or removal of an associated review where there is a valid reason; or
- information about how their profile data is being used.
We will assess the request promptly and explain any information we must retain for legal, contractual, accounting, safety or dispute-resolution reasons.
Where consent for public profile information is validly withdrawn, we will stop the relevant consent-based processing unless another lawful basis and Article 9 condition applies.
16. Information about other people
Do not provide personal information about another person unless:
- you have their authority;
- it is necessary and lawful to do so; and
- they understand how their information will be used.
Reviews must not contain private contact details, confidential communications, defamatory allegations or unnecessary sensitive information about another person.
17. Children
The website and its services are intended only for adults aged 18 and over.
We do not knowingly collect information from children. If you believe that a person under 18 has provided personal information through the website, contact us immediately so the matter can be investigated and appropriate action taken.
18. Automated decision-making
We do not currently use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects.
If this changes, this policy will be updated and affected individuals will be provided with the information and safeguards required by law.
19. External links
The website may contain links to websites operated by other organisations.
We are not responsible for the privacy, security or content of an independent third-party website. You should review its privacy information before providing personal details.
20. Complaints
Please contact us first if you have concerns about how we have handled your personal information:
Email: admin@bunnysoflondon.co.uk
Telephone: 07825 002242
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
The ICO recommends that UK privacy notices explain the right to complain and identify the ICO as the relevant supervisory authority.
21. Changes to this Privacy Policy
We may update this Privacy Policy where:
- our services or data practices change;
- service providers change;
- the website introduces new functionality;
- legal requirements or regulatory guidance change; or
- clarification is required.
The updated version will be published on this page with a revised “Last updated” date.
Where a change materially affects how personal information is used, we will take reasonable steps to bring it to the attention of affected individuals.
22. Contact us
Questions about this policy or the handling of personal information should be sent to:
Bunnys of London
Berkeley Square
Mayfair
London
W1J 5BB
United Kingdom
Email: admin@bunnysoflondon.co.uk
Telephone: 07825 002242
22. Contact us
Questions about this policy or the handling of personal information should be sent to:
Bunnys of London
Berkeley Square
Mayfair
London
W1J 5BB
United Kingdom
Email: admin@bunnysoflondon.co.uk
Telephone: 07825 002242