Privacy Policy

1. Who we are

Fast OTT Ltd, trading as Vodlix, is the controller of the personal data described in this policy.

Vodlix is a registered trade mark of Fast OTT Ltd (UK00004203433). We also operate Vertex, Vimo and Cookie Panda, which have their own privacy policies.

2. What this policy covers, and what it does not

This is the distinction that matters most.

If you watched something on a streaming service powered by Vodlix, we are not the controller of your data. The company whose service you used is. We process that data only on their instructions, under a Data Processing Agreement, and we cannot answer a rights request about it; we will pass you to them.

3. What we collect, why, and on what basis

3.1 If you visit vodlix.com

3.2 If you contact us or book a meeting

Name, email, phone, company, what you asked, meeting time. Used to respond and to follow up about our services.

Lawful basis: where you would enter a contract with us yourself, steps you ask us to take before entering it; otherwise, and for following up, our legitimate interests in responding to business inquiries and developing customer relationships (section 3.6).

3.3 If you hold a Vodlix account

If you use an account on behalf of your organization, the contract is with your organization, not with you. Where this table says contract, we rely instead on our legitimate interests in providing, billing and supporting the Services for that organization (section 3.6(b)).

3.4 If we think you might become a customer

Business contact details from public sources and enrichment providers, and our record of interactions.

Lawful basis: legitimate interests in business-to-business marketing. You can object at any time (section 8) and we will stop.

3.5 What we do not collect

We do not seek special category data (health, race, religion, biometrics, sexuality) about visitors, prospects or account holders, and ask you not to send it. Do not include it in support tickets.

Separately, where a customer uses our AI dubbing, voice or likeness features, or cast linking, a voice or face model may be created from people appearing in their content. That is processing we carry out for the customer as their processor, governed by the Data Processing Agreement, not by this policy.

3.6 The legitimate interests we rely on

Where this policy says we rely on legitimate interests, these are the interests we mean:

(a) running, securing and improving our website and the Services, including preventing fraud, misuse and security incidents;

(b) operating, billing and supporting the Services for our customers, including for the users a customer creates;

(c) responding to inquiries and marketing our services to businesses, including scoring and prioritizing sales inquiries (section 12);

(d) establishing, exercising or defending legal claims; and

(e) selling or reorganizing our business (section 6).

We rely on an interest only where your rights and interests do not override it. You may ask us at [email protected] for our assessment of any of them, and you may object at any time (section 8).

3.7 Where your data comes from

We collect personal data:

(a) from you, when you use our website, contact us, book a meeting, sign up or use the Services;

(b) from your device, automatically, when you visit vodlix.com (section 3.1 and our Cookie Policy);

(c) from the customer you work for, when they create a user account for you on the Services;

(d) from Google, if you choose to sign in with your Google account: the name and email address on that account;

(e) from advertising platforms, as the click identifier added to the link when you arrive from one of our adverts; and

(f) from public sources, if we think you might become a customer (section 3.4). What we obtain this way is business contact details, such as your name, employer, role, business email address and business telephone number. Our sources are public sources, such as company websites and professional networks.

3.8 Whether you have to give us your data

You do not have to give us any personal data to browse vodlix.com. You can refuse non-essential cookies and still use the site.

To open and run an account we need the data marked Contract in section 3.3. Without it we cannot provide the Services. The law also requires us to keep billing and tax records.

If you make an inquiry, we need enough contact details to reply to you. Anything else you give us is optional.

4. Marketing and advertising

This section describes the analytics and advertising tools we use, what they receive, and how you can control them.

4.1 What we run

4.2 The offline conversion upload, plainly

When you inquire, we store the advertising click identifier that brought you. Later, if you become a customer, we send that identifier back to Google so it can attribute the sale to the ad.

It is standard practice and is how ad measurement works. You can opt out (section 8).

4.3 Legal basis and control

All non-essential analytics and advertising run on consent, collected through our consent banner. You may withdraw consent at any time via the banner or by emailing [email protected], and withdrawal is as easy as giving it.

4.4 Marketing email

We send marketing email on consent, or to existing business customers about similar services under the soft opt-in. Every message has an unsubscribe link that works immediately.

When you sign up for our marketing email, we ask you to confirm your email address before we send you any (double opt-in).

We track opens and clicks in our marketing emails. Each email contains a tracking pixel, which tells us when it is opened, and tracked links, which tell us which links you click. To stop this tracking, unsubscribe. To stop open tracking only, set your email program to block images.

5. Cookies

We use cookies and similar technologies that are:

• Strictly necessary: sign-in, security, load balancing. No consent needed.

