Privacy Policy for X-Fly

Last Updated: 09 July 2026

1. Introduction

X-Fly (“X-Fly”, “we”, “our”, or “us”) is provided by:

VMLY&R KOL Insights & Digital Solutions Ltd
WPP Sea Containers
18 Upper Ground
London SE1 9GL
United Kingdom

For privacy-related enquiries, please contact: [email protected]

This Privacy Policy explains how we collect, use, disclose and protect personal information when authorised users access and use the X-Fly web and mobile applications.

X-Fly is a business-to-business software platform and is available only to individuals who have been authorised by a customer organisation and provided with access credentials through that organisation.

2. Information We Collect

User Information

  • Name
  • Business email address
  • Job title
  • User profile information
  • Customer organisation information

Authentication Information

  • Username and account identifiers
  • Single Sign-On (SSO) authentication details provided by your organisation’s identity provider

X-Fly generally relies on customer-managed identity providers for authentication and may not store user passwords directly.

Technical Information

  • IP address
  • Browser type and version
  • Device information
  • Mobile device identifiers
  • Operating system information
  • Session information
  • Application and usage logs

Usage Information

  • User activity within the platform
  • Feature usage data
  • Audit trail records
  • System performance and diagnostic information

3. How We Use Information

We use personal information to:

  • Provide and operate X-Fly
  • Authenticate authorised users
  • Manage user access and permissions
  • Deliver customer support
  • Monitor service performance
  • Protect against unauthorised access, fraud and security threats
  • Produce analytics and usage reporting
  • Improve and develop the platform
  • Provide reporting and administrative information to customer administrators

4. Legal Basis for Processing

Where applicable, we process personal information:

  • To perform our contractual obligations to our customers;
  • For legitimate business interests, including service administration, security and improvement;
  • To comply with applicable legal obligations.

In many cases, X-Fly acts as a processor on behalf of its customer organisations, who act as the controller of user information.

5. Sharing Information

We may share information with:

  • Cloud hosting providers, including Microsoft Azure and Amazon Web Services (AWS);
  • Analytics and monitoring service providers;
  • Professional advisers and auditors where necessary;
  • Regulatory authorities where required by law.

We do not sell personal information.

6. International Transfers

X-Fly data is hosted within the European Union as standard.

Where personal information is transferred outside the EU or UK, appropriate safeguards are implemented, including:

  • European Commission Standard Contractual Clauses (SCCs);
  • UK International Data Transfer Addendum (IDTA);
  • Transfers to organisations providing equivalent levels of protection under applicable data protection laws.

7. Data Retention

Personal information is generally retained for the duration of the applicable customer agreement.

Following termination or expiry of a customer relationship, information may be retained in archives and backups for up to 180 days before deletion, unless a longer retention period is required by law.

8. Security

We use appropriate technical and organisational measures to protect information, including:

  • Encryption in transit and at rest;
  • Single Sign-On (SSO) authentication;
  • Multi-factor authentication where configured by customers;
  • Role-based access controls;
  • Audit logging and monitoring;
  • Regular vulnerability scanning and security reviews.

While we take reasonable steps to safeguard information, no system can be guaranteed completely secure.

9. Cookies and Similar Technologies

The X-Fly applications and associated websites may use:

  • Essential session cookies;
  • Analytics cookies;
  • Similar technologies necessary for platform functionality, security and performance monitoring.

10. Your Rights

Depending on applicable law, individuals may have rights to:

  • Access personal information;
  • Correct inaccurate information;
  • Request deletion of information;
  • Restrict or object to certain processing activities;
  • Request portability of personal information.

Because X-Fly is provided through customer organisations, requests relating to personal information should normally be directed to the relevant customer organisation in the first instance.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Updated versions will be posted on this page together with a revised “Last Updated” date.

12. Contact Us

VMLY&R KOL Insights & Digital Solutions Ltd
WPP Sea Containers
18 Upper Ground
London SE1 9GL
United Kingdom

Email: [email protected]