VoxFluo -- Privacy Policy

Effective Date: April 2026 Last Updated: April 17, 2026 Document Version: 1.0

IMPORTANT: This Privacy Policy explains how VoxFluo collects, uses, processes, stores, shares, and protects personal data. By using the VoxFluo Service (including the Web Portal and Mobile Application), you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

Disclaimer: This document must be reviewed and approved by a qualified attorney and data protection specialist admitted to practice in Austria before commercial deployment. A formal Data Processing Agreement (DPA) should be prepared as a separate executable document for B2B customers.

Table of Contents

1. Definitions
2. Data Controller and Data Processor Roles
3. Categories of Personal Data We Collect
4. How We Collect Personal Data
5. Purposes and Legal Basis for Processing
6. Global Data Processing, Transfer, and Storage
7. Third-Party Sub-Processors
8. Data Sharing and Disclosure
9. Data Retention
10. Data Deletion and the Right to Erasure
11. Data Security
12. Your Rights Under GDPR and Austrian Law
13. Rights of Non-EU/EEA Data Subjects
14. Artificial Intelligence and Automated Decision-Making
15. Audio Recordings and Voice Data
16. Business Card Images and OCR Data
17. Offline Data and Local Device Storage
18. Cookies and Tracking Technologies
19. Children's Privacy
20. Data Breach Notification
21. Data Protection Officer
22. Changes to This Privacy Policy
23. Governing Law and Supervisory Authority
24. Contact Information

1. Definitions

• "GDPR" means the General Data Protection Regulation (EU) 2016/679.
• "DSG" means the Austrian Datenschutzgesetz (Austrian Data Protection Act).
• "Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject"), as defined in Article 4(1) GDPR.
• "Processing" means any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
• "Data Controller" means the natural or legal person that determines the purposes and means of the processing of personal data.
• "Data Processor" means a natural or legal person that processes personal data on behalf of the Data Controller.
• "Sub-Processor" means any third party engaged by VoxFluo to process personal data.
• "Customer" means the legal entity that has entered into a VoxFluo Terms and Conditions agreement.
• "End User" means the individual user of the VoxFluo Mobile Application or Web Portal.
• "Lead Data" means personal data captured through the VoxFluo Service relating to prospects encountered at trade shows or sales events, including names, email addresses, phone numbers, company information, business card images, audio recordings, transcriptions, and AI-generated outputs.
• "Service" means the VoxFluo platform, including the Web Portal, Mobile Application, API, Edge Functions, and AI processing capabilities.
• "VoxFluo", "we", "us", or "our" means [VoxFluo Legal Entity Name], registered in the Republic of Austria, with its registered office at [Address], registered under commercial register number [FN XXXXXX] at the [Handelsgericht Wien].

2. Data Controller and Data Processor Roles

2.1 VoxFluo as Data Controller

VoxFluo acts as the Data Controller (Article 4(7) GDPR) for:

• Account and registration data of Customers and their Admins;
• Billing and payment information;
• Website visitor data (cookies, analytics);
• Data collected for VoxFluo's own legitimate business purposes (fraud prevention, security, service improvement).

2.2 VoxFluo as Data Processor

VoxFluo acts as the Data Processor (Article 4(8) GDPR) for:

• All Lead Data captured by Customers through the Service;
• End User (Sales Representative) data processed on behalf of the Customer organization.

In this capacity, VoxFluo processes Lead Data strictly on behalf of and according to the documented instructions of the Customer (the Data Controller). The Customer is responsible for establishing the lawful basis for processing Lead Data.

2.3 Customer as Data Controller

The Customer acts as the Data Controller for all Lead Data and is solely responsible for:

• Establishing a lawful basis for the collection and processing of Lead Data (e.g., legitimate interest under Article 6(1)(f) GDPR, or consent under Article 6(1)(a) GDPR);
• Providing required privacy notices to data subjects (e.g., prospects at trade shows) at or before the time of data collection;
• Responding to data subject access requests (DSARs) related to Lead Data;
• Conducting Data Protection Impact Assessments (DPIAs) where required;
• Ensuring compliance with applicable data protection laws in all jurisdictions where the Customer operates.

2.4 Data Processing Agreement (DPA)

Where VoxFluo processes personal data on behalf of the Customer, the parties shall enter into a Data Processing Agreement pursuant to Article 28 GDPR. The DPA specifies the subject matter, duration, nature, purpose, type of personal data, and categories of data subjects, and forms an integral part of the contractual relationship.

3. Categories of Personal Data We Collect

3.1 Customer Account Data (Controller Role)

3.2 End User Data (Processor Role on behalf of Customer)

3.3 Lead Data (Processor Role on behalf of Customer)

3.4 Technical and Operational Data

4. How We Collect Personal Data

4.1 Directly from You

• When you create an account or register your organization;
• When you configure settings, events, products, or user accounts in the Web Portal;
• When you capture a business card image using the Mobile Application;
• When you record an audio voice note using the Mobile Application;
• When you manually enter lead information;
• When you contact our support team;
• When you subscribe, purchase tokens, or provide payment information.

