Privacy Policy

Climaxx Media Ltd
Effective Date: 9th December 2025
Last Updated: 6th September 2026

1. Introduction

Climaxx Media Ltd ("we", "us", or "our") is committed to protecting the privacy and personal data of individuals in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws in the United Kingdom. This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal data when you visit our website at https://climaxxmedia.com or interact with us in any way.

We are registered with the UK Information Commissioner's Office (ICO) as a Data Controller under registration number ZB778270.

2. Who We Are

Climaxx Media Ltd
Registered in England and Wales
Company Number: 15778481
Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email: info@climaxxmedia.com
Website: https://climaxxmedia.com

We are the Data Controller for all personal data described in this policy.

3. Legal Basis for Processing

We collect and process personal data under the following lawful bases, as defined under Article 6 of the UK GDPR:

• Consent, where you have given clear and informed permission.
• Contractual necessity, where processing is required to fulfil a contract.
• Legal obligation, where we are legally required to retain or share data.
• Legitimate interests, for purposes such as marketing, security, or service optimisation, where your rights do not override our interests.

4. What Data We Collect

We may collect and process the following categories of personal data:

• Identity Data, name, date of birth, username, profile photo (if applicable)
• Contact Data, email address, phone number, postal address
• Technical Data, IP address, browser type, device information
• Usage Data, page views, clickstream data, referral sources
• Marketing Data, preferences, interactions with our newsletters or campaigns
• Application Data, professional interests, age, gender, sexual orientation (if voluntarily disclosed and required for casting)
• Performer Media, the photos and videos you upload to your profile, including your full length nude casting photo

Sensitive data (such as sexual orientation or gender identity) is only collected where explicit consent has been obtained and where it is directly relevant to our legitimate casting activities or services.

Performer media is used to build your profile so that producers can assess your suitability for their projects. Your full length nude casting photo is shown only to verified producers on Climaxx and is not posted to the public web. Your public profile listing stays off until you choose to switch it on in your settings, and you can remove any media from your profile at any time. Identity and age verification is handled separately, using your identity document and a clothed verification selfie, and those documents are never shared with producers.

5. How We Collect Data

We collect data through:

• Direct submissions (e.g. contact forms, course enrolment, casting applications)
• Website analytics tools (e.g. Google Analytics, via anonymised tracking)
• Cookies and similar web tracking technologies
• Third-party integrations (e.g. email marketing platforms, CRM systems)

6. Cookies and Tracking Technologies

We use cookies to enhance your experience, understand usage patterns, and deliver targeted content. You will be notified of cookie use upon your first visit and have the option to manage your preferences.

We use Mailgun (Sinch Email, EU region) to deliver our transactional and campaign emails. When you open one of our emails, Mailgun records the open event for delivery analytics via a small invisible tracking pixel embedded in the message. We do not use Mailgun's link-click tracking, so the URLs in our emails are not rewritten and we do not record which links you click via the email service. You can disable image loading in your email client to prevent open tracking.

7. How We Use Your Personal Data

We process your data for the following purposes:

• To provide, manage, and support our services, including training courses and casting opportunities
• To administer your account or application
• To respond to enquiries or complaints
• To send marketing communications (with opt-out options)
• To comply with legal or regulatory obligations
• To carry out age verification and age assurance, including to meet our obligations under the Online Safety Act 2023
• To protect against fraud, abuse, or unauthorised access

7A. Fraud Prevention, Platform Safety and Automated Processing

To keep the platform safe and to meet our legal obligations, we run the following automated checks. Each is listed with what it does and its lawful basis.

• Repeat-application check. When an application is declined or an account is banned, we keep a limited record (name, date of birth, a one-way hash of the email address and phone number, the decision and its reason) and compare new applications against it so that the same person cannot re-apply through a different door. Lawful basis: legitimate interests in preventing fraud and protecting members. Retained for 24 months from the decision, then deleted.
• Location and network checks. At registration and on each visit we record your IP address, the country it resolves to and the network it belongs to. We use this to apply territorial restrictions (Terms section 1.5), to flag VPN, proxy or data-centre traffic, and to investigate suspected fraud. Lawful basis: legitimate interests and, for age assurance, legal obligation under the Online Safety Act 2023.
• Message scanning. Platform messages, profile fields and casting applications are checked automatically for telephone numbers, external messaging handles and other off-platform contact details before a booking is confirmed (Terms section 8.7). Matches may be redacted and a warning shown; repeated matches are reviewed by staff. Lawful basis: legitimate interests in member safety and contract.
• Image checks. Uploaded photographs and identity images are checked for embedded metadata indicating AI generation, compared against previously uploaded images by perceptual fingerprint, and may be searched for elsewhere on the web to detect stolen photographs. Lawful basis: legitimate interests, legal obligation and, for identity images, the fraud exception in section 10.
• Account lifecycle automation. Free accounts that stay empty or inactive for the periods stated in our Terms are removed automatically; accounts suspended pending identity verification that receive no response within the stated window are deleted; failed subscription payments downgrade the account after the retry period. Lawful basis: contract and legitimate interests.

