Privacy Policy

Key points to note This Privacy and Cookie Policy will apply to any Personal Information Doxi collects or otherwise receives about third parties (“you”), including when you use our Website www.doxibars.co.uk, we provide services to you in person (e.g. when you book or attend one of our events) or otherwise engage with us. When you use our Website or request services from us (such as purchasing goods from us) or otherwise engage with us, we may collect Personal Information from you.

This Privacy and Cookie Policy explains what Personal Information we collect and how we will only process this information

(i) to provide our services to you

(ii) to comply with our legal obligations,

(iii) for the purposes of our legitimate business interests (namely to provide our services and to analyse the use of our Website and services to continually improve our business and your customer experience) and

(iv) where we otherwise have your consent. You can ask us to stop using some of your Personal Information at any time and have the right to ask us to delete some of the Personal Information that we hold about you. Just contact us at hello@doxi.uk. You can also use this email address if you have any questions about this Privacy and Cookie Policy. In addition to this Privacy and Cookie Policy please take the time to read our Website Terms and Conditions which will also govern your use of our Website: www.doxibars.co.uk.

1. Company Statement We will only use information from which you can be identified (“Personal Information”), such as your name, contact details and financial information, which is provided to us, or otherwise obtained by us, as set out in this Policy. We will ensure that your Personal Information is handled in accordance with the “Data Protection Legislation”, meaning any law applicable from time to time relating to the processing of Personal Information and/or privacy, as in force at the date of this Agreement or as re-enacted, applied, amended, superseded, repealed or consolidated, including without limitation, the UK Data Protection Act 1998, the General Data Protection Regulation (EU) 2016/679, and the Privacy and Electronic Communications (EC Directive) Regulations 2003, in each case including any legally binding regulations, direction and orders issued from time to time under or in connection with any such law, and all other relevant legislation. By visiting and/or contacting us through the Website (or otherwise engaging with us), you acknowledge that we may collect, use and transfer your Personal Information as set out in this Policy. Doxi reserves the right to change this Policy from time to time and you should therefore check this page frequently to ensure that you are happy with any changes.

Doxi PRIVACY POLICY 2 OF 9 In this Policy, “Doxi“, “we”, “us” and “our”, refer to Doxi. For the purposes of the Data Protection Legislation, we are deemed to be the “data controller” in respect of any Personal Information that you provide to us in connection with the operation of our business or we otherwise obtain about you. Where you provide us with Personal Information to be shared with a third party (e.g. the postal service required to deliver your goods), they may also be a data controller of that information and you should review their own privacy and Cookie policy for details as to how they handle your Personal Information.

2. Personal Information that we collect from you When you engage with us (e.g. registering with us, sending us emails, contacting us via telephone or visiting or making an enquiry through the Website or at a restaurant), you may provide Personal Information about yourself including your name and contact details (e.g. your email address and telephone number) and where you apply for a role with us, you may provide us with further information such as your job title and CV. If you consider purchasing goods from with us or requesting any other form of service from us, you may also provide us with your name, contact details (telephone, mail and e-mail addresses), date of birth, the names of other parties (where applicable such as when gifting a product), billing information, financial transaction and credit card information and various other necessary Personal Information (e.g. the location of delivery which may reveal your or another’s business or home address). Where you purchase for someone other than, or in addition to, yourself, you are responsible for notifying your guest(s) that you have provided their Personal Information to us and directing them to this Privacy Statement as to how we will process their Personal Information. We also have CCTV at some of our offices for the purpose of crime prevention and where this is used, we will display appropriate notices. If you choose to leave a review or share a memory with us, about one of our products, you may choose to provide us with your contact information, where you are from, where, when and with whom you visited us or our website (and any photos of you with our products). Where you apply for a job with us, we may collect from you and third parties (where relevant) additional Personal Information such as your CV, any references, and contact details. Unless you ask us to keep such information on file for future opportunities or we need to retain such information for compliance with our legal obligations, in the event that you are unsuccessful, we will only retain this Personal Information for as long as is reasonably necessary to process your application.

3. Whose Personal Information might we collect and why?

3.1 People who register with us Registration involves the following information: your title, name and address, contact phone number and e-mail addresses. When you register with us, if you choose to opt-in to receiving our emails, we may send you our latest brochures, information and special offers. You can also update us with your preference of communication by e-mailing us with your details and mailing preferences.

DOXI PRIVACY POLICY 3 OF 9

3.2 People who request a complimentary quote for large orders or for special occasions When you request a quote of this type, we take certain Personal Information such as your name and contact details. You may also provide us with other Personal Information so that we may provide a more detailed quote for your special occasion. When submitting the form, you have the opportunity to subscribe to our monthly news and offers by ticking the box.

