VoxParties
Controller: the customer organisation that buys the channel.
Processor: Vox, the platform provider.
What Vox does as processor
Receives encrypted report submissions, stores encrypted case content and attachments, supports handler follow-up, provides case management tools, and generates aggregated statistics that do not identify a reporter.
Instructions and confidentiality
Vox only processes personal data on documented instructions from the controller. Staff with platform access are bound to confidentiality. Case content remains encrypted; Vox does not hold the keys that can read it.
Sub-processors
Customer organisations give general authorisation for the sub-processors listed on the sub-processor register. Material changes are notified at least 30 days in advance.
Security measures
Browser-side encryption for report content, EU (Frankfurt) data residency, passkey and TOTP staff authentication, hash-chained audit logging of staff actions, and session controls.
Breach notification
Vox will notify the controller without undue delay after becoming aware of a personal data breach affecting the service.
Return and deletion
At the end of the service, personal data is returned or deleted in line with the signed agreement and the controller’s retention choices, unless UK law requires longer storage.