VoxWho this notice covers
This notice covers people who submit a report through a Vox channel, and staff who handle cases for a customer organisation.
Who is responsible
The customer organisation that bought the channel is the data controller. It decides why reports are collected and how cases are handled.
Vox is the data processor. It provides the platform and processes data on the organisation’s instructions under a data processing agreement.
What we process
Report content (written concern text). File attachments are not supported in the current release. Optional identity details if the reporter chooses a confidential or open route. Handler account details such as name, work email, and authentication data. Audit events that record who did what, not the plaintext of the report.
Reporter IP addresses are not stored with the report. The facts in a report can still identify someone.
Why it is processed
To receive and manage workplace concerns, allow follow-up through a case key, support investigation by authorised handlers, keep an audit trail, and operate the annual subscription.
Where data is held
Data, backups, and processing are hosted in the European Union (Frankfurt) on Render.
Security
Reports are encrypted in the browser before storage. Vox stores ciphertext and does not hold the keys that can read case content. Staff sign in with a passkey and an authenticator app backup.
Retention
Retention follows the customer organisation’s settings and legal needs. When a subscription ends, data is returned or deleted under the data processing agreement.
Your rights
Depending on your role, you may have rights of access, correction, erasure, restriction, and objection under UK GDPR. Requests about a report should usually go to the customer organisation as controller. Platform requests can be sent to privacy@vox.uk.