3.3 People who purchase products form us In order to deliver the ultimate Doxi experience, we also require certain other Personal Information, such as your name, address and credit card details. We would be delighted to keep in touch, including to let you know about future promotions and products – therefore, unless you have opted out of such communications, we may also send you information about other

Doxi promotions and products.

3.4 People who subscribe to our products In order to deliver the ultimate Doxi subscription experience, we also require certain other Personal Information, such as your name, address and credit card details. In order to provide a full service, we also require your email address to communicate regarding your charges and upcoming orders and deliveries. We would also be delighted to keep in touch, including to let you know about future promotions and products – therefore, unless you have opted out of such communications, we may also send you information about other Doxi promotions and products.

3.5 People who apply for a job with us Where you apply for a job with us, we may collect from you and third parties (where relevant) Personal Information such as your CV, any references, your right to work, your name and contact details and any other information that you supply to us as part of your application. Unless you ask us to keep such information on file for future opportunities or we need to retain such information for compliance with our legal obligations, if you are unsuccessful, we will only retain this Personal Information for as long as is reasonably necessary to process your application.

3.6 People who provide services to us and other business contacts Where you or your employer (or any other entity you work for) provide services to us, you and/or they may provide us with some of your Personal Information in connection with the provision of the services, such as your name, business contact details and other ID information. We will only process such Personal Information in connection with the provision of the services (such as using your contact details to discuss the services) and in accordance with this Privacy and Cookies Policy. In addition, where necessary, we may also share your Personal Information with our customers or other third parties in order to provide our services (e.g. if you or your business provide a courier service, we may share your business contact details with our customers so that they can contact you about a delivery).

4. Technical Personal Information that we collect from you Where you make use of our Website, make a purchase, or otherwise engage with us we may also collect Personal Information about you and certain limited information about your device and your visits to our Website, which may be considered “Technical Personal Information”. Technical Personal Information may include: • Device data. We may collect information about the type of device or platform you use (such as a computer or mobile device) to access our Website and your choice of web browser. • Location data. Your use of our Website may generate geographical data, such as the location or time zone of a device, domain name or IP address, which we may collect.

DOXI PRIVACY POLICY 4 OF 9

• Log data about your visit. Your use of our Website automatically generates information about your unique visit which we may collect. This can include [uniform resource locators (URLs), data about your internet service provider, the number and timing of clicks to and from the content on our Website, the website that you visited prior to our Website, which events and restaurants you view, page response times, download errors, length of visits to certain pages, page interaction data (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page. Typically we will not be able to identify you from this information.

• Data about your interactions. Our Website may provide you with the opportunity to interact with content in certain ways, such as by sharing content on social media. These interactions create data which we may collect, for example, the contents of a post or comment, or whether a link or image was shared using a particular social media network. Where you receive emails from us we may also collect information about email engagement rates and activities. Some of the Technical Personal Information set out above can be collected by cookies. For more information on the ways in which we make use of cookies, please see section [11] below.

5. Personal Information that we receive from other sources We may receive information from third parties who collect Personal Information from you and pass it on to us.

For example:

(i) when you receive a gift from someone who is required to enter your personal details, such as your name, address and allergies;

(ii) your employer may provide your Personal Information to us in connection with a service they provide to us or in connection with services that we provide to our customers; and

(iii) we may receive information from past employers and others concerning your employment history where you apply for a job with us. Where this is the case the third party is responsible for informing you that your information will be shared, but once we are holding it, we will only handle it in accordance with this policy.

6. Children’s Personal Information

If you are a young person under the age of 18, you will not be allowed access to our website or be able to purchase any goods due to the alcoholic content of many products.

7. How we use your Personal Information

We will only use your Personal Information in order to:

(i) supply the products and/or services you (or another individual on your behalf) have requested and correspond with you in relation to their provision,

(ii) provide support to you in respect of these services,

(iii) improve our Website and services,

(iv) comply with our own legal obligations,

(v) perform internal business processes, including providing support to our staff and

(vi) where relevant, process your application for employment.

Marketing Communications and Newsletters

Where you have explicitly consented at the time we collected your Personal Information or where we otherwise have a right to do so, we may also use your Personal Information to send you information by email and post.

DOXI PRIVACY POLICY 5 OF 9

These will inform you of our launch of new products, special sales or events taking place and other products and services that may be of interest to you. We may also use your postal address to send you the latest news on product launches, events or competitions we are running.

• Social Media Competitions.