4.2 Automatically

• Device information and usage data collected by the Mobile Application;
• Server logs and technical data collected when you access the Web Portal or API;
• Cookies and similar tracking technologies on the Web Portal (see Section 18);
• Crash reports and performance metrics.

4.3 From Third-Party Sources

• AI-generated enrichment data (company information derived from email domains via OpenAI);
• Payment transaction confirmations from our payment provider.

4.4 From Your Employer or Authorized Organization

• Your name, email address, and role as provided by your organization's Admin when provisioning your End User account.

5. Purposes and Legal Basis for Processing

5.1 Processing Activities and Legal Bases

5.2 Legitimate Interest Balancing

Where we rely on legitimate interest as the legal basis, we have conducted a balancing test to ensure that our interests do not override the fundamental rights and freedoms of data subjects. Records of these assessments are available upon request to our Data Protection Officer.

6. Global Data Processing, Transfer, and Storage

6.1 International Data Transfers

By using the VoxFluo Service, you expressly and unambiguously acknowledge and consent to the transfer, processing, and storage of personal data in countries worldwide, including countries outside of the European Economic Area (EEA), the European Union (EU), Switzerland, and the United Kingdom.

6.2 Specific Acknowledgments

You acknowledge and agree that:

• Personal data (including Lead Data, account data, audio recordings, images, transcriptions, and enrichment data) may be transferred to, processed in, and stored on servers and infrastructure located in any country worldwide;
• VoxFluo's Sub-Processors (including cloud infrastructure providers and AI service providers) operate data centers and processing facilities in multiple jurisdictions, including the United States of America, the European Union, and other regions;
• Data is routinely transmitted across international borders during synchronization, AI processing, backup, and disaster recovery operations;
• The data protection laws of countries outside the EU/EEA may not provide the same level of protection as the GDPR;
• This applies regardless of the nationality, residency, or citizenship of any data subject, including citizens and residents of EU/EEA member states, Switzerland, the United Kingdom, and all other jurisdictions;
• You assume the residual risks associated with international data transfers, even where safeguards are implemented.

6.3 Safeguards for International Transfers

VoxFluo implements the following safeguards for international data transfers, as applicable:

• Standard Contractual Clauses (SCCs): VoxFluo enters into EU Commission-approved Standard Contractual Clauses with Sub-Processors located outside the EEA that do not benefit from an adequacy decision;
• Adequacy Decisions: Where the European Commission has determined that a third country provides an adequate level of data protection, transfers to that country require no additional safeguards;
• Supplementary Measures: Where required following a Transfer Impact Assessment (TIA), VoxFluo implements supplementary technical (e.g., encryption in transit and at rest) and organizational measures;
• Contractual Protections: All Sub-Processors are bound by contractual obligations regarding data protection, security, and confidentiality.

6.4 Export-Controlled Data

Personal data submitted to the Service may be subject to export control laws in the data subject's jurisdiction. By using the Service, the Customer and End Users acknowledge that personal data may be processed and stored outside of the data subject's home country, and the Customer assumes full responsibility for ensuring compliance with applicable export control laws.

6.5 No Data Locality Guarantee

VoxFluo does not guarantee that personal data will be stored or processed exclusively within any particular country, region, or jurisdiction, unless a separate written data residency addendum has been executed.

7. Third-Party Sub-Processors

7.1 Current Sub-Processors

VoxFluo engages the following categories of Sub-Processors to provide the Service:

7.2 Sub-Processor Obligations

All Sub-Processors are bound by:

• Written data processing agreements that comply with Article 28 GDPR;
• Obligations to implement appropriate technical and organizational security measures;
• Restrictions on processing personal data only for the purposes specified by VoxFluo;
• Confidentiality obligations;
• Obligations to assist with data subject requests and security incidents.

7.3 Changes to Sub-Processors

VoxFluo will maintain an up-to-date list of Sub-Processors. Customers subscribed to Sub-Processor notifications will be informed of changes at least fourteen (14) calendar days before a new Sub-Processor begins processing personal data. Customers may object to a new Sub-Processor by contacting VoxFluo within the notification period.

7.4 AI-Specific Processing

Regarding OpenAI and other AI providers:

• Data is transmitted via encrypted API calls;
• Audio recordings and text data sent to OpenAI via the API are NOT used to train OpenAI's public models, as per OpenAI's API data usage policy;
• VoxFluo has opted out of any training data programs where available;
• Processed results are returned to VoxFluo and stored in VoxFluo's database infrastructure;
• No personal data is permanently stored by AI providers beyond the processing session, except as required for abuse monitoring (typically retained for 30 days by OpenAI before deletion).

