Trust & compliance
Privacy Policy
Last updated: 2026-10-09
This policy explains what personal data Provoxis Ltd ("Provoxis", "we", "us") collects, why, how it is protected, and what rights you have — for visitors to this website, for the organisations ("customers") that subscribe to Provoxis, and for the people who use a customer's reporting channel. It is written to the UK GDPR and the EU GDPR. It should be read together with our Terms of Service and our Data Processing Agreement, which govern the same relationship from different angles.
Who we are
Provoxis Ltd, company number 17472067, registered office at Grosvenor House, 3 Chapel Street, Congleton, England, CW12 4AB, is the controller described in this policy wherever it refers to data we hold as controller (see "Two different roles" below), and the processor wherever it refers to report data we handle on a customer's behalf. Our contact details, our data protection contact, and — once appointed — our Data Protection Officer and our EU Article 27 representative are in the "How to contact us" section at the end.
Two different roles, two different sections
Provoxis acts in two distinct capacities, and this policy is split accordingly. As a **data controller**, we decide why and how we process data about this website's visitors, our prospective and paying customers, and the individual staff accounts (admins, case handlers) customers create. As a **data processor**, we process report content and reporter data on a customer's behalf, strictly under that customer's instructions and our Data Processing Agreement — for that data, the customer organisation is the controller, not Provoxis. If you submitted a report through a customer's reporting channel, this policy explains how that data is technically handled and protected, but the customer's own privacy notice — shown on their intake form — is the primary source for how they, as controller, use it.
Data we collect
This section describes every category of personal data the service handles, grouped by who it is about. Sections marked "processed on a customer's behalf" are data for which the customer, not Provoxis, is the controller.
Website visitors
When you browse this marketing site we keep our own basic, aggregate usage statistics — which pages are viewed, from which country, from which referring website, and, if you arrived from a campaign link, the campaign tags (utm_source, utm_medium, utm_campaign) in that link's address. This is measured on our own servers, without cookies and without any identifier stored on your device. To derive the approximate country we briefly process your IP address using a local database licensed from DB-IP (which requires the attribution "IP Geolocation by DB-IP"); the IP address itself is never written to a log and never stored. To count unique visitors without tracking you, each recorded page view carries a one-way visitor code that is re-derived daily from your IP address and browser, cannot be reversed, and cannot be linked from one day to the next — and it is erased entirely within about two days, once that day's events have been counted. Individual records are kept for at most 90 days; only anonymous aggregate totals are kept after that. How this relates to cookies is covered under "Cookies" below.
Prospective and paying customers
When an organisation registers for Provoxis, we collect the registering admin's name and email address, the organisation's company name and chosen subdomain, and billing information (processed by our payment provider, Stripe — we never see or store full card numbers ourselves). We also record that the registering admin accepted the Terms of Service, this Privacy Policy, and the Data Processing Agreement, and which version they accepted and when. We use this to create the customer's account, operate the subscription (a flat rate per customer, billed via Stripe), keep a record of the agreement between us, and communicate with the customer about their account. If you contact our sales or support address, we also process the content of that correspondence and your contact details (see "Support and other correspondence" below).
Customer staff accounts (admins and case handlers)
Accounts for a customer's own admins and case handlers hold a name, an email address, a role, and authentication data: a hashed password (we never store the password itself), and — if two-factor authentication is enabled — the associated secret and one-time recovery codes. We also keep basic sign-in records (for example the time of the last sign-in) needed to operate and secure the account. This data is stored in that customer's assigned region's own database, not in a shared central one, so a customer's staff directory carries the same regional residency guarantee as the report content they handle. Where the same person's name then appears on a case note or in the audit log, that record is report data (see below) and the customer is its controller. If you connect your accounts on several customers' workspaces so you can switch between them, we also store a link between those accounts. It is only ever created by you while signed in, it exists only between workspaces in the same region, and it is removed when you disconnect or the account is deleted. You see the names of your own connected workspaces. Each customer can see only that your account is connected to other workspaces, never which ones. No report data passes between workspaces.
Report and case data (processed on a customer's behalf)
A reporter's submission — written report text, optional evidence attachments, an anonymised audio recording if the oral channel is used, and any messages exchanged with a case handler — together with the case metadata built around it (a reference code, category, status, timestamps, and deadline clocks) is processed by Provoxis strictly as instructed by the customer, under our Data Processing Agreement with that customer. Reporting is always available anonymously; a customer cannot disable anonymous reporting or make identification a condition of submitting a report. A report may, by its nature, contain special category data and information about criminal offences or allegations — see "Special category data" below. Because the customer is the controller of this data, the customer's own privacy notice governs how it is used.
