Volta Privacy Policy

Effective 8 July 2026 v2 · Last updated 8 June 2026

1. Introduction

This Privacy Policy explains how [Volta AI Limited] ("Volta", "we", "us", "our") collects, uses, shares and protects personal data when you visit volta.com, use our products and services, or otherwise interact with us.

We take the privacy of personal data seriously - it sits at the heart of what we build. As a provider of confidential computing infrastructure, the protection of data is our core product proposition, and that mindset extends to the data we hold about the people who visit our site and engage with us.

Customer data: customers of Volta's cloud services retain full ownership and control of the data they process on our platform. Volta processes that data only to operate and support the services in line with the customer's instructions under the Master Services Agreement and Data Processing Agreement. This Privacy Policy concerns the data Volta itself controls - primarily from website visitors, prospects, candidates, and contacts.

This policy is written to be understood. If anything is unclear, please contact us using the details at the end.

2. Who we are

[Volta AI Limited] is the data controller for the personal data we collect about you.

  • Registered company name: [Volta AI Limited] [LEGAL TEAM CONFIRM]
  • Company number: [registration number] [LEGAL TEAM CONFIRM]
  • Registered office: [registered address] [LEGAL TEAM CONFIRM]
  • Privacy contact: privacy@volta.com
  • Data Protection Officer: [LEGAL TEAM CONFIRM whether a DPO is required - likely yes given confidential computing implies large-scale special category processing for customers]
  • EU/UK Representative: [LEGAL TEAM CONFIRM - required if Volta does not have an establishment in both UK and EU]

3. The personal data we collect

We collect personal data in the following categories. We minimise collection to what is necessary for the purpose at hand.

Information you give us directly

  • Contact details when you fill in a form on our site (name, work email, company, role, country)
  • Information you provide when you email us, call us or meet with us
  • Information you provide when you apply for a job
  • Information you provide if you become a customer (account details, billing information)
  • Information you provide when subscribing to our newsletter or downloading gated content

Information collected automatically

  • Device and browser information (IP address, browser type, operating system, device identifiers)
  • Site usage information (pages visited, time on page, referring URLs, interaction events)
  • Behavioural and product analytics data (the electronic path you take through our services, your interactions with content)
  • Cookie and similar technology data - see our Cookie Policy

Information from third parties

  • Information from business intelligence providers (eg. enriched contact data for B2B sales prospecting)
  • Information from analytics and advertising platforms (eg. ad campaign engagement attribution)
  • Information from public sources (eg. LinkedIn for verified business contacts)
  • Information from lead generation form integrations (eg. LinkedIn Lead Gen Forms, embedded HubSpot forms)

Categories of personal data

  • Identity data: information that identifies an individual (name, job title)
  • Contact data: email, telephone, social media handles
  • Online identifiers: IP address, cookies, device identifiers (typically anonymised)
  • Communication data: content of communications with us (emails, form submissions, chat)
  • Marketing and preferences data: subscriptions, communication preferences

We do not knowingly collect special category personal data (eg. health, religion, biometric data) through our website or marketing activities.

[LEGAL TEAM CONFIRM: does the Volta platform itself process any special category data on behalf of customers, and if so does that need a flag here or only in the Customer Privacy Notice / DPA? ]

Purpose Categories of data Lawful basis (UK & EU GDPR)
Responding to enquiries you send us Contact details, enquiry content Legitimate interests / pre-contract steps
Sending you marketing emails about Volta Contact details, role, company, preferences Consent (where required) / legitimate interests for B2B contacts
Newsletter delivery and engagement tracking Contact details, engagement data Legitimate interests
Providing our products and services to customers All customer account data Contract
Managing recruitment Candidate details, CV, application data Legitimate interests / pre-contract steps
Operating and securing our website Device and usage data Legitimate interests
Analytics and improving our services Usage data, aggregated trends Consent (where required) / legitimate interests
Internet-based advertising and ad measurement Online identifiers, ad engagement data Consent
Complying with legal obligations Whatever data is required Legal obligation
Defending or bringing legal claims Whatever data is relevant Legitimate interests

When we rely on legitimate interests, we have carried out a balancing test. You can contact us if you would like more information about that test.