8. Data Sharing and Disclosure

8.1 We Do Not Sell Personal Data

VoxFluo does not sell, rent, or trade personal data to third parties for marketing or advertising purposes.

8.2 Circumstances of Disclosure

We may disclose personal data in the following circumstances:

• To Sub-Processors: As described in Section 7, strictly for the purpose of providing the Service;
• To the Customer (Data Controller): Lead Data and End User data are accessible to the Customer's Admin users through the Web Portal;
• Within the Customer's Organization: Lead Data is shared among the Customer's authorized End Users as configured by the Customer's Admin;
• Legal Obligations: Where required by law, regulation, court order, subpoena, or other legal process applicable in Austria or the EU;
• Protection of Rights: To protect the rights, property, safety, or security of VoxFluo, our users, or the public;
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of all or substantially all of VoxFluo's assets, where personal data may be transferred to the successor entity, subject to this Privacy Policy;
• With Consent: Where the data subject or Customer has provided explicit consent.

8.3 Aggregated Data

We may share aggregated, anonymized, and de-identified data that cannot reasonably be used to identify any individual, for purposes such as analytics, benchmarking, and marketing.

9. Data Retention

9.1 Retention Periods

9.2 Retention Principle

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. We regularly review our retention practices and delete personal data that is no longer necessary.

10. Data Deletion and the Right to Erasure

10.1 Account Termination

Upon termination of a Customer's subscription:

1. The Customer has 30 calendar days to export all Customer Data using the Service's export functionality;
2. After the 30-day export window, all Customer Data (including Lead Data, images, and audio recordings) is permanently deleted from VoxFluo's primary systems;
3. Backup copies are purged within 90 calendar days of deletion from primary systems;
4. Certain data may be retained longer where required by Austrian law (see Section 9.1).

10.2 Tombstone Deletion Method

When specific Lead Data records are deleted (either upon request or at subscription termination):

• All Personally Identifiable Information (PII) is permanently overwritten with null values;
• All associated media files (images, audio recordings) are permanently deleted from storage;
• The anonymous database record ID is retained (tombstoned) to maintain the integrity of the Customer's billing records and token ledger;
• Tombstoned records contain no data that can be used to identify any individual.

10.3 Individual Erasure Requests

Data subjects (e.g., prospects whose business cards were captured) may request the erasure of their personal data:

• For Lead Data: Requests should be directed to the Customer (Data Controller). The Customer can delete specific lead records through the Web Portal, or request VoxFluo's assistance;
• For VoxFluo Account Data: Requests should be directed to VoxFluo at privacy@voxfluo.com.

VoxFluo will process erasure requests within 30 calendar days, subject to applicable legal retention obligations.

10.4 Technical Limitations

Please note that:

• Data that has already been exported by the Customer to external systems (CRM, CSV exports, etc.) is outside VoxFluo's control;
• Certain data may persist in encrypted backup systems for a limited period before purging;
• Aggregated and anonymized data (which does not identify individuals) is not subject to erasure requests.

11. Data Security

11.1 Technical Measures

VoxFluo implements the following technical security measures:

• Encryption in Transit: All data transmitted between the Mobile Application, Web Portal, and VoxFluo's servers is encrypted using TLS 1.2 or higher;
• Encryption at Rest: Customer Data stored in the database and file storage is encrypted at rest using AES-256 or equivalent industry-standard encryption;
• Row-Level Security (RLS): PostgreSQL Row-Level Security policies enforce strict multi-tenant data isolation, ensuring that each Customer can only access its own data;
• Authentication: Secure authentication via Supabase Auth with support for email/password, magic links, and multi-factor authentication;
• Password Hashing: Passwords are hashed using bcrypt or equivalent one-way hashing algorithms;
• API Security: API endpoints are protected by authentication tokens, rate limiting, and input validation;
• Infrastructure Security: Cloud infrastructure managed by Supabase with enterprise-grade security controls.

11.2 Organizational Measures

• Access to production systems is restricted to authorized VoxFluo personnel on a need-to-know basis;
• All VoxFluo personnel with access to personal data are bound by contractual confidentiality obligations;
• Regular security reviews and vulnerability assessments;
• Incident response procedures for security events;
• Secure development practices including code review and dependency scanning.

11.3 No Absolute Security

Despite our efforts, no method of transmission over the Internet and no method of electronic storage is 100% secure. VoxFluo cannot guarantee the absolute security of personal data. The Customer acknowledges and accepts the inherent risks of transmitting data over the Internet and storing data electronically.

11.4 Customer's Security Responsibilities

The Customer is responsible for:

• Securing End User account credentials;
• Managing End User access permissions appropriately;
• Ensuring physical security of Devices used to access the Service;
• Promptly reporting any suspected security incidents to VoxFluo at security@voxfluo.com.

