Privacy Policy

1. Planet XO and the organisations responsible

Planet XO is the shared trading and network brand connecting XO Radio LTD and QT FM Studios. It is not a separately incorporated company and has no company registration number of its own.

A data controller is the person or organisation that decides why and how your personal information is used. Responsibility follows the actual processing of information, rather than the shared brand name.

Shared website and general enquiries controller: XO Radio LTD & QT FM Studios.

XO Radio LTD

Registered legal name: XO RADIO LTD
Company number: 15632388
Registered in: England & Wales.

Its station network includes XO Radio (North West), Blast Radio (Yorkshire & Humber), Every Radio (East of England), Beats Radio (London) and Numb Radio (UK-wide 80s).
> Visit XO Radio LTD.

QT FM Studios

Registered legal name: QTFM Studios
Company number:
Registered in: England & Wales.

Privacy contact: [email protected].

Its station network includes QT FM, QT FM Gold, QT FM Mix and QT FM Hits.
> Visit QT FM Studios.

Each partner is responsible for processing it independently controls. This does not mean all information is automatically shared between partners. If both partners jointly decide the purposes and means of a particular activity, the notice for that activity must explain their joint responsibilities and how you can exercise your rights.

2. Information covered by this policy

Depending on how you use our services, information may include your name and contact details; messages, song requests and submitted recordings; competition entries and prize-delivery details; advertising enquiries and contractual records; and recruitment information such as applications, CVs and relevant experience.

Technical and listening information: When you listen through our website or app, listener location information is collected through our radio hosting provider as part of delivering the stream. For app downloads, we use download counts supplied by Google Play and the Apple App Store. These counts do not describe individual listening activity.

Separately, qtfm.co.uk offers local weather using browser location permission. Where permission is granted and the location feature completes, coordinates are sent to BigDataCloud to identify the locality and to Open-Meteo to obtain weather information. London is used as a fallback if location is unavailable. This weather feature operates separately from listening.

Please do not send sensitive information unless it is needed for a clearly explained purpose. Where health information, criminal-record information or other specially protected information is necessary, the relevant operator must explain the additional legal conditions and safeguards that apply.

3. Why information is used and the lawful basis

The relevant controller must identify the lawful basis for each activity. The following describes the intended approach for activities offered through the network; specific forms or service notices should explain any differences.

• General enquiries and listener requests: legitimate interests in answering messages and providing listener services, balanced against your rights. Sending a message does not itself mean consenting to unrelated marketing.
• Advertising enquiries and bookings: taking requested steps towards, or performing, a contract with you where applicable; legitimate interests in communicating with representatives of business customers; and legal obligations for required records.
• Recruitment: legitimate interests in assessing applicants and organising recruitment, or necessary steps towards a contract where applicable. A vacancy notice should explain the basis used for that role.
• Competitions: administering the entry and prize under the competition arrangements, with the specific lawful basis identified in the competition notice. Any optional publicity or marketing is explained separately.
• Optional marketing: consent where required, with a clear way to unsubscribe. Marketing messages must also meet applicable electronic-marketing rules.
• Security and troubleshooting: legitimate interests in protecting services, preventing misuse and resolving technical problems, using only information reasonably needed for those purposes.
• Legal requirements: complying with obligations that require particular information to be processed or retained.

Where consent is used, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before you withdrew. If a new use of information is proposed, you will receive the relevant privacy information before that use begins.

4. Where information comes from and whether it is required

Information may come directly from you, from the devices or platforms used to access a service, or from another person you have authorised to act for you. If information is obtained from another source, the relevant notice must identify that source and the categories of information received.

Providing information is generally your choice. Some details are needed to answer an enquiry, process an application, arrange a booking or deliver a prize. The relevant form or agreement should explain what is required, any contractual or statutory requirement, and what happens if it is not provided.

5. Messages, broadcasts and publicity

A message intended for broadcast may include a name, location or contribution that will be heard publicly. The relevant station should explain this when collecting the contribution and identify its lawful basis. Do not send private information you do not want included in a public contribution.

Competition winner announcements, recorded interviews and promotional use of photographs or recordings must be explained in the relevant notice. A website visit or general enquiry does not automatically authorise those uses.

6. Sharing information

Information may be accessed by authorised team members and service providers supporting the relevant activity, such as website hosting, streaming, email, recruitment systems or prize delivery. Access should be limited to what is needed, with appropriate safeguards and agreements where providers process information on a controller’s behalf.

An enquiry may be routed to the partner or station you selected. If the correct recipient is unclear, this should be clarified before unnecessary information is passed on. Shared branding does not justify unrestricted access to another partner’s information.

Information may also be disclosed where required by law or where lawfully necessary to establish, exercise or defend legal claims. Specific service notices should identify any additional recipients.

Our technical service providers

• Website, App & On Air Metadata services: provided by Kane Productions.
• Web & Radio hosting: provided by XO Hosting.

These are service providers supporting the network. Providing a technical service does not, by itself, make a provider the controller of all listener or applicant information. Their access and data protection responsibilities depend on the services and arrangements involved. Where they handle personal information on behalf of a controller, appropriate processing terms and safeguards are required. Any processing for their own purposes must be explained separately.

7. Third-party services and listening platforms

External websites and platforms, including Twitch, YouTube, Alexa, Fire TV and Roku, may process information under their own privacy policies when you use their services. Availability differs by station and device.

An embedded player or video may send technical information to its provider. The relevant cookie and service information should identify the provider and explain any controls or consent required before loading it. A link to another website does not mean the partner networks control that website’s processing.

