1. Scope and controller
This notice applies when you browse Voxa's public pages, use a registration or login page without completing an account, or send us a support request. It also covers people we deal with in other capacities: suppliers, journalists, general enquirers and applicants.
Voxa Research Ltd, a company registered in England and Wales with company number 17430382 and registered office at 141 Belgrave Road, Leicester, United Kingdom, LE4 6AS is the controller for this data.
Voxa Research Ltd is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration reference ZC235808. The registration runs from 1 September 2026 to 31 August 2027 (Tier 1).
If you hold an account, read the notice for your role as well (the Participant Privacy Notice or the Researcher Privacy Notice), which covers everything you do while signed in.
Voxa is established in the United Kingdom and offers the service to people in the European Economic Area, so the EU GDPR applies to us as well as the UK GDPR. Article 27 of the EU GDPR requires a company in our position to designate a representative inside the EEA: a named organisation that acts as a local point of contact for you and for supervisory authorities on every issue relating to our processing, and that holds a copy of our record of processing activities. Contacting the representative is an alternative to contacting us, not a replacement, and it does not limit any action you can take directly against Voxa Research Ltd. Where Voxa Research Ltd has designated a representative, its name and contact details appear in this section; until then, people in the EEA should contact us through the Contact page and may complain to their own supervisory authority without approaching us first.
2. What we collect
We do not build advertising profiles of visitors, and no advertising or third-party analytics technology is connected in the current release.
- Technical request information needed to deliver and secure pages: request identifiers, general browser and device context, and network-derived security information.
- A one-way hash of your IP address rather than the raw address, together with a masked network range and country, region and city derived from it, used for rate limiting and abuse prevention.
- Your cookie and device-storage choices, your theme preference, and other device-local settings.
- Anything you enter in a registration, login, password recovery or contact form. Participant registration includes name, email address, date and place of birth, country of birth, and residential address.
- Correspondence with us, including any information you choose to put in it, and records of any business relationship we have with you such as invoices or contracts.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis under UK and EU GDPR |
|---|---|
| Deliver the website and remember your device-local choices | Our legitimate interests in operating a working, secure website (Article 6(1)(f)). |
| Protect forms, accounts and infrastructure from abuse, and apply rate limits | Our legitimate interests in security and fraud prevention. |
| Answer your enquiry and keep a record of it | Our legitimate interests in responding to enquiries and managing business relationships; or steps taken at your request before entering a contract (Article 6(1)(b)). |
| Diagnose faults and improve the site | Our legitimate interests in maintaining and improving the service. |
| Store or read non-essential information on your device, or send marketing | Your consent, which you can withdraw at any time. |
| Comply with law and respond to lawful requests | Compliance with a legal obligation (Article 6(1)(c)). |
5. How long we keep it
| Record | Retention |
|---|---|
| Access and security events | 90 days, then deleted automatically. |
| Contact and support requests that do not lead to an account or a business relationship | 12 months from the last message in the thread. |
| Correspondence and documents relating to a business relationship | Seven years from the end of that relationship, reflecting the limitation period for legal claims. |
| Transaction and payment records | Seven years from the transaction, to meet accounting and tax obligations. |
| Device-local storage | Until it expires, you clear it, or your browser clears it. It stays on your device and is not held by us. |
6. Your choices and rights
You have rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent, subject to the exemptions in the law. Our Data Protection and Your Rights document explains each one and how it works in practice.
Use the Contact page and choose Privacy and data rights. Signed-in users can also use Account & privacy to update preferences, download an account export or request deletion.
Use the cookie preference control at the bottom of any page to change your device-storage choices at any time.
You can complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority where you live or work. You do not have to contact us first.
7. Changes
We update this notice as the site, our providers or the law change, and post it here with a new effective date.