At a glance
1. Who we are
BlueClick Media operates dormy.ai and sends the emails you subscribe to here. Under data-protection law we are the controller of your personal data: we decide why and how it is used, and we are responsible for protecting it.
- Controller
- BlueClick Media
- Postal address
- 22 Sandbourne
Dartmouth Close
London W11 1DS
England - Privacy contact
- privacy@dormy.ai
Some companies help us run our service (for example, the providers of our servers). They act as our processors: they may only use your data on our written instructions and must keep it secure. Advertisers whose offers appear in our emails are not given your data — see section 4.
2. What we collect and why
| Data | When | Why we need it |
|---|---|---|
| Email address | You subscribe or ask for a preferences link | To send you the emails you asked for, and the confirmation and preference links. |
| Topics you choose | You subscribe or change your preferences | To send you only those topics. |
| Date and time, IP address and browser (user agent) of your sign-up and of your confirmation click | You subscribe and confirm | A record of your consent, so we can prove you agreed (double opt-in). |
| Preference changes and unsubscribes, with date, time and IP address | You change topics or unsubscribe | To respect your choices and prove that we did. |
| Whether you open our emails or click links in them, with time, IP address and device type | You open or click an email | Delivery statistics, keeping our lists healthy, and detecting abuse. |
We do not ask for your name, phone number, payment details or any special-category data (such as health information) on this website. Choosing a topic such as health supplements only tells us which offers you would like to receive; it is not a record of your health.
3. Our legal basis
Data-protection law (the UK GDPR and the Data Protection Act 2018 in the UK, and the GDPR in the European Union) only allows us to use your data when we have a legal basis. Marketing emails are also covered by the Privacy and Electronic Communications Regulations (PECR) in the UK and the ePrivacy rules in the EU, which require your prior consent.
- Consent (Article 6(1)(a)) — for sending you marketing emails in the topics you chose. You give it by ticking the agreement box and confirming by email. You can withdraw it at any time; this does not affect emails sent before you withdrew.
- Legal obligation and legitimate interests (Article 6(1)(c) and (f)) — for keeping the record of your consent and your unsubscribe, so we can prove we followed the law and make sure we never email you again after you opt out.
- Legitimate interests (Article 6(1)(f)) — for open and click statistics and for protecting our service against abuse and fraud. You can object to this at any time (see section 8).
4. Our emails, advertisers and tracking
- Double opt-in. You are not subscribed until you click the link in our confirmation email. That link expires after 48 hours.
- Offers from partners. Our emails may contain offers from other companies (advertisers). We send these emails ourselves; we do not sell, rent or give your email address to advertisers. If you click an offer you leave our emails and go to the advertiser's website, where their privacy notice applies.
- Suppression lists. Advertisers sometimes give us lists of people who do not want their offers. These are compared in a one-way scrambled (hashed) form, so neither side sees the other's addresses, and anyone on them is excluded.
- Open and click tracking. Our emails contain a small image and tracked links that tell us when an email is opened or a link is clicked. You can block this by turning off automatic image loading in your email app.
- Every email identifies us as the sender and includes a working unsubscribe link and a link to manage your preferences.
6. Where your data is stored
Our servers are located in the European Union. If a service provider ever needs to access your data from a country without equivalent data-protection law, we will only allow it with the safeguards the law requires — such as the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses.
7. How long we keep it
- While you are subscribed — your email address, topics and consent record.
- After you unsubscribe — we keep your consent record and unsubscribe record only for as long as we may need to show that we respected the law or to defend a legal claim, then delete them.
- Do-not-email list — if you unsubscribe from everything or ask us to delete your data, we keep a one-way scrambled (hashed) form of your email address. It cannot be turned back into your address; its only use is to stop us ever emailing you again by mistake.
- Open and click details — the IP address and browser/device information are deleted after 180 days; only anonymous counts are kept after that.
- Confirmation and preference links — confirmation links expire after 48 hours and preference links after 7 days. The link record (your email address, IP address and browser) is deleted within a day of the link expiring or being used. If you never click the confirmation link, you are never subscribed.
8. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
How to use your rights. To change topics or stop emails, use the preferences page — it takes effect from our next send. For any other request, email privacy@dormy.ai. We may ask you to confirm you control the email address before we act. We will reply within one month (this can be extended by two further months for complex requests, in which case we will tell you why). Using your rights is free.
Complaints. We would like the chance to resolve any concern first, but you can complain at any time to the Information Commissioner's Office (UK), or to the data-protection authority in the EU country where you live or work.
9. If you live outside the UK and EU
- United States. Our emails follow the CAN-SPAM Act: they identify the sender, include our postal address and a working unsubscribe link, and we honour opt-outs promptly — normally from our next send and always within 10 business days. We do not sell your personal information.
- Canada. We send commercial emails only with your express consent, as required by Canada's Anti-Spam Legislation (CASL).
- Elsewhere. We apply the protections in this notice to everyone, wherever they live.
10. Security
Our website uses encrypted connections (HTTPS). Access to our systems is restricted to authorised staff, protected by passwords and firewalls, and logged. Preference links are private, single-purpose and time-limited. No system is perfectly secure, but if a breach ever puts your rights at high risk, we will tell you and the regulator as the law requires.
12. Children
Our emails are intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has subscribed, contact us and we will delete the data.
13. Changes to this notice
We may update this notice when our practices or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you by email before it takes effect.
14. Contact us
For questions about this notice or your data, email privacy@dormy.ai, or write to us at the postal address in section 1.