8. Cookies and similar technologies

Some or all websites, apps and services across Planet XO and its partner networks may use the technologies listed below. Their use varies between networks, stations and services, so not every technology applies to every website or app.

Cookies are small files stored on your device. Similar technologies, including local storage, can also remember information in your browser. These technologies may support website features, remember preferences, protect services or provide advertising and performance measurement.

Cookie preferences and browser storage

• QT FM cookie-notice preference: qtfm.co.uk uses a local-storage entry named qtfmCookies to remember that its cookie notice has been dismissed. It has no automatic expiry set by the website code and remains until cleared by you, your browser or a later website update. This entry does not itself record separate advertising preferences.
• QT FM weather cache: qtfm.co.uk uses qtfmWeatherCache in local storage to remember a place name, temperature, weather code and timestamp. Cached information is reused for up to 30 minutes before being refreshed. The stored entry is not automatically deleted after 30 minutes; it remains until overwritten or cleared.

Advertising, security and performance services

• Google AdSense: qtfm.co.uk includes Google’s advertising service. Google may use cookies and similar technologies to deliver and measure advertising and, where permitted, personalise ads. The technologies used depend on the service configuration, your choices and browser settings. Read Google’s cookie information .
• hCaptcha: the XO Radio website uses hCaptcha to help protect forms against spam and automated misuse. It may process technical and interaction information and use cookies or similar technologies for its operation. Read hCaptcha’s privacy and cookie information .
• Cloudflare performance measurement: where Cloudflare Web Analytics is enabled, it collects website performance and usage metrics. Cloudflare states that this analytics service does not use cookies or local storage to collect those metrics. Other Cloudflare services, including security features, may operate differently. Read about Cloudflare Web Analytics .

External media and platforms

Twitch, YouTube, Mixcloud and other external platforms have their own privacy and cookie arrangements. Following a link takes you to the provider’s service. Where content is embedded within a network website, the provider may receive technical information and use cookies or similar technologies when that content loads.

Your choices

Where consent is required for advertising or other optional technologies, it must be obtained before those technologies are used. Dismissing a notice or continuing to browse does not, by itself, give that consent.

You can use your browser settings to block or delete cookies and clear local storage. Where a service provides consent controls, you can also use those controls to manage your choices. Blocking technologies needed for a requested service may affect how that service works.

9. How long information is kept

Each partner network keeps personal information only for as long as needed for the purpose it was collected, including any applicable legal requirements. Information is then securely deleted or anonymised.

• General enquiries and listener messages: normally kept for up to 12 months after the enquiry has been resolved, unless an ongoing complaint or another justified purpose requires longer retention.
• Unsuccessful recruitment applications: normally kept for up to six months after the recruitment process ends. Keeping an application for future opportunities will be explained and agreed separately.
• Successful applicants and team members: relevant information is kept for the duration of the relationship. Any retention afterwards depends on the record type and applicable legal obligations, as explained in the relevant team privacy notice.
• Competition entries: normally kept for up to six months after prizes have been delivered and any outstanding issues resolved. Records needed for accounting or a dispute may be retained longer.
• Advertising enquiries: normally kept for up to 12 months after the last meaningful contact if no booking is made.
• Advertising bookings and financial records: retained for the period required by applicable accounting and tax rules. For XO Radio LTD, relevant company tax records are normally kept for at least six years from the end of the accounting period they relate to, and longer where required.
• App download statistics: aggregate download counts may be retained for reporting and planning where they do not identify individual users.
• Cookies and browser storage: retention varies by technology, as explained in Section 8. Some local-storage entries remain until overwritten or cleared.

Records may be retained longer where reasonably necessary to handle a complaint or dispute, meet a legal obligation, or establish, exercise or defend legal claims. This does not mean that all information is retained indefinitely.

10. Security and international transfers

Appropriate technical and organisational measures are required to protect personal information. These should reflect the information held and the risks involved. No online transmission can be guaranteed completely secure.

International transfers: Our website hosting is located in the United Kingdom, and backups are stored in Manchester, United Kingdom. We also use Cloudflare, a US based provider operating a global network. Depending on the services used, personal information may be processed outside the United Kingdom, including in the United States and European Economic Area. Cloudflare provides international transfer safeguards through its data processing agreement, including the UK Extension to the EU–US Data Privacy Framework for covered US transfers, and Standard Contractual Clauses with the UK Addendum where applicable.

11. Automated decisions and profiling

None.

12. Your rights

Depending on the processing and applicable law, you may have rights to access your information, correct inaccuracies, request erasure, restrict processing, object to processing, and receive or transfer certain information. You can withdraw consent where processing relies on it and object to the use of your information for direct marketing.

Some rights have legal limits or exceptions. You can also ask for information about any applicable safeguards concerning automated decisions. The relevant controller will explain the position when responding to your request.

Use the contact details below and identify the station or service involved. Reasonable information may be requested to verify your identity. Requests are normally answered within one month, subject to lawful extensions or other applicable rules; you will be told if an extension applies.

13. Children and young people

Young people should avoid sharing unnecessary personal information publicly. A service aimed at children, a young person’s competition or any collection requiring parental authorisation needs appropriate age information, safeguards and a clear notice for that activity.

14. Contact and complaints

For a privacy question or rights request, use our contact page, select the relevant station or network, and mark your message “Privacy”.
Contact Information for this can be found in Section 1.

You may complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. You can contact the relevant controller first so it can try to resolve your concern, but this does not remove your right to complain to the ICO.

15. Changes to this policy

This policy may be updated as services or processing change. The date above identifies the current version. Material changes should be brought to your attention where appropriate. Updating a policy does not itself provide consent or a lawful basis for a new use of information.