• Analytics: how the site is used. Consent.

• Advertising: measuring and targeting ads. Consent.

We manage this with Cookie Panda, our own consent platform, which records your choices and passes them to the vendors involved. You can change your choices at any time from the banner.

To refuse non-essential cookies, decline them in the banner. You do not need to change your browser settings, and we will not treat browser settings as consent.

The full detail is in our Cookie Policy (vodlix.com/cookie-policy).

6. Who we share data with

We do not sell your personal data for money.

Service providers, in these categories:

All act on our instructions under written contract, and may only use the data to provide their service to us.

We publish these categories of recipients rather than a complete vendor list, as Article 13(1)(e) permits.

Anyone may ask us for the full named list. Write to [email protected] and we will answer within 5 business days, free and without conditions. Customers also receive it as an annex to their Data Processing Agreement, and we give at least 30 days' notice before adding a new provider.

Professional advisers: lawyers, accountants and auditors, under confidentiality.

Authorities: where legally required. We assess each request, challenge those that appear invalid or overbroad, disclose the minimum, and tell you unless prohibited.

A buyer: if we sell or reorganize the business, under confidentiality, with this policy continuing to apply until you are told otherwise.

7. Where your data goes

Some of our systems are hosted in the United States. We are telling you plainly rather than burying it.

Where data leaves the UK or EEA we rely on:

• the UK Extension to the EU-US Data Privacy Framework, for providers certified under it, currently Cloudflare, Google and Stripe; or

• Standard Contractual Clauses with the UK International Data Transfer Addendum, for everyone else.

For personal data of people in the European Economic Area sent to the United States, we rely on the EU-US Data Privacy Framework for providers certified under it, and on the European Commission's Standard Contractual Clauses for everyone else. Transfers between the UK and the EEA rely on adequacy: UK law recognizes the EEA countries as adequate, and the European Commission has adopted an adequacy decision for the United Kingdom. Where we use a provider in any other country that has an adequacy decision, we rely on that decision.

You can ask us for a copy of the safeguards at [email protected].

8. Your rights

You have the right to:

How to exercise them

Email our Privacy team at [email protected], or use the privacy controls in your account.

We respond within one month. If a request is complex we may extend by two further months and will tell you why within the first month. There is no charge unless a request is manifestly unfounded or excessive.

We may ask for enough information to confirm your identity: only what is needed, and we do not use it for anything else.

If your request is about a streaming service run by one of our customers, contact that service. They are the controller. Tell us and we will pass it on and tell you who they are.

Complaints

If you have a concern about how we handle your personal data, tell our Privacy team at [email protected]. We will acknowledge your complaint within 30 days, take appropriate steps to investigate it, keep you informed of its progress, and tell you the outcome without unnecessary or unjustifiable delay.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

If you are in the European Economic Area, you may also complain to the supervisory authority of the country where you live or work, or where you believe the infringement took place. The European Data Protection Board lists them at edpb.europa.eu.

9. How long we keep it

Where we must keep something after you ask us to delete it, we tell you what, why and for how long, and we stop using it for anything else.

10. Security

We protect data with encryption in transit, two-factor authentication, regular security scanning, backups, access on a need-to-know basis, and confidentiality obligations on everyone with access.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a high risk to you, we will tell you without undue delay, and we notify the ICO within 72 hours where required.

Report a vulnerability to [email protected]. We will not pursue researchers who report in good faith and give us reasonable time to fix it.

11. Children

The Services are provided to businesses and organizations and are not directed at children. We do not knowingly collect personal data directly from anyone under 18 through vodlix.com. If you believe a child has given us personal data directly, tell our Privacy team at [email protected] and we will delete it.

End users of our customers' services may include children. There, the customer running the service is the controller, and we process those end users' personal data as its processor under our Data Processing Agreement. The customer is responsible for age assurance, for giving appropriate privacy information, for obtaining parental or guardian consent where required, and for complying with the children's privacy and online safety law that applies to its service.

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects based solely on automated processing.

We do use automated tools to score and prioritize sales inquiries. That affects who we contact and when. It has no legal effect on you, and you can object at [email protected].

13. Changes

We may update this policy. If a change materially affects your rights or how we use your data, we will give at least 30 days' notice by email to account holders and by posting the updated policy with a new effective date.

14. Contact

Fast OTT Ltd, trading as Vodlix

Office 7, 480 Larkshall Road, London, England, E4 9HH

Company number 15157138 · VAT GB452774964

Privacy team [email protected] · Security [email protected] · Legal [email protected] · General [email protected]

We have not appointed a Data Protection Officer, having assessed that we are not required to.