Where you enter a social media competition you have the opportunity to subscribe to our email newsletters by ticking the box. You can unsubscribe to these communications using the link in the email at any time. • Market Research. From time to time, where you have opted-in to receive such communications, we may also use your information to contact you for market research purposes. We may contact you by email or mail.

• Sensitive Personal Information.

If you wish, you may provide us with some special categories of Personal Information (“Sensitive Personal Information”) in order for us to provide you with a better standard of service. Sensitive Personal Information that we may receive in connection with our services includes Personal Information relating to your religion, philosophical beliefs, political opinions, mental or physical health or condition (including any dietary or medical requirements or conditions) and sexual orientation. For example, you may provide us with information about your dietary or medical requirements, you may purchase gifts for a company or a group with religious beliefs preventing consumption of alcohol or individuals who are allergic to a product. The provision of this information is entirely voluntary and where you provide such information to us, by [ticking the relevant tick-box online (or, if communicating with one of the team) you consent to our processing of this type of Personal Information so that we can better provide the services you have requested. We shall endeavour to only process this information to the extent strictly necessary, after which we will promptly delete such information. We may share your personal information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006. Although usage will be limited to the original purpose for which we obtained your data unless we have your consent otherwise

8. Your rights

You may choose to restrict the collection or use of your Personal Information in the following ways:

(i) There are various tick-boxes on our website which you can use to indicate your preference to receive our marketing – or to not receive it.

(ii) If you have been receiving marketing from us but change your mind and decide you don’t want to hear from Doxi, you can unsubscribe by emailing us at hello@doxi.uk.

(iii) If you have previously agreed to Doxi sharing your Personal Information with third parties for direct marketing purposes, you may change your mind at any time by using the unsubscribe option in the relevant communication, contacting us at hello@doxi.uk or contacting the third party directly. You are entitled to know some details about the Personal Information we hold about you and how that information is processed. If you would like to request this, please contact us at hello@doxi.uk and we will provide you with the information to which you are entitled. You have the right to request that we correct any Personal Information that we are holding about you that is incorrect or incomplete. You also have the right to ask us to erase or stop processing any Personal Information we have about you where there is no longer a legal ground for us to hold it and, in some circumstances, you have the right to request that we transfer any information we hold about you to a third party. If you wish to exercise any of these rights, please contact us as soon as possible, at hello@doxi.uk. We will promptly correct any information found to be incorrect.

DOXI PRIVACY POLICY 6 OF 9 You may also have similar rights with our third party partners and you should consult their privacy and Cookie policies and/or contact them for further information

9. How long we retain your Personal Information Unless otherwise instructed by you, we will retain your Personal Information for only as long as we require for the purposes for which it was collected. Once the relevant purpose has been satisfied, we will securely delete or anonymise your Personal Information unless we are required to retain a copy of such information under applicable law.

10. Third Parties We may share your Personal Information with third parties where we have your explicit consent, or it is necessary

(i) for the performance of the services you have requested,

(ii) for us to comply with our legal obligations or

(iii) for our legitimate business interests. Some of the services on our Website and at Doxi locations are delivered or served by third party companies, which may collect information about your use of the services for their own purposes and where this is the case, they are likely to be the data controller over such information. When you use our Website, these third parties may also place or recognise cookies to track your behaviour and we advise you to read their privacy policies as to how they will process your data We run promotions with third parties at specific times of the year and if you choose to opt-in, we may share your data with these third parties. We use third party advertising companies to serve ads when you visit our Website. These companies may use your Personal Information, in order to enhance user experience, offer a greater variety of content and provide advertisements about goods and services of interest to you. This may include the use of cookies. For more information about cookies please see section 11 below. In exceptional circumstances, if we are sold or merged with another company we may disclose your information to a potential buyer, including your Personal Information and other information concerning your relationship with us, so that they can continue to provide the services you have requested.

11. Cookies

A cookie is a small file that a Website puts on your hard drive so that it can remember something about you at a later time. Cookies help us to analyse web traffic and identify which pages of our Website are being used. Our Website also uses cookies to respond to you as an individual so that it can tailor its operations to your needs by gathering and remembering information about your preferences. A cookie in no way gives us access to your computer or any information about you, other than information about how you use the Website and the Personal Information you choose to share with us (including Personal Information you automatically share with us by way of your browser settings). We do not use cookies to store any of your financial information on your computer.

DOXI PRIVACY POLICY 7 OF 9

In particular, we use the following cookies:

• Strictly necessary cookies. These cookies are essential in order to enable you to move around the Website and use its features.

• Performance cookies. These cookies collect information about how visitors use our Website, for instance which pages visitors go to most often and if they get error messages from the web pages. These cookies don’t collect information that identifies a visitor; all information these cookies collect is aggregated and therefore anonymous. It is only used to improve how our Website works.

