Privacy Policy
- Version
- 2.2
- Last Updated
- October 2026
- Classification
- Public
- Contact
- legal@votis.io
Votis Technologies Ltd (“Votis”, “we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, services, or interact with us.
1. When we are a controller, and when we are a processor
This Privacy Policy explains how we handle personal data where Votis decides how and why it is processed. That covers visitors to this website, people who contact us or request a demo, prospective customers, applicants, and the administrative contacts of our customers.
It does not cover data inside the Votis Platform. When our customers use the Platform, they decide what data is entered and why. For that data our customer is the controller and Votis is the processor, acting on their instructions under our Data Processing Agreement. If you completed a configuration through a Votis portal link sent to you by a company you work with, that company is the controller of your data and you should direct requests to them in the first instance.
2. Information We Collect
2.1 Information You Provide
We collect information you voluntarily provide, including:
- Identity Data: Name, username, title
- Contact Data: Email address, telephone numbers, addresses
- Professional Data: Company name, job title, department
- Account Data: Username, password, preferences
- Transaction Data: Payment details, purchase history
- Communication Data: Feedback, support requests, correspondence
- Marketing Data: Preferences, subscriptions
2.2 Information from Use of Services
We automatically collect:
- Technical Data: IP address, browser type, device information
- Usage Data: Pages visited, features used, interaction data
- Log Data: Access times, duration, error logs
- Cookie Data: As per our Cookie Policy
2.3 Information from Third Parties
We may receive information from:
- Payment processors (transaction confirmations)
- Analytics providers (usage patterns)
- Marketing partners (lead information)
- Public sources (company information)
3. How We Use Your Information
3.1 Primary Purposes
We use your information to:
- Provide and maintain our Services
- Process transactions and send related information
- Send administrative information and updates
- Respond to inquiries and provide support
- Monitor and analyze usage and trends
- Detect and prevent fraud or security issues
- Comply with legal obligations
3.2 Marketing and Communications
With appropriate consent, we may:
- Send promotional communications
- Provide information about new features
- Share relevant industry insights
- Invite participation in surveys or events
3.3 Legal Bases for Processing
We process personal data based on:
- Consent: Where you have given clear consent
- Contract: To perform our contract with you
- Legal Obligation: To comply with laws
- Legitimate Interests: For business operations, provided your rights are protected
4. How We Share Information
4.1 Service Providers
We share controller-side personal data with the following service providers:
| Provider | Purpose |
|---|---|
| Amazon Web Services | Infrastructure, compute and database hosting |
| Vercel | Website and application hosting |
| Cloudflare | DNS, CDN and web application firewall |
| Stripe | Payments and billing |
| Google Workspace | Email and business operations |
| HubSpot | Customer relationship management and marketing |
| Apollo.io | Sales prospecting and contact management, and company-level identification of website visits (only with marketing cookie consent) |
| Advertising measurement, retargeting and conversion tracking for our LinkedIn adverts (only with marketing cookie consent) | |
| Plausible Analytics | Cookie-free website analytics (aggregate visit statistics, no personal profiles) |
| Resend | Transactional email |
| Anthropic | AI processing |
| Sentry | Error monitoring |
Platform-side subprocessors are listed separately in Schedule 2 to the Data Processing Agreement.
4.2 Legal Requirements
We may disclose information to:
- Comply with legal obligations
- Respond to lawful requests
- Protect rights and safety
- Investigate potential violations
4.3 Business Transfers
In connection with mergers, acquisitions, or asset sales, your information may be transferred.
4.4 Consent
We share information with your consent or at your direction.
4A. The Votis browser extension
The Votis browser extension powers Assisted Configuration, a beta feature. When a consultant starts a run and confirms it, the extension lets Votis key agreed settings into their business system (for example Unit4 ERPx) in their own browser, signed in as them. The data it handles belongs to our customer, and we process it as a processor under the Data Processing Agreement.