Abuse prevention on public forms
To prevent automated abuse of the public forms — the reporting form, the reporter portal sign-in, the password-reset form, and the free policy generator — we briefly process the IP address a request is made from. It is used only to limit how many requests can be made from the same address in a short window of time. It is held in a short-lived in-memory store that expires on its own, is never written to a log, is never stored once the window has passed, and is never linked to a report or used to identify a reporter.
Support and other correspondence
When you email our support or sales address, or a customer's staff raise a support request, we process your name, your email address, and whatever you put in the message and any attachments — which may include information about a case if you choose to include it. We use this only to answer you, to keep a record of the request and our response, and to improve our support. We ask that report content and reporter identities are not sent to us by email; where a message unavoidably contains them, we handle it under the same confidentiality and security rules as the rest of the service.
Service and security logs
Our application writes technical logs — errors, warnings, and records of privileged or unusual activity — to a regional logging system, used to keep the service running and secure. The service receives the connecting IP address of every request and uses it transiently for the abuse-prevention limits and the approximate-country lookup described above, but it is not written into these logs and we do not run a separate web-server access log that records it. If that ever changes (for example if we later add a load balancer or web application firewall that keeps access logs), we will disclose it here and in the sub-processor registry, keep any such logs for a short period only, and never use them to identify a reporter. Logs are kept only as long as needed for security and troubleshooting and are then deleted.
Audit log (processed on a customer's behalf)
For each customer we maintain an immutable audit log that records every read of a report, case note, evidence file, or audio recording, and every privileged action (a legal hold set or released, a manual erasure, a change to retention or access-control settings, an audit-log export). Each entry records who did what and when. A customer's admins can browse and export their own audit log. It is report data — the customer is its controller — and is retained for the life of the case it relates to.
Cookies
We use only strictly necessary and functional cookies. We set no advertising or analytics cookies, and we use no third-party tracking — the website usage statistics described above are measured on our own servers, without cookies. We do not use Google Analytics or any comparable product, and we do not track you across other websites. Because every cookie we use is either strictly necessary or a functional cookie you control by choosing a language, no consent banner is required and none is shown. The cookies are:
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| provoxis-locale | Provoxis (first party) | Remembers the language you chose so pages load in it. Functional; set only once you actively choose a language. | Up to 1 year |
| __Host-provoxis-session | Provoxis (first party) | Keeps a signed-in member of a customer's staff signed in as they move between pages of the admin application. Also set while a new customer signs up, and on the policy generator page to secure its form. Strictly necessary; never set for reporters or on any other page of this website. | Session / up to 2 hours idle |
| Stripe cookies (__stripe_mid, __stripe_sid) | Third party | Set by Stripe on the sign-up and billing pages to process payment securely and detect card fraud. Strictly necessary for taking payment. See Stripe's own privacy policy for details. | Session to 1 year |
How we use it
We use the data described above to: provide and operate the service (the report-intake channel, case management, the reporter portal, and the notifications and audit logging around them); create and administer customer and staff accounts; process subscription billing and keep the records tax and company law require; send account, security, and service communications (including deadline reminders to a customer's case handlers); answer support and sales enquiries; keep the service, its data, and its users secure and prevent abuse; understand at an aggregate level which pages and resources on this website are useful; keep a record of the agreements between us and of your acceptance of them; and meet our own legal obligations, including under data protection law. We do not use the data for any purpose incompatible with these.
Legal bases for processing (data we hold as controller)
Where the UK GDPR or the EU GDPR applies to data we hold as controller, we rely on the following legal bases. For report data we process as a customer's processor, the customer determines the legal basis in its own privacy notice.
- Performance of a contract — creating and operating the account a customer or reporter is using, providing the service, and taking payment. Without this data we cannot provide the service.
- Compliance with a legal obligation — keeping billing, tax, and accounting records; responding to valid requests to exercise data protection rights; retaining and, where lawfully required, disclosing data; and our own security-incident and record-keeping duties.
- Our legitimate interests, where these are not overridden by your rights — keeping the service and its data secure, preventing and investigating abuse of the public forms, maintaining service and security logs, understanding aggregate website usage without tracking individuals, sending service and security communications, keeping evidence of agreement acceptance, and running our business (including responding to enquiries and, if it ever happens, a sale or reorganisation of the business).
