At a glance
Voxa Research Ltd, a company registered in England and Wales with company number 17430382 and registered office at 141 Belgrave Road, Leicester, United Kingdom, LE4 6AS ("Voxa", "we", "us" or "our") is the controller for personal data used to register researchers, verify organisations, operate workspaces, publish studies, fund rewards, manage disputes and secure the marketplace. This notice applies to individual researchers and to people acting for an organisation.
Voxa Research Ltd is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration reference ZC235808. The registration runs from 1 September 2026 to 31 August 2027 (Tier 1).
This notice is about data we hold *about you*. It is not about the data you collect from participants: for that you are the controller, and section 7 explains what that means.
Voxa is established in the United Kingdom and offers the service to people in the European Economic Area, so the EU GDPR applies to us as well as the UK GDPR. Article 27 of the EU GDPR requires a company in our position to designate a representative inside the EEA: a named organisation that acts as a local point of contact for you and for supervisory authorities on every issue relating to our processing, and that holds a copy of our record of processing activities. Contacting the representative is an alternative to contacting us, not a replacement, and it does not limit any action you can take directly against Voxa Research Ltd. Where Voxa Research Ltd has designated a representative, its name and contact details appear in this section; until then, people in the EEA should contact us through the Contact page and may complain to their own supervisory authority without approaching us first.
1. What we collect
We receive information from you, from your workspace owner or administrators, from researchers who invite you, from participants who interact with your studies, from our service providers, and from records generated as you use the platform.
- Account: name, work email address, password credential, role, verification state and multi-factor status.
- Professional and organisation: job title, department, sector, research area, organisation name and country, contact email, workspace membership and role, invitations you send or accept, and any verification evidence you provide.
- Study: drafts and published listings, eligibility rules and saved audience filters, external study addresses, study content you build with our own tools, ethics references, data-protection declarations, participant limits, rewards, quotas and schedules.
- Financial: deposits, wallet and ledger entries, invoices and transaction references (including PayPal order and capture references), refunds, bonuses awarded, and payment provider status. We never receive your PayPal sign-in details or raw card details.
- Operational: submissions you review, review decisions and reasons, messages, reports, appeals, participant lists you create, support cases, administrator decisions and audit events.
- Technical and security: a one-way hash of your IP address, a masked network range, country, region and city, limited browser and device context, a device fingerprint hash, request identifiers, session and login events, and risk signals.
2. Why we use it, and our lawful basis
| Purpose | Lawful basis under UK and EU GDPR |
|---|---|
| Open and administer accounts, workspaces and studies | Performance of our contract with you (Article 6(1)(b)). |
| Verify your identity, affiliation and organisation | Performance of our contract, and our legitimate interests in marketplace integrity and fraud prevention (Article 6(1)(f)). |
| Process funding, rewards, fees and refunds | Performance of our contract, and compliance with a legal obligation for accounting and tax records (Article 6(1)(c)). |
| Send service communications, team invitations and platform notices | Performance of our contract, and our legitimate interests in operating the service. |
| Prevent fraud, enforce our rules and resolve disputes and appeals | Our legitimate interests in protecting participants, other researchers and the service, and in the establishment or defence of legal claims. |
| Review study content and submissions in a Voxa-hosted study, for compliance, safeguarding and troubleshooting | Our legitimate interests in ensuring lawful use of our own tools and in supporting and improving the service. |
| Keep accounting, tax and compliance records | Compliance with a legal obligation. |
| Send optional product updates, or use non-essential analytics or storage | Your consent. Where we contact you as a business contact at your organisation, our legitimate interests, and you can opt out at any time. |
| Improve the platform using aggregated or anonymised data | Our legitimate interests in understanding and improving the service. |
4. Studies you build on Voxa
Where you use our own task or survey tools, we hold your study content and your participants' responses. We keep that content confidential and do not use it for our own research or commercial purposes.
We may review it to confirm you are complying with our terms, where a safeguarding concern or participant complaint arises, to resolve a dispute or appeal, and for troubleshooting and platform improvement. The full position, including our obligations as your data processor, is in the Voxa-Hosted Study Terms for Researchers.
Responses to a Voxa-hosted study are deleted six months after they are submitted. Export what you need before then.
5. International transfers
Some of our providers process data outside the United Kingdom. Where a transfer is not covered by a UK or European Commission adequacy decision, we use an approved safeguard supported by a transfer risk assessment. Our International Data Transfers document sets out the mechanism for each provider.
Where we make participant data available to you outside the UK and EEA, that transfer is governed by the transfer clauses in the Researcher Terms, and, for responses to a Voxa-hosted study, by the Voxa-Hosted Study Terms for Researchers. You remain responsible for onward transfers of the study data you control.
6. How long we keep it
| Record | Retention |
|---|---|
| Access and security events | 90 days, then deleted automatically. |
| Account, workspace and study records | While the account is active, and up to 12 months after closure, except where a balance remains outstanding, in which case until it is resolved. |
| Study content and responses in a Voxa-hosted study | Six months from submission, then deleted automatically. |
| Financial, invoicing and tax records | Seven years from the transaction, to meet accounting and tax obligations. |
| Support requests and platform messages | Three years from the last message in the thread, or from account closure if later. |
| Reports, appeals, disputes and enforcement records | Up to seven years, reflecting the limitation period for legal claims in England and Wales. |
| Consent and audit records | Seven years, so we can demonstrate what was agreed and how decisions were made. |
| Aggregated or anonymised records | Indefinitely. No individual can be identified from them. |
7. Your responsibilities for participant data
You are an independent controller for personal data you collect in your study. Before you collect anything you must give participants a compliant privacy notice, identify a lawful basis and any special-category condition, collect only what you need, set a retention period, give a rights contact, secure the data and handle international transfers lawfully.
We provide a pseudonymous participant identifier and limited study-administration information. You must not attempt to identify or re-identify a participant, combine data to reveal them, contact them outside approved channels, or use their information for an unrelated purpose. Where you use participant lists to re-invite or exclude people, say so in your privacy notice.
If a participant asks you about data you control, you must handle that request. We will help identify the right contact route where we can, but we cannot answer for you and we cannot erase data from systems we do not control.
8. Your rights and how to complain
Depending on the processing, you have rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent. You also have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects: significant enforcement decisions on Voxa involve a person and a recorded reason.
Use the Contact page and choose Privacy and data rights. Signed-in users can also use Account & privacy to update preferences, download an account export or request deletion.
We respond within one month; complex or numerous requests may lawfully take longer, and we will tell you if so. We may withhold information that would reveal another person's data, our security or fraud controls, or privileged material.
You can complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority where you live or work. We would like the chance to put things right first, but you do not have to come to us before going to a regulator. Voxa Research Ltd's registered details are set out at the top of this notice.
9. Changes
We update this notice as the product, our providers or the law change. We post changes here with a new effective date and, where a change materially affects you, notify you on the platform or by email.