Privacy Policy

Legal

March 2026

General

flashflix.co (referred to hereafter as FlashFlix, "we", "us", and/or "our") provides this Privacy Policy to describe how we collect, use, and share the information of individuals who visit our website flashflix.co (hereafter referred to as the "website"). This policy further describes how we utilise any related services.

The Company is established and operates within the European Union and therefore complies with the General Data Protection Regulation (EU GDPR). The Company also acknowledges and complies with the Protection of Personal Information Act 4 of 2013 (POPIA) applicable to residents of the Republic of South Africa. Where multiple regulatory frameworks apply, the Company applies the higher standard of protection to Personal Data to the extent legally permissible.

For users in the European Union, Personal Data is processed in accordance with GDPR principles including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. For South African users, Personal Data is processed in accordance with POPIA principles including lawful processing, purpose specification, minimality, accountability, and security safeguards.

Below you will find an explanation of how and why we collect and use Personal Data, the circumstances under which it may be shared, and the measures we implement to safeguard such data.

Use and Treatment of Information

The Company informs users that any information arising from the use of the website or from the purchase or use of its products and services will result in Personal Data being processed and stored as part of its internal systems. By using the website and services, the user expressly consents to such processing where lawful consent is required.

The Company may process aggregated and anonymised data for analytical, statistical, research, marketing, and service improvement purposes. Such aggregated information does not identify individual users and may be shared with advertisers, research partners, and business collaborators.

The primary purpose of collecting Personal Data is to provide users with a personalised and optimised service experience. Information collected may be used to tailor content, improve platform functionality, and deliver relevant advertising and communications. Only authorised personnel of the Company have access to identifiable account-level data.

The Company may conduct research relating to user demographics, interests, and behavioural patterns using registration data, transaction data, survey responses, and system logs. Such research is compiled on an aggregated basis and may be shared with trusted third parties for legitimate business and analytical purposes.

The Company may further use Personal Data to send marketing communications, promotional materials, service updates, and information regarding products or services that may be of interest to the user. Such communications are sent only where permitted by law and, where required, on the basis of user consent provided at the time of registration or thereafter. Users may withdraw consent and unsubscribe from promotional communications at any time by contacting dpo@flashflix.co with the subject line "UNSUBSCRIBE".

The Company confirms that it does not sell Personal Data. Personal Data may only be shared in accordance with this Policy and subject to appropriate confidentiality and data protection agreements. While reasonable technical and organisational measures are implemented to protect Personal Data, the Company cannot guarantee absolute security of information transmitted over the internet.

Artificial Intelligence (AI), Profiling and Automated Processing

The Company utilises artificial intelligence systems, machine learning technologies, and other automated processing tools, including those provided by third-party service providers, in order to operate, maintain, enhance, and personalise its services. These systems may process Personal Data to analyse user behaviour, preferences, interactions, and usage patterns, and may be used to generate recommendations, insights, predictive outputs, and personalised content.

By using the services, the user expressly acknowledges and consents, where lawful, to the processing of Personal Data through automated systems, including profiling and behavioural analysis. Such processing is intended to improve user experience and service performance, although outputs generated by such systems are inherently probabilistic and may not always be accurate or complete.

AI Content, Intellectual Property and Use Restrictions

Certain content made available through the platform may be generated, assisted, or enhanced by artificial intelligence systems. All such content, including AI-generated outputs, is owned or licensed by the Company and is protected under applicable intellectual property, copyright, and contractual rights.

Users expressly agree that they shall not copy, reproduce, distribute, scrape, extract, modify, reverse engineer, or otherwise exploit any content from the platform, whether human or AI-generated, without prior written authorisation from the Company. Users further agree that platform content shall not be used for the purpose of training artificial intelligence systems, machine learning models, datasets, or similar technologies. Any unauthorised use of content may result in suspension or termination of access and may give rise to legal action.

Marketing, Advertising and Third-Party Communications

By using the service and providing consent where required, users agree that the Company may process Personal Data to tailor user experience, deliver personalised content, and provide marketing communications. The Company may send promotional material where the user has opted in to receive such communications during registration or thereafter.

Communications may be delivered via email, SMS, WhatsApp or similar messaging platforms, or through in-app notifications. Such communications may include promotional offers, product updates, service announcements, customer experience surveys, and feedback requests. Users acknowledge and consent that certain customer experience communications and surveys may be conducted directly by the Company or through authorised third-party service providers acting on its behalf.

The Company may also share limited Personal Data with advertising networks, marketing partners, analytics providers, and customer experience service providers strictly for operational, analytical, and service improvement purposes, subject to appropriate contractual safeguards.

Users may withdraw consent to receive promotional communications at any time by contacting dpo@flashflix.co with the subject line "UNSUBSCRIBE". Service-related communications necessary for account maintenance or operational purposes may still be sent where legally permissible.

Information We Collect

The Company collects Personal Data including, but not limited to, technical information such as IP address, device identifiers, browser type, operating system, and usage data relating to interaction with the website. The Company also collects registration data, profile information, and other information voluntarily provided by the user.

The Company uses cookies and similar tracking technologies for the purposes of enabling core functionality, analysing usage patterns, improving user experience, personalising content, and facilitating advertising, including advertising provided by third parties. Users acknowledge that third-party advertisers may also place cookies or similar technologies on the user’s device, and the Company does not control the operation of such third-party technologies once deployed.

How We Share Your Information

The Company does not sell or rent Personal Data. Personal Data may be shared with trusted third-party service providers, including hosting providers, analytics services, AI technology providers, advertising partners, and customer experience partners, solely for the purposes of operating, improving, and delivering the services.

Personal Data may also be disclosed where required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of the Company, its users, or others. In the event of a merger, acquisition, restructuring, or sale of assets, Personal Data may be transferred as part of such transaction, subject to continued protection under this Policy.

All third parties processing Personal Data on behalf of the Company are required to implement appropriate confidentiality, security, and data protection obligations consistent with GDPR and POPIA requirements.

How We Protect Your Information

The Company implements reasonable technical, organisational, and administrative safeguards designed to protect Personal Data against accidental loss, unauthorised access, disclosure, alteration, or destruction. However, no system of transmission or storage can be guaranteed as completely secure, and the user acknowledges that they provide Personal Data at their own risk.

Data Subject Rights

Users may exercise rights afforded under applicable data protection laws, including the right to access Personal Data, request correction of inaccurate data, request deletion of data where applicable, object to processing, request restriction of processing, request data portability, and withdraw consent where processing is based on consent. Users may also object to automated decision-making and profiling in accordance with applicable law.

Children’s Privacy

The Company does not knowingly collect or process Personal Data from individuals under the age of 18. If it becomes aware that such data has been collected without appropriate authorisation, it will take reasonable steps to delete such data promptly.

Notifications

The Company may send service-related notifications, account-related communications, transactional messages, marketing communications (where consented to), and customer experience surveys. By using the service, users acknowledge and agree to receive such communications through reasonable electronic means, subject to applicable opt-out rights.

Amendments

The Company reserves the right to amend or update this Privacy Policy from time to time. Any material changes will be communicated to users where required by law or through appropriate notice mechanisms.

All privacy-related enquiries may be directed to dpo@flashflix.co.

Definitions

For the purposes of this Policy:
"Data Controller" refers to the entity which determines the purposes and means of processing Personal Data.
"Personal Data" means any information relating to an identified or identifiable natural person.
The Company refers to FlashFlix, operated by Fat Panda Ltd. responsible for the website and services described herein.