1. Scope
This Addendum applies to California residents, under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 and its regulations (the "CCPA"). It supplements our Participant, Researcher and Website Visitor Privacy Notices. Where it conflicts with them, this Addendum prevails for California residents.
It applies only to the extent that Voxa Research Ltd is regulated as a "business" under the CCPA, and only to personal information within the CCPA's scope. In this Addendum "personal information" has the meaning given by the CCPA and excludes deidentified or aggregated information, publicly available information, and anything otherwise outside that definition.
Where a researcher runs a study, that researcher is the business for the personal information you give inside their study, and their notice applies. Where a study is built with Voxa's own tools, we act as a service provider to that researcher for your responses.
2. We do not sell or share your personal information
Voxa has not sold personal information in the preceding 12 months, does not sell it, and will not sell it. "Sell" has the broad CCPA meaning: disclosing personal information to a third party for monetary or other valuable consideration.
We also do not "share" personal information, meaning we do not disclose it to a third party for cross-context behavioural advertising, whether or not money changes hands. We run no advertising network integrations and set no advertising cookies.
Because we neither sell nor share, there is nothing for you to opt out of under the right to opt out of sale or sharing. If that ever changes we will update this Addendum first, provide a conspicuous "Do Not Sell or Share My Personal Information" link, and honour opt-out preference signals.
We have no actual knowledge that we sell or share the personal information of consumers under 16 years of age. Voxa is not available to anyone under 18.
3. Categories we collect
We collect and use each category for the business and commercial purposes set out in the "Why we use it" section of the privacy notice for your role, and we retain each category for the periods set out in that notice's retention table.
| CCPA category | What we collect | Sources | Disclosed for a business purpose to |
|---|---|---|---|
| A. Identifiers | Name, email address, account credentials, participant identifier, country and region derived from a hashed IP address, and records of studies you took part in. | You; our verification, payment and network-classification providers. | Researchers (pseudonymous identifier only), service providers. |
| B. Customer records (Cal. Civ. Code §1798.80(e)) | Name, address information, identity document details, education and employment information. | You. | Service providers; researchers, limited to eligibility information for a study you joined. |
| C. Protected classification characteristics | Optional demographic answers that may include race, ethnicity, religion, marital status, medical condition, disability, age, gender and sexual orientation. | You, and only if you choose to answer. | Service providers; researchers, limited to the screening answers relevant to a study you joined. |
| D. Commercial information | Rewards earned and paid, wallet balance, deposits, withdrawals and transaction references. | You; our payment providers. | Service providers; tax authorities where reporting rules require it. |
| E. Biometric information | None. We do not create, derive or store biometric identifiers or templates. Identity verification is a human review of a document and a short video, and both files are deleted once a decision is recorded. | Not applicable. | Not applicable. |
| F. Internet or network activity | A one-way hash of your IP address, masked network range, derived location, browser and device context, device fingerprint hash, request identifiers, session and login events. | Collected automatically. | Service providers. |
| G. Geolocation data | Country, region and city derived from a hashed IP address. We do not collect precise geolocation. | Collected automatically. | Service providers. |
| H. Audio, electronic, visual or similar information | A short identity verification video, deleted once a decision is recorded. Any audio, video or images you upload in a Voxa-hosted study, deleted six months after submission. | You. | Service providers; the researcher running the study. |
| I. Professional or employment information | Employment status, job title, department, sector, research area and organisation. | You. | Service providers; participants viewing a researcher's study listing. |
| J. Education information | Education level and student status. | You. | Service providers; researchers, where relevant to a study you joined. |
| K. Inferences | Eligibility matches derived from your profile answers. We do not build behavioural, advertising or personality profiles. | Derived by us. | Not disclosed. Matching happens on our servers. |
4. Sensitive personal information
We collect the following sensitive personal information: government identifier details from an identity document; account log-in credentials; and, only where you choose to provide them, optional answers revealing racial or ethnic origin, religious or philosophical beliefs, health, sex life or sexual orientation. Where you use platform messaging, the contents of those messages may be sensitive personal information, and we access them only where necessary, for example to address a report of abuse.
We use sensitive personal information only for purposes permitted by section 7027(m) of the CCPA regulations: performing the service you asked for, verifying identity, ensuring security and integrity, detecting and preventing fraud, and complying with law. We do not use it to infer characteristics about you, and we do not sell or share it.
You are not required to provide any optional demographic answer, and you can delete an individual answer or your whole sensitive profile at any time in Account & privacy. That is the practical way to limit our use of your sensitive personal information, and it takes effect immediately.
5. Your California rights
You may make a request to know or a portability request no more than twice in any 12-month period.
We may deny a deletion request where retaining the information is reasonably necessary to complete a transaction, provide a service you asked for, ensure security and integrity, debug errors, exercise free speech, engage in peer-reviewed research where deletion would seriously impair it, enable internal uses reasonably aligned with your expectations, or comply with a legal obligation. Where we deny a request in whole or part, we will tell you why.
- Right to know. Ask us to disclose the categories and specific pieces of personal information we collected about you, the categories of sources, our business or commercial purposes, and the categories of third parties to whom we disclosed it.
- Right to delete. Ask us to delete personal information we collected from you, subject to the exceptions in the CCPA.
- Right to correct. Ask us to correct inaccurate personal information, taking into account its nature and the purposes of processing.
- Right to data portability. Receive the personal information you provided in a readily usable format that lets you transmit it elsewhere.
- Right to limit use of sensitive personal information. We use sensitive personal information only for permitted purposes, so this right is not engaged, but you can delete optional sensitive answers yourself at any time.
- Right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of.
- Right to non-discrimination. We will not deny you service, charge you a different price, give you a lower quality of service, or retaliate against you for exercising a CCPA right.
6. How to exercise your rights
Use the Contact page and choose Privacy and data rights. Signed-in users can also use Account & privacy to update preferences, download an account export or request deletion.
Only you, or someone you have authorised to act on your behalf, may make a verifiable consumer request. An authorised agent must provide proof of their authority. You may also make a request on behalf of your minor child, although Voxa is not available to anyone under 18.
Your request must give us enough information to verify that you are the person we collected the information about, and enough detail for us to understand and respond to it. Depending on the request, we may verify you by asking questions about information we already hold, or by contacting you at the address on your account. We use information you provide for verification only for that purpose. You do not need an account with us to make a request.
We acknowledge requests within 10 business days and respond within 45 days. If we need longer, we may take up to a further 45 days and will tell you why within the first period. We deliver our response through your account where you have one, and otherwise by email or post at your option. Requests are free unless they are manifestly unfounded or excessive, particularly because they are repetitive, in which case we may charge a reasonable fee or decline and tell you why.
7. Opt-out preference signals
Because we do not sell or share personal information and serve no targeted advertising, there is no processing for a universal opt-out mechanism such as Global Privacy Control to act on.
If we ever introduce processing that engages the right to opt out, we will process opt-out preference signals, including Global Privacy Control, in a frictionless manner, and will apply the signal to the browser or device it came from and to any profile we can associate with it.
8. Contact and changes
Questions about this Addendum or our California privacy practices can be sent through the Contact page, choosing Privacy and data rights.
We review this Addendum at least annually, as the CCPA requires, and update it whenever our practices change.