Decisions that have a legal or similarly significant effect on you, including declining an application, suspending or terminating an account, and rejecting identity verification, are made or reviewed by a member of our staff. You can ask for human review of any automated outcome, express your point of view, or contest a decision by emailing info@climaxxmedia.com. We do not profile members for marketing purposes.

8. Data Sharing and Third Parties

With your explicit consent:

• Verified partner production companies for increased casting and performance opportunities (as detailed in your application consent preferences)
• Other third parties you have specifically authorised us to share your information with

For legitimate business purposes:

• IT service providers acting on our instructions: DigitalOcean (hosting and file storage, London), Cloudflare (network security and content delivery), Stripe (subscription payments; we never see or store card numbers), Mailgun (transactional email, EU region), Google Analytics (site usage statistics), Sentry (error monitoring), and our self-hosted mailing list software
• Professional advisors (e.g. legal, HR, compliance consultants)

When legally required:

• Regulatory bodies (e.g. ICO, HMRC)
• Law enforcement agencies, when legally obligated to do so

All third-party service providers are bound by strict data processing agreements ensuring GDPR compliance. Where we share data based on your consent, you retain the right to withdraw that consent at any time by contacting us.

9. Data Transfers Outside the UK

Where data is transferred outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are in place, such as: UK IDTA (International Data Transfer Agreement) or Standard Contractual Clauses (SCCs) approved by the UK Government or European Commission.

10. How Long We Keep Your Data

We retain personal data only as long as necessary:

We securely delete or anonymise personal data after the retention period.

Exception: suspected verification fraud. Where we detect or reasonably suspect that identity or age verification images were AI-generated, synthetic, manipulated, or belonged to another person, we retain those images together with the associated account and technical data, including the IP address and country from which the account was created and accessed, login and device records, timestamps, and the results of our authenticity checks. This material is retained for as long as is necessary to investigate the matter, prevent further fraud, establish, exercise or defend legal claims, and report the matter to law enforcement or other competent authorities where appropriate. It is retained notwithstanding the deletion periods in the table above, and it continues to be retained if the account is suspended, closed or deleted. Our lawful bases are our legitimate interests in preventing fraud and protecting the platform and its members (UK GDPR Article 6(1)(f)) and the establishment, exercise or defence of legal claims. Access to this material is restricted to authorised staff.

11. Your Data Protection Rights

Under UK GDPR legislation, you have the following rights:

• Right to access, request a copy of your personal data
• Right to rectification, request correction of inaccurate data
• Right to erasure, request deletion of your data
• Right to restrict processing, request limits on use
• Right to object, object to processing based on legitimate interest
• Right to data portability, request data transfer to another provider
• Right to withdraw consent, where processing is based on consent

To exercise your rights, email: info@climaxxmedia.com

If you believe your rights have been violated, you can lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/

12. Data Security

We implement technical and organisational measures to safeguard your data, including:

• SSL encryption
• Secure data hosting and firewalls
• Access controls and role-based data permissions for staff
• Regular backups and vulnerability monitoring

We also train our staff on GDPR and confidentiality obligations.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, operations, or technology. The most recent version will always be available on this page with the last updated date clearly displayed.

14. Governing Law and Jurisdiction

This Privacy Policy and any dispute arising out of it shall be governed by the laws of England and Wales. Any legal action or proceeding shall be subject to the exclusive jurisdiction of the courts of England and Wales.

15. Contact Us

For any privacy-related queries, requests, or concerns, please contact:

Data Protection Lead
Climaxx Media Ltd
Email: info@climaxxmedia.com
Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
ICO Registration Number: ZB778270

Effective Date: 9th December 2025. Last Updated: 6th September 2026. Climaxx Media Ltd. Company No. 15778481.