5. Marketing communications and newsletter

If you subscribe to our newsletter, request gated content, attend our events, or engage with our marketing forms, we will send you communications related to your interest in Volta. This may include product updates, technical content, event invitations, and case studies.

We use [email service provider - HubSpot / Marketo / Customer.io / Klaviyo - LEGAL TEAM CONFIRM once selected] to deliver our marketing communications and to gather aggregate metrics around email opens, clicks and engagement. The information collected is used to improve the relevance of our communications and is not shared with third parties for their own use.

You can unsubscribe at any time by clicking the link at the bottom of any marketing email, by adjusting your preferences in the preference centre, or by contacting privacy@volta.com.

Lead generation form submissions (including LinkedIn Lead Gen Forms used in paid campaigns) are limited to the fields necessary to follow up - typically name, email and company - and are processed under legitimate interests.

6. Internet-based advertising and tracking pixels

We use third-party advertising platforms to deliver targeted advertising about Volta to users who have shown an interest in our content. To measure the effectiveness of those campaigns, we operate the following tracking pixels and SDKs:

[LEGAL TEAM CONFIRM and marketing ops to finalise the actual list once the launch stack is locked. Indicative list - mirror the format Radiant publishes:]

  • LinkedIn Insight Tag. Conversion measurement on LinkedIn ads, anonymised reporting. Cookie validity [90 days].
  • Meta (Facebook) Pixel. Conversion measurement on Meta ads, retargeting visitors of our site.
  • Reddit Pixel. Conversion measurement on Reddit ads.
  • X (Twitter) Pixel. Conversion measurement on X ads.
  • Google Ads and Google Analytics 4. Web analytics and ad conversion measurement.
  • Hotjar / [alternative behaviour analytics tool]. Heatmaps and session-level interaction insights for UX improvement.
  • HubSpot Forms / [alternative form provider]. Lead capture forms and progressive profiling.

We do not place non-essential tracking pixels until you have given consent through our cookie banner. You can manage your consent at any time through the "Cookie settings" link in the footer.

7. Session recording and behaviour analytics

[LEGAL TEAM CONFIRM whether Volta will use session recording at launch. If yes, the following language is appropriate.]

Where we use session recording or replay tools to understand how users interact with our site, we configure those tools to anonymise or exclude sensitive fields (passwords, authentication tokens, payment data, support ticket content). Recordings are used only for internal analysis to support service reliability, performance and UX improvements.

8. How we share personal data

We share personal data only where it is necessary, and only with parties bound by appropriate confidentiality and data protection obligations. The categories of recipient are:

  • Service providers acting on our instructions - eg. cloud infrastructure providers, CRM platforms, analytics providers, email service providers, communication platforms, advertising platforms
  • Professional advisors - eg. lawyers, accountants, auditors
  • Regulators, courts and law enforcement where we are legally required to disclose
  • Acquirers or successors in the event of a corporate transaction (eg. merger, acquisition, financing) subject to confidentiality
  • Our customers where you are a user of a service we operate for them and they have an independent or joint controller relationship

We do not sell personal data.

A list of the third-party processors we use, with their location and the safeguards in place, is published at volta.com/subprocessors [LEGAL TEAM CONFIRM - or hold on a private page available on request until the launch list is finalised].

9. International transfers

Some of our service providers are based outside the UK and EEA. Where personal data is transferred outside the UK or EEA, we put in place appropriate safeguards, including:

  • Transfers to countries that the UK or EU has determined provide an adequate level of protection
  • Standard Contractual Clauses (with the UK addendum where relevant)
  • [Binding Corporate Rules where applicable] [LEGAL TEAM CONFIRM]

A list of the countries we transfer data to, and the safeguards in place, is available on request from privacy@volta.com.

