Privacy Policy

1. Who we are

This website and the services available through it ("Services") are operated by Visional Media Limited ("we", "us", "our"), a company registered in England and Wales.

• Company number: 04247285
• VAT number: GB877113217
• Registered office: 30 Orange Street, London WC2H 7HF
• ICO registration number: Z8799523
• Data protection contact: toc@virtualtalk.co.uk
• Postal address for data protection enquiries: 30 Orange Street, London WC2H 7HF

We are the data controller for the personal data described in this notice.

EU representative (Article 27 UK/EU GDPR): Visional Media Limited — toc@virtualtalk.co.uk

2. What this notice covers

This notice explains what personal data we collect when you use xpanded.uk, why we collect it, what we do with it, how long we keep it, and what rights you have.

It applies to everyone who uses the Services: registered members, visitors, cam hosts, phone chat hosts, and anyone who contacts us.

Separate terms apply to hosts and performers. See the Creator Terms.

3. The law that applies

We process personal data in accordance with:

• the UK General Data Protection Regulation and the Data Protection Act 2018, for users in the United Kingdom; and
• Regulation (EU) 2016/679 (EU GDPR), for users in the European Union.

Where the two differ, we apply the standard that gives you the greater protection.

4. Special category data

This section matters more than any other in this notice, and we want to be clear about it.

Because we operate an adult entertainment platform, information about your use of the Services may reveal details of your sex life or sexual orientation. Under Article 9 of the UK and EU GDPR this is "special category" data, and it receives additional protection in law.

We rely on your explicit consent (Article 9(2)(a)) to process this data. That means:

• we ask you to consent separately and specifically, not as part of accepting our terms generally;
• you can withdraw that consent at any time through your account settings or by contacting toc@virtualtalk.co.uk;
• withdrawing consent does not affect processing that happened before you withdrew it;
• if you withdraw consent, we will close your account, because we cannot provide the Services without processing this data.

Where we process special category data for the purposes of preventing or detecting unlawful acts, or for safeguarding, we rely on the conditions in Schedule 1 of the Data Protection Act 2018. We maintain an Appropriate Policy Document as required by paragraph 5 of Schedule 1, which is available on request.

We do not use special category data for marketing or profiling, and we do not share it with advertisers.

5. Age assurance

You must be at least 18 to use the Services.

We will verify your age where required before providing access to age-restricted services or content.

Under Part 5 of the Online Safety Act 2023 and Ofcom's implementing guidance, any service that allows access to pornographic content from the UK must use highly effective age assurance. A tick-box, a date-of-birth field, or a self-certification splash page is expressly identified by Ofcom as NOT meeting this standard. The current Scrile age gate does not comply.

Ofcom can impose fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, and can apply for business disruption measures requiring payment providers and ISPs to withdraw service. Senior managers can face personal liability for certain failures.

Separate EU requirements also apply. Germany (JMStV) and France (ARCOM) both mandate age verification for pornographic services, and several other member states have introduced or are introducing equivalent rules.

A provider must be selected and integrated before the site accepts UK or EU traffic. Once selected, this section must state: the provider's name, the method used, exactly what data they collect, whether we ever see it, and how long anything is retained.]

Our position, once a provider is in place, will be that we retain only a pass or fail result and the date it was issued. We do not intend to retain identity documents, facial images, or any underlying verification data. ICO guidance is clear that data minimisation applies with full force here, and we will confirm the provider's retention practices contractually before going live.

6. What we collect and why

6.1 Information you give us

6.2 Information we collect automatically

6.3 Information from third parties

• Age assurance results from our age verification process
• Aggregate analytics from Google Analytics
• Information from credit reference and fraud prevention agencies (see section 9)

6.4 Our legitimate interests

Where we rely on legitimate interests, those interests are: keeping the Services secure, preventing fraud and chargeback abuse, moderating content, investigating complaints, and improving what we offer. We have assessed these against your rights and keep a record of that assessment, which you can request.

You have the right to object to processing based on legitimate interests. See section 12.

7. Content monitoring and moderation

We monitor and review content on the Services, including live streams, recordings, images, profiles and messages. We do this to comply with the Online Safety Act 2023, the EU Digital Services Act, payment card scheme requirements, and our own Acceptable Use Policy.

Monitoring may be automated, human, or both. Where an automated system makes a decision that significantly affects you, you can ask for human review — see section 12 and our Complaints, Reporting and Takedown Policy.

We keep records of moderation decisions, including content removed and the reasons for removal.

8. Cookies

We use cookies and similar technologies. When you first visit, you will be shown a consent banner allowing you to accept or reject each category.

Rejecting non-essential cookies will not prevent you from using the Services. Only strictly necessary cookies are required.

9. Who we share your data with

We do not sell your personal data.

We share it with:

• Google, for analytics, where you have consented
• Credit reference and fraud prevention agencies, where a chargeback is raised without first contacting us
• Law enforcement, regulators and courts, where legally required
• Professional advisers, and any purchaser if the business is sold

Every processor is bound by a written contract meeting Article 28 requirements.

10. International transfers

Some of our providers are outside the UK and EEA. Where that is the case, we rely on one of:

• an adequacy decision by the UK government or European Commission;
• the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum;
• the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified.

You can ask us for a copy of the safeguards in place.

11. How long we keep it

Where a legal claim, regulatory investigation or law enforcement request is live, we retain relevant data until it concludes.

12. Your rights

You have the right to:

• be informed about how we use your data — this notice
• access a copy of the data we hold about you
• rectify inaccurate or incomplete data
• erase your data ("right to be forgotten"), where no overriding legal basis applies
• restrict processing while a dispute is resolved
• data portability — receive data you gave us in a machine-readable format
• object to processing based on legitimate interests, and to direct marketing at any time
• withdraw consent at any time, including consent to processing special category data
• not be subject to solely automated decisions with legal or similarly significant effects, and to obtain human review

To exercise any of these, contact toc@virtualtalk.co.uk or write to us at the registered office above.

We respond within one month. We may extend by two further months for complex requests, and will tell you if we do. There is no charge unless a request is manifestly unfounded or excessive.

We will verify your identity before acting on a request. This protects you.

Removing content you have posted

If you want content removed, contact toc@virtualtalk.co.uk or use the process in our Complaints, Reporting and Takedown Policy. Where the content shows you and was shared without your consent, we treat it as urgent — see that policy for the intimate image takedown route.

13. Complaining

If you are unhappy with how we handle your data, tell us first at toc@virtualtalk.co.uk so we can put it right.

You also have the right to complain to a supervisory authority:

• UK: Information Commissioner's Office, ico.org.uk/make-a-complaint, 0303 123 1113
• EU: your national data protection authority.

You do not need to complain to us first, and you can also seek a judicial remedy.

14. Children

The Services are for adults only. We do not knowingly collect data from anyone under 18. If we discover that a user is under 18 we will close the account immediately and delete the data, other than what we must retain to prevent re-registration or to comply with a legal obligation.

If you believe a minor is using the Services, or that content on the Services shows a minor, report it immediately using the route in our Complaints, Reporting and Takedown Policy. We report child sexual abuse material to the Internet Watch Foundation and to law enforcement.

15. Security

We use encryption in transit (TLS), access controls, and restrict staff access to personal data on a need-to-know basis. Payment card details are handled by our payment processor and are not stored on our systems.

No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights, we will tell you without undue delay, and we will notify the ICO within 72 hours where required.

16. Changes

We may update this notice. The version published here is the one that applies when you use the Services. Where changes are significant, we will notify registered members by email.

Contact: toc@virtualtalk.co.uk | Visional Media Limited, 30 Orange Street, London WC2H 7HF