- Consent — for the single case where we ask for it: before an oral report is recorded, the reporter is asked to consent to being recorded and can play back and delete the recording before submitting it. You can withdraw consent at any time, without affecting processing already carried out. We do not rely on consent for the core service, because anonymous reporting must always be available without conditions.
Special category data and criminal-offence data
A whistleblowing report can, by its nature, reveal special category data — such as data about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or a person's sex life or sexual orientation — and, because the oral channel captures a person's voice, may include biometric data. A report may also concern criminal offences or allegations. For this data the customer is the controller and identifies the condition that permits the processing in its own privacy notice — for a whistleblowing programme this is typically a substantial public interest, compliance with employment or corporate law, or the national law implementing the EU Whistleblowing Directive. Provoxis processes it only on the customer's instructions and applies the safeguards set out in Annex II of the Data Processing Agreement: role-based access enforced below the interface, pseudonymisation of reporter identity behind a case reference, encryption of evidence and audio, server-side stripping of identifying metadata from uploads, in-house pitch- and formant-shifting of audio with the raw recording never kept, and an immutable audit log.
No automated decision-making
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile you. Case triage, assessment, and outcomes are decided by a customer's own people, not by the software, and report content is never fed to an AI model for scoring, evaluation, or training.
Who we share data with
We do not sell personal data and we do not share it for advertising. We disclose it only to the following categories of recipient:
- Sub-processors that process data on our behalf under contract — currently our cloud host, our payment provider, and our transactional email provider. Every one is named, with its purpose, processing location, and a link to its own data-processing terms, in our sub-processor registry. The same page carries our Data Processing Agreement in full.
- Professional advisers — lawyers, accountants, auditors, and insurers — bound by confidentiality, where needed to run and protect the business.
- Courts, regulators, law-enforcement bodies, and other public authorities, where we are legally required to disclose data or need to establish, exercise, or defend legal claims. For data we process as a customer's processor we do not respond to such a request substantively — we refer the authority to the customer and challenge requests that are unlawful or overbroad, as set out in the Data Processing Agreement.
- A buyer or successor entity, and its advisers, if we sell or reorganise all or part of the business — in which case the data stays subject to a policy at least as protective as this one, and we will notify affected customers.
Where data is stored and processed
A customer's report content and staff-account data are never stored or processed outside that customer's assigned region. Each region — application servers, database, cache, queue workers, and object storage — is a complete, independent stack; report data is not routed through, or replicated into, another region. At launch, only the EU region (Frankfurt) is live; a UK region (London) exists as infrastructure but is not yet activated for new customers. Customer-registry and billing metadata (which customer maps to which region, and subscription status) and the website analytics described above are held centrally, on infrastructure in the EU region, and never contain report content.
Security measures
Evidence files and audio recordings are encrypted at rest with a per-customer encryption key managed by a regional key-management service; database content is protected by disk-level encryption. All traffic to and from the service is encrypted in transit (TLS). Access to report content is restricted by role, enforced at the application's access-control layer, not just the interface, and every read of a report, evidence file, or audio recording, along with every privileged action, is written to the immutable audit log described above. Provoxis staff access the content of a customer's cases only where the customer asks for support that requires it or where it is strictly necessary to keep the service secure, and every such access is logged. The full set of technical and organisational measures is set out in Annex II of the Data Processing Agreement.
A note on availability
The security and residency commitments above are launch-day guarantees. Service availability is not: launch runs a single instance per region, without automatic failover or a guaranteed uptime commitment. We do not represent this service as highly available or as covered by an uptime SLA.
How long we keep data
We keep personal data only as long as necessary for the purpose it was collected for, and then delete it or irreversibly anonymise it. The main retention periods are:
- Report and case data — a tiered schedule: reports assessed as out of scope are deleted within 2 months of that assessment; cases where disciplinary or legal proceedings are initiated are retained until those proceedings (including any appeal) conclude; other closed, founded cases are retained for the period set by the national law implementing the EU Whistleblowing Directive in the customer's registered country, where that law sets one — generally between 3 months and 5 years across the countries we've reviewed — or for 5 years by default where it does not. A customer admin may place a legal hold that suspends this schedule, or request a reason-required, audit-logged manual erasure at any time.
- Customer and staff account data — kept while the subscription is active and deleted, on the schedule in the Data Processing Agreement, after it ends. Billing, tax, and accounting records are then kept for the period tax and company law require (generally up to 7 years).