10. How long we keep personal data

We keep personal data only for as long as we need it for the purposes set out in this policy. Retention periods vary by data category. The defaults below are starting positions for legal review:

  • Marketing contacts: until you unsubscribe or after [24 months] of inactivity [LEGAL TEAM CONFIRM]
  • Customer records: for the duration of our relationship, plus [6 years] for tax, legal and audit purposes [LEGAL TEAM CONFIRM]
  • Recruitment data: [12 months] from the end of the recruitment process, longer if you consent to us holding your details on file [LEGAL TEAM CONFIRM]
  • Website analytics: [26 months] in aggregated form [LEGAL TEAM CONFIRM]
  • Security and log data: [12 months] [LEGAL TEAM CONFIRM]

Where we no longer need personal data, we delete it or anonymise it.

11. Your rights

Under UK GDPR and EU GDPR you have rights in relation to your personal data:

  • Access - you can ask for a copy of the personal data we hold about you
  • Rectification - you can ask us to correct data that is wrong or incomplete
  • Erasure - you can ask us to delete your data where there is no good reason for us to continue using it
  • Restriction - you can ask us to suspend processing in certain circumstances
  • Portability - you can ask us to provide your data to you, or to another controller, in a structured machine-readable format
  • Objection - you can object to processing based on legitimate interests, including direct marketing, at any time
  • Withdraw consent - where we rely on consent, you can withdraw it at any time (see below)
  • Not be subject to automated decision-making - we do not currently make any solely automated decisions that produce legal or similarly significant effects

To exercise any of these rights, contact privacy@volta.com. We will respond within one month.

If we are relying on your consent to process your data and you would like to withdraw it:

  1. Prepare your request. Send a clear, written request to privacy@volta.com stating which processing activity you would like to withdraw consent for (eg. marketing email, analytics cookies, a specific campaign).
  2. Identity verification. We may ask you for additional information to verify the request, to make sure we are not actioning a withdrawal request that did not come from you.
  3. Confirmation and timeline. We will acknowledge your request within [5 working days] and confirm when the change has been applied. For marketing email, this typically takes effect within 48 hours; for tracking and analytics, immediately.
  4. No detriment. Withdrawing consent will not affect the lawfulness of any processing carried out before your withdrawal, and we will not penalise you for withdrawing.

If you are not satisfied with how we handle your data, you can lodge a complaint with:

  • UK: the Information Commissioner's Office (ICO) at ico.org.uk
  • EU: the data protection authority in your country - a list is at edpb.europa.eu

12. How we keep personal data secure

We take technical and organisational measures to protect personal data, including:

  • Encryption in transit and at rest for personal data we hold
  • Access controls and the principle of least privilege
  • Regular security review and penetration testing
  • Staff training in data protection
  • Incident response procedures

Volta is committed to industry-recognised security standards. [LEGAL TEAM CONFIRM target certifications to reference here - SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018 are the standards Volta's direct competitors hold or are working towards. Recommend a "certifications and standards" sub-page on the website rather than naming them all in policy text - text needs to stay accurate over time, certifications page can be updated faster.]

No system is ever completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours, and we will notify you directly where the risk is high.

We use cookies and similar technologies on our website. For details of which cookies we use, why, and how you can manage them, please see our Cookie Policy.

We use [consent management platform - OneTrust / Cookiebot / Iubenda / custom - LEGAL TEAM CONFIRM once selected] to manage your cookie and tracking preferences. You can update your preferences at any time by clicking "Cookie settings" in the footer of the site.

Our site may include links to third party sites. We are not responsible for the privacy practices of those sites. Please read their privacy notices before providing personal data.

15. Children

Our website and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected personal data from a child, please contact privacy@volta.com.

16. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes. Where a change is material, we will draw it to your attention by an appropriate means - eg. an email notice to active contacts or a prominent notice on the site.

17. How to contact us

For any privacy-related question or to exercise your rights: