Privacy Policy
1. Introduction
This Privacy Policy ("Policy") explains how KINGSLEY AVENUE LTD (Company number 09955507), with its registered office at Ormond House 26/27 Boswell Street, Suite 2, London, England, United Kingdom, WC1N 3JZ (hereinafter "MobileXY", "we", "us", or "our"), collects, uses, stores, and protects your personal data when you use our services, including the MobileXY website and Progressive Web App at mobilexy.com, eSIM data plans, Virtual Numbers, the XY Coins balance, and our referral programme (collectively, "Services").
We are committed to protecting your privacy and will only process your personal data in accordance with this Policy, the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and other applicable data protection laws.
This Privacy Policy describes how we process your data. Please read it carefully to understand our practices regarding your personal data.
2. Key Definitions
"Personal Data": Any information relating to an identified or identifiable natural person.
"Processing": Any operation performed on Personal Data, such as collection, storage, use, or disclosure.
"Controller": KINGSLEY AVENUE LTD, which determines the purposes and means of processing your Personal Data.
"You" / "Your": Any user of our Services, including visitors to our website and Progressive Web App at mobilexy.com.
3. Data We Collect and How We Use It
We collect and use your Personal Data for specific, legitimate purposes, as outlined below.
Account & Registration Data
Includes name, email address, magic-link sign-in tokens, optional password hash, 2FA secret, and payment method details. We use it to create and manage your account, provide our Services, process payments, and communicate with you about your account. Legal basis: performance of a contract; legitimate interests (for customer support and service administration).
Technical & Usage Data
Includes your IP address, device type, browser type, website and PWA usage data, and essential cookies. We use it to ensure the technical functionality of our Services, to analyse and improve them, and for security and fraud prevention. Legal basis: legitimate interests.
Communication Data
Includes the content of your emails, support chats, or feedback. We use it to respond to your inquiries and provide customer support. Legal basis: legitimate interests.
eSIM & Service Usage Data
Includes data consumption, countries of use, ICCID, and profile lifecycle events. We use it to deliver and configure the Services you purchase, for billing, and to troubleshoot technical issues. Legal basis: performance of a contract.
Virtual Number Data
Includes the number you rent, sender numbers, the content of inbound SMS, and delivery / usage logs. We use it to receive and display SMS sent to your Virtual Number (typically OTP / verification codes from third-party services) and to administer the rental. Legal basis: performance of a contract.
Account balance / XY Coins Ledger
Includes top-ups, balance, purchase history, and transactions. We use it to manage your account balance and the Services purchased with it, and to comply with accounting and tax obligations. Legal basis: performance of a contract; legal obligation.
Referral Data
Includes referrer-invitee links, payout amounts and status, and fraud-check signals. We use it to administer the referral programme and to detect abuse or scripted self-referral activity. Legal basis: legitimate interests.
Marketing Data
Includes your preferences for receiving marketing communications. We use it to send you promotional offers and updates about our Services (with your consent). Legal basis: consent, which you can withdraw at any time by contacting us at support@mobilexy.com.
3.1 Virtual Number SMS Content
Where you rent a MobileXY Virtual Number, any SMS sent to that number is received through our upstream telecom partner and delivered to your account dashboard so that you can retrieve verification codes and other messages addressed to you. SMS content and sender numbers are stored only for as long as needed to deliver the message and provide an audit trail for billing (see Section 7). SMS content is never used for marketing, automated profiling, or shared with third parties beyond what is necessary to deliver the message and operate the Service. Senders' numbers and message content are visible only to you in your authenticated account area.
4. How We Share Your Personal Data
We may share your Personal Data with the following categories of recipients:
Service Providers — trusted third parties who assist us in providing our Services, such as payment processors, eSIM and virtual-number telecom partners, cloud hosting providers, email-delivery providers, and customer support platforms. These partners are bound by strict data processing agreements and are permitted to process your data only on our documented instructions.
Network Operators — partner mobile network operators globally to provide you with connectivity. We only share pseudonymised data (e.g., a unique identifier) necessary for the network to function, not your identifying information like your name or email.
Legal and Regulatory Authorities — where we are required to do so by law, or to protect our rights, property, or safety, or that of our users or others.
Professional Advisers — such as lawyers and accountants, where necessary.
We do not sell your Personal Data to third parties.
5. International Data Transfers
Our Services rely on partner networks worldwide. This means your pseudonymised usage data may be transferred outside the UK. When we do so, we ensure appropriate safeguards are in place, such as relying on UK adequacy regulations or using the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the Standard Contractual Clauses approved by the UK Information Commissioner's Office.
6. Data Security
We implement appropriate technical and organisational measures to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, access controls, and secure server infrastructure.
7. Data Retention
We will retain your Personal Data only for as long as necessary to fulfil the purposes outlined in this Policy, unless a longer retention period is required or permitted by law. Specifically:
Account data is retained for the lifetime of your account and for a reasonable period after closure to handle disputes and chargebacks.
SMS content received on Virtual Numbers is retained for ninety (90) days from delivery, after which it is purged from active systems.
Account balance / XY Coins transactions and invoices are retained for six (6) years to satisfy UK tax and accounting obligations.
Inactive accounts may be terminated as described in our Terms of Service.
When data is no longer needed, it will be securely deleted or anonymised.
8. Your Data Protection Rights
Under UK data protection law, you have the following rights:
Right of Access: You can request a copy of the Personal Data we hold about you.
Right to Rectification: You can request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): You can request deletion of your Personal Data in certain circumstances.
Right to Restrict Processing: You can request that we temporarily halt the processing of your data.
Right to Data Portability: You can request a machine-readable copy of your data to transfer to another service.
Right to Object: You can object to processing based on our legitimate interests.
Rights related to automated decision-making: We may apply limited automated checks to detect fraudulent referral activity (e.g., shared IPs, scripted account chains) and may automatically void affected referral payouts. We do not otherwise make decisions about you based solely on automated processing that produces legal or similarly significant effects. You may request human review of any automated decision by contacting support@mobilexy.com.
To exercise any of these rights, please contact us at support@mobilexy.com. We will respond to your request without undue delay and at the latest within one month. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests.
9. Cookies and Similar Technologies
Our website and PWA use only essential cookies required for the Service to function:
laravel_session — your authenticated session.
mx-theme — your dark / light theme preference.
Our website and PWA use essential cookies required for the Service to function, alongside an attribution cookie (mxy_ref) if you arrived via a referral link, which requires your explicit consent via our cookie settings.
CSRF tokens — to protect form submissions from cross-site request forgery.
We do not use marketing or third-party tracking cookies on our website or PWA. You can clear these cookies at any time through your browser settings.
10. Children's Privacy
Our Services are not intended for individuals under the age of 18. We do not knowingly collect Personal Data from children. We rely on your self-declaration of age at sign-up; if we become aware that we have collected such data, we will take steps to delete it.
11. Changes to This Policy
We may update this Policy from time to time. The "Last Updated" date at the end of this page will indicate when changes were made. We will notify you of any material changes via email or a prominent notice within our Services.
12. Contact Us
If you have any questions, concerns, or complaints about this Policy or our data practices, please contact us at:
Data Protection Officer
KINGSLEY AVENUE LTD
Ormond House 26/27 Boswell Street, Suite 2
London, England, WC1N 3JZ
Email: support@mobilexy.com
If you are not satisfied with our response, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: https://ico.org.uk/make-a-complaint/
Phone: 0303 123 1113