- Records of which version of the Terms, Privacy Policy, and DPA a customer accepted, and when — kept for the life of the account and for the limitation period after it ends.
- Encrypted backups — retained on a short rolling cycle (no more than 30 days) and overwritten in the ordinary course; data deleted from the live service works its way out of backups within that cycle.
- Website analytics — individual records for at most 90 days (the visitor code within them erased within about 2 days); only anonymous aggregate totals, which are not personal data, are kept after that.
- Service and security logs, and support correspondence — kept only as long as needed for security, troubleshooting, and to handle the request and any follow-up, and then deleted.
If there is a data breach
We maintain an incident-response plan. If a personal data breach affects data we hold as controller, we will assess it and, where the law requires, notify the competent supervisory authority within 72 hours and notify affected individuals without undue delay where the breach is likely to result in a high risk to them. If a breach affects data we process for a customer, we notify that customer without undue delay and in any event within 72 hours of becoming aware, so the customer — as controller — can meet its own notification duties, as set out in the Data Processing Agreement.
Your rights
Subject to applicable law, you have the right to: ask for access to the personal data we hold about you; have inaccurate data corrected; have data erased; restrict or object to certain processing; receive data you gave us in a portable format; and, where we rely on consent, withdraw it at any time. You will not be treated any less favourably for exercising these rights.
For data Provoxis holds as controller (this website, your account as a customer admin or case handler, billing records, correspondence with us), contact us using the details at the end of this policy. We respond within one month; we may extend this by two further months for complex or numerous requests and will tell you if we do. There is no fee unless the request is manifestly unfounded or excessive. We may need to verify your identity before we act. If your data was submitted as part of a report to a specific customer, that customer is the controller of that data and is the right first point of contact; where Provoxis holds that data as processor we will assist the customer, and the customer's admins have self-service tools to export or erase a case.
You also have the right to lodge a complaint with a data protection supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the authority in your country of residence or work. We would appreciate the chance to address your concern first. You may also have a right to an effective judicial remedy.
International transfers
Report content and staff-account data stay within a customer's assigned region and are not transferred internationally. Provoxis Ltd operates and supports the platform from the United Kingdom, so our staff access EU-region data from the UK; this relies on the European Commission's adequacy decision for the UK, with the EU Standard Contractual Clauses incorporated in the Data Processing Agreement as a documented fallback if that decision lapses. For data we hold as controller, our payment provider Stripe processes billing data primarily in the United States under its own Standard Contractual Clauses and UK Addendum; our other sub-processors process in the EEA. Where a transfer relies on Standard Contractual Clauses you can ask us for a copy using the contact details below.
Children's data
This service is intended for use by organisations and their staff, reporters, and website visitors acting in a professional or adult capacity. It is not directed at children, and we do not knowingly collect data from children. A report submitted through a customer's channel may mention a child; that data is handled by the customer as controller under its own privacy notice.
Third-party links
This website and our documents link to third-party websites — for example each sub-processor's own data-processing terms. We are not responsible for the content or privacy practices of those sites; their own policies apply when you visit them.
Changes to this policy
We may update this policy from time to time. If we make material changes we will update the "last updated" date above and, where appropriate, notify customer admins directly. Because the Terms of Service, this Privacy Policy, and the Data Processing Agreement are accepted together at registration, a material change is reflected in the acceptance version recorded on the account. The current version is always the one published here; we can provide an earlier version on request.
Which law applies
Provoxis is offered to organisations established in the United Kingdom and the European Economic Area, and this policy is written to the UK GDPR and the EU GDPR. We do not target the service at, or knowingly offer it to, individuals in other jurisdictions, and this policy does not attempt to address the privacy laws of other regions.
How to contact us
For questions about this policy, or to exercise your rights in relation to data we hold as controller, contact us at support@provoxis.com, or by post at Provoxis Ltd, Grosvenor House, 3 Chapel Street, Congleton, England, CW12 4AB.
Data protection contact: support@provoxis.com.
Data Protection Officer: [DATA PROTECTION OFFICER — NOT YET APPOINTED / REQUIREMENT NOT YET DETERMINED].
Representative in the European Union for the purposes of Article 27 of the EU GDPR: [GDPR ART. 27 EU REPRESENTATIVE — NOT YET APPOINTED].
You can also complain to a supervisory authority — the Information Commissioner's Office in the UK, or the authority for your country in the EEA.