4A.1 What the extension handles
- Screenshots of the business system's page while a run is in progress
- The address of that page and a text outline of what is on it (buttons, fields, labels)
- The clicks and typing Votis carries out, with the time of each
- A pairing token that links the extension to your Votis account, stored in the browser
4A.2 What it does not do
- It works only on the business system address connected to the project, and only during a run you start
- It does not read your browsing history or any other tab or website
- It never reads or stores passwords, and refuses to type into password fields
- It does not track you, show advertising, or sell or transfer data to anyone
- It does not delete records in your business system
4A.3 How the data is used and kept
Screenshots and page outlines are sent to Votis and to our AI provider (Anthropic) only to carry out the run. They are kept as an audit record of every step, so the customer can see exactly what was changed. They are Customer Data, kept and deleted as the Data Processing Agreement sets out, and are never used to train AI models. Our AI provider does not use them to train its models.
The use of information received from Google APIs and the Chrome browser will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. You can remove the extension at any time from your browser, and revoke its pairing from your Votis settings.
4B. Public information about the organisations our customers work with
Where a customer switches it on for a project, Votis reads publicly available information about the organisation being implemented: only that organisation’s own website and public registers such as Companies House and the Charity Commission. We do not search the wider internet. The result is a short brief, with the source of each line, which the customer can see, edit or switch off. It is used only to prepare for that project.
5. Data Security
We implement appropriate technical and organizational measures:
- Encryption in transit (TLS 1.2 or above) and at rest (AES-256)
- Access controls and authentication
- Regular security assessments
- Employee training and confidentiality
- Incident response procedures
- Business continuity planning
While we strive to protect your information, no method is 100% secure.
6. Data Retention
We retain personal data for:
- Active accounts: for the duration of service provision
- Platform data after termination: as set out in the Data Processing Agreement — available for export for 30 days, deleted within 60 days, removed from backups within 90 days
- Marketing and prospect data: until consent is withdrawn or after 24 months of no engagement
- Financial records: 6 years, as required by UK company and tax law
- Cookies: As specified in Cookie Policy
7. Your Rights
7.1 Access and Control
You have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion (right to be forgotten)
- Restrict processing
- Data portability
- Object to processing
- Withdraw consent
7.2 Exercising Rights
To exercise rights, contact: legal@votis.io
We will respond within one month, as required by UK GDPR, extendable by two further months for complex requests, in which case we will tell you within one month. We may request identity verification.
7.3 Complaints
You may lodge complaints with supervisory authorities:
- UK: Information Commissioner’s Office (ICO)
- EU: Relevant national authority
8. International Data Transfers
8.1 Transfer Mechanisms
We transfer data internationally using:
- Standard Contractual Clauses
- Adequacy decisions
- Your explicit consent
8.2 Safeguards
All transfers include appropriate safeguards to protect your data.
9. Cookies and Tracking
9.1 Types of Cookies
- Essential: Required for site operation
- Functional: Remember preferences
- Marketing: Identify which company a visit comes from (Apollo.io) and measure our LinkedIn adverts (LinkedIn Insight Tag), only if you opt in
9.2 Managing Cookies
You can control cookies through browser settings or via the cookie banner and our Cookie Policy. Essential cookies cannot be disabled.
10. Children's Privacy
Our Services are not directed to individuals under 18. We do not knowingly collect children’s personal data.
11. Region-Specific Provisions
11.1 European Union (GDPR)
- Legal basis required for all processing
- Enhanced rights including data portability
- Privacy by design implementation
11.2 United Kingdom (UK GDPR)
- Equivalent protections to EU GDPR
- ICO as supervisory authority
- UK-specific international transfer rules
12. Automated Decision-Making
We use AI/ML for:
- Service optimization
- Feature recommendations
- Support routing
You have the right to:
- Be informed about automated processing
- Request human review of decisions
- Object to automated decision-making
13. Changes to This Policy
We may update this Policy periodically. We will notify you of material changes via:
- Email notification
- Service announcement
- Website notice
14. Data protection inquiries
For privacy inquiries or to exercise your rights:
Data protection inquiriesVotis Technologies Ltd
71-75 Shelton Street
Covent Garden
London WC2H 9JQ
Email: legal@votis.io