1. Who to ask
Voxa is the controller for the data used to run accounts, matching, study administration, rewards, support, safety and platform security. Send us requests about any of that.
A researcher is a separate controller for the responses and other information collected inside their study. They must answer requests about that data, and their own privacy notice tells you how to reach them.
The exception is a study built with Voxa's own tools. There we hold the responses as the researcher's processor, so the researcher still decides, but we can act on their instruction, and we will pass your request to them.
If you are not sure which applies, send it to us. We will handle our part and, where we lawfully can, help you identify the researcher's contact route without exposing anyone else's data.
2. The rights themselves
| Right | What it means in practice |
|---|---|
| Be informed | Receive clear information about what we collect and why. That is what the privacy notices are for. |
| Access | Confirm whether we process your data, get a copy of it, and get the supporting information the law requires. |
| Rectification | Have inaccurate data corrected and incomplete data completed. |
| Erasure | Have data deleted where no overriding lawful reason requires us to keep it. Our Account Deletion guide explains how this works on Voxa. |
| Restriction | Ask us to pause most uses of your data while accuracy, an objection or a legal issue is worked out. |
| Portability | Receive data you gave us, in a structured, commonly used, machine-readable format. Account & privacy gives you a JSON export immediately. |
| Object | Object to processing based on legitimate interests, given your particular situation. You can object to direct marketing at any time and we must stop. |
| Withdraw consent | Stop future consent-based processing. This does not make earlier processing unlawful. |
| Automated decisions | Get human intervention, express your view and contest the outcome where a decision is made about you solely by automated means and has legal or similarly significant effects. |
3. Automated processing on Voxa
Two things on Voxa are automated and worth being explicit about.
Matching. We compare a study's criteria against your profile to decide which studies to show you. That is profiling. It is not a decision with legal or similarly significant effects: a study you do not match is simply not displayed, and no service is denied to you. You can see and change every answer that feeds it.
Integrity checks. Signals such as a country change, VPN or proxy detection, a device fingerprint shared with another account, or an unusually fast completion, can provisionally limit access to studies or flag an account for review. Where an automated control has restricted your account, you can ask for a human to review it, put your side, and contest the outcome. We will tell you the outcome and the reasons, unless explaining them in detail would compromise our fraud controls; in that case we will tell you as much as we safely can.
Significant decisions (suspensions, bans, identity outcomes, appeal decisions) are made by a person with a recorded reason. They are not made solely by automated means.
4. Optional sensitive answers
Some optional demographic answers are special category data: racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life or sexual orientation. We hold these separately from your ordinary profile and rely on your explicit consent, alongside a lawful basis under Article 6.
Every one of these answers is optional. You can delete an individual answer or the whole sensitive profile at any time, and doing so withdraws your consent for future use. A short cooldown applies before the same answer can be re-entered, which exists to stop people changing answers to chase particular studies.
Researchers never receive your sensitive profile. Matching happens on our servers, and only the eligibility information relevant to a study you actually join is made available.
Researchers are prohibited from collecting special category data in studies built with Voxa's own tools. If one asks, return the study and report it.
5. Making a request
Use the Contact page and choose Privacy and data rights. Signed-in users can also use Account & privacy to update preferences, download an account export or request deletion.
We may ask for proportionate verification that you are who you say you are: enough to protect you from someone else obtaining your data, and no more. We respond within one month. Complex or numerous requests can lawfully take up to a further two months, and if that applies we will tell you within the first month and explain why.
Requests are free. The law allows a reasonable fee, or a refusal, where a request is manifestly unfounded or excessive, particularly if it is repetitive. We will explain if we ever rely on that.
Someone can make a request on your behalf if you have authorised them and they can show that authority.
- Use Account & privacy to correct your profile, change your choices, download a JSON export of your account data, or request deletion. These are immediate and do not need our involvement.
- Use the Contact page and choose Privacy and data rights for access, restriction, objection, wider portability, or anything the account controls do not cover.
- Tell us which right you want to use, and the account email or support reference involved. That is usually all we need.
- Do not send identity documents unless we specifically ask for them through a secure route. We will not ask you to email a passport.
6. What we may withhold or keep
We may redact another person's personal data, confidential legal advice, information that would reveal our security or fraud-detection controls, and material covered by an applicable exemption. Disclosing how fraud detection works would let people evade it, which harms every honest participant.
We may keep financial, tax, consent, audit, fraud, dispute and legal-claims records where the law or a compelling legitimate need requires it, even after you have asked for erasure. The Account Deletion guide sets out exactly what survives deletion and why.
Where we withhold or retain something, we will tell you the basis for it unless the law prevents us from doing so.
7. Complaints
If you think we have mishandled your data or your request, tell us through the Contact page and we will look at it properly.
You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority in the country where you live or work. You do not have to come to us first, and complaining to us does not affect your right to go to a regulator afterwards.
If you are in the EEA or Switzerland, our Participant and Researcher Privacy Notices set out how to reach us and any representative we have appointed.
8. Rights outside the UK and EEA
Some jurisdictions give rights that go beyond, or work differently from, UK and EU data protection law: the right to know what is sold or shared, the right to opt out of targeted advertising, the right to appeal a refused request, and specific rules for health data.
Our Regional privacy addenda cover California, other US states including consumer health data, and jurisdictions in Asia-Pacific and beyond. Where an addendum applies to you, it prevails over this document to the extent of any conflict.