• Functionality cookies. These cookies allow our Website to remember choices you make (such as your user name, language or the region you are in) and provide enhanced, more personal features. These cookies can also be used to remember changes you have made to text size, fonts and other parts of the Website that you can customise. The information these cookies collect is anonymised and they cannot track your browsing activities on other websites.

• Sharing cookies. These cookies allow you to interact with third party services such as LinkedIn. [Information collected by these cookies is aggregated and therefore anonymous].

• Persistence cookies. These cookies enable a website to remember you on subsequent visits, speeding up or enhancing your experience of services or functions offered. It remains on the user’s computer/device for a pre-defined period of time. e.g. a day. You may see a message on our Website before we store a cookie on your computer which describes the types of cookies we use and what information they might collect. We may also use banners and pop-ups from time to time to give you options around cookies use. You can also manage cookie use via your browser settings (this will allow you to refuse the setting of all or some cookies) and your browser provider may ask you to confirm your settings. Note, however, that if you block all cookies (including essential cookies) via your browser settings you may not be able to access all or parts of our Website. You can find more information about the specific cookies we use and the purposes for which we use them in the table attached to this Policy. You can also find more information about cookies generally here: www.allaboutcookies.org.

12. Links Links from our site to external websites do not mean we endorse these websites. We advise you to read the privacy and Cookie policy applicable to each third party site you visit and we will not accept any responsibility for or liability in respect of either the contents or your use of these third party sites.

13. Security Please note that the transmission of information via the internet is not completely secure and, although we will take steps to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted via the Website and any transmission is therefore at your own risk.

14. Transfers of your Personal Information outside the EEA The Personal Information you provide to us will be transferred to and stored on our servers in the UK and we take steps to protect your Personal Information from unauthorised access and against unlawful processing, accidental loss, destruction and damage.

DOXI PRIVACY POLICY 8 OF 9

In processing your Personal Information, it may be necessary for us to transfer your Personal Information outside the European Economic Area (“EEA”). It may also be accessed by staff operating outside the EEA who work for us or for one of our suppliers or group companies. This includes staff engaged in, among other things, the provision of support services. We will take all steps reasonably necessary to ensure that your Personal Information is treated securely and in accordance with this Policy and the Data Protection Legislation when it is processed in, or otherwise accessed from, a location outside the EEA. This means that we will only transfer your Personal Information to third parties outside the EEA if that third party

(i) is situated in a country that has been confirmed by the European Commission to provide adequate protection to Personal Information,

(ii) has agreed (by way of written contract incorporating the “model clauses” as approved by the European Commission or by some other form of data transfer mechanism approved by the European Commission) to provide all protections to your Personal Information as required by the Data Protection Legislation or

(iii) we have your explicit consent to do so. Where any transfer takes place under a written contract, you have the right to request a copy of that contract and may do so by contacting us at hello@doxi.uk For the avoidance of doubt, in the event that the UK is no longer a part of the EEA, references in this paragraph to the EEA shall mean the EEA and the UK. By submitting your Personal Information to us, you acknowledge this transfer, storing or processing of your Personal Information.

15. Complaints Should you have any queries or complaints in relation to how we use your Personal Information, please contact us at hello@doxi. Should you wish to take any complaints or queries further, you have the right to contact the Information Commissioner’s Office regarding such issues via their website at www.ico.org/concerns or write to them at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

16. Changes to this Privacy and Cookie Policy Any changes we may make to our Privacy and Cookies Policy in the future will be posted on our Website and, where appropriate, notified to you when you next access our Website or otherwise request services from us. It is your responsibility to ensure that you are aware of the latest version of this Privacy and Cookies Policy and by continuing to use our Website, request services from us or otherwise engage with us, you will be deemed to have accepted any revised terms.

17. Contact us If you have any questions, please feel free to call us between 9am – 6pm (GMT) Monday – Friday to talk to our customer services team. Outside these hours please leave a message after the recording or email us and we will get back to you as soon as possible.

DOXI PRIVACY POLICY 9 OF 9

18. Our Cookies Cookie Name Description/Purpose Duration Sharing cookies

Facebook

These cookies allow you to interact with third party services, customize ads on their properties and help you track sales and other conversions from your ad. It adds a cookie to a person’s computer when the person clicks an ad. 7-90 days

Twitter

Instagram

YouTube

Persistence cookies

Google Analytics To determine new sessions/visits on the site. 1 day Google AdWords To customize ads on Google properties and help you track sales and other conversions from your ad. It adds a cookie to a person’s computer when the person clicks an ad. 7-90 days