12. Your Rights Under GDPR and Austrian Law

12.1 Data Subject Rights

If you are located in the European Economic Area (EEA), you have the following rights under the GDPR and the Austrian DSG:

12.2 How to Exercise Your Rights

• For Lead Data (you are a prospect): Contact the organization (Customer) that captured your data. As Data Controller, they are your primary point of contact.
• For Account Data or End User Data: Contact VoxFluo directly:
  • Email: privacy@voxfluo.com
  • Subject Line: "Data Subject Request -- [Your Right]"
  • Include your name, email address, and a description of your request.

12.3 Response Time

We will respond to verified data subject requests within 30 calendar days of receipt. If a request is complex or we receive a high volume of requests, we may extend this period by an additional 60 calendar days, and will inform you of the extension and reasons within the initial 30-day period.

12.4 Verification

We may need to verify your identity before processing your request to prevent unauthorized access to personal data.

12.5 No Fee (Generally)

Requests are generally processed free of charge. However, we may charge a reasonable administrative fee for manifestly unfounded or excessive requests, or refuse to act on such requests, in accordance with Article 12(5) GDPR.

13. Rights of Non-EU/EEA Data Subjects

13.1 General Commitment

VoxFluo is committed to respecting the privacy rights of all individuals, regardless of their location. While our primary obligations arise under GDPR and Austrian law, we extend the following rights to all data subjects:

• Right to know what personal data we hold about you;
• Right to request correction of inaccurate data;
• Right to request deletion of your data (subject to legal retention requirements);
• Right to receive a copy of your data in a portable format.

13.2 Specific Jurisdictions

If you are located in a jurisdiction with specific data protection legislation (e.g., California (CCPA/CPRA), Brazil (LGPD), Canada (PIPEDA), United Kingdom (UK GDPR), Switzerland (nDSG)), we will comply with the applicable requirements of such legislation to the extent they apply to VoxFluo's processing activities.

13.3 Do Not Sell

VoxFluo does not sell personal data. For the avoidance of doubt, this applies to all data subjects regardless of jurisdiction, including California residents under the CCPA/CPRA.

14. Artificial Intelligence and Automated Decision-Making

14.1 AI Processing

VoxFluo uses third-party AI services (primarily OpenAI) to perform the following automated processing:

• Optical Character Recognition (OCR): Extracting text from business card images;
• Speech-to-Text (STT): Transcribing audio voice notes;
• Intent Mapping: Analyzing transcribed text to identify product interests, temperature ratings, and follow-up actions;
• Company Enrichment: Generating company summaries and industry classifications from email domains.

14.2 Nature of Processing

This AI processing constitutes automated processing but does not constitute solely automated decision-making that produces legal effects within the meaning of Article 22 GDPR, because:

• AI outputs are preliminary suggestions, not final decisions;
• All AI-generated outputs are subject to human review and verification by the Customer's End Users;
• AI outputs do not produce legal effects or similarly significantly affect data subjects;
• The Customer (Data Controller) retains full control over how AI outputs are used.

14.3 Accuracy Disclaimer

AI processing is probabilistic. Results may contain errors. VoxFluo does not guarantee the accuracy of any AI-generated output. The Customer is responsible for verifying all outputs.

14.4 Profiling

VoxFluo does not engage in profiling of prospects (data subjects in Lead Data) for marketing, credit scoring, or any other purpose. The Service structures data as instructed by the Customer; it does not make behavioral inferences or predictions about data subjects.

15. Audio Recordings and Voice Data

15.1 Nature of Audio Data

Audio recordings captured through the VoxFluo Mobile Application may contain:

• The voice of the End User (Sales Representative);
• The voices of prospects, colleagues, or bystanders;
• Background noise and ambient sounds from the event environment.

Voice data may constitute biometric data in certain jurisdictions and under certain interpretations of the GDPR (Article 9), particularly if used for identification purposes.

15.2 How Audio Data Is Processed

1. The End User initiates recording through the Mobile Application;
2. The audio file is stored locally on the Device (encrypted at rest if supported by the OS);
3. When connectivity is available, the audio file is transmitted (encrypted in transit) to VoxFluo's servers;
4. The audio file is sent to OpenAI's API for transcription (speech-to-text);
5. The transcribed text is processed by OpenAI's API for intent mapping;
6. Results are stored in VoxFluo's database associated with the Lead record;
7. The original audio file is stored in VoxFluo's file storage for reference and re-processing.

15.3 Audio Data Retention

• Audio files are retained for the duration of the Customer's subscription;
• Audio files are permanently deleted within 30 days of subscription termination;
• Customers may delete individual audio files at any time through the Service.

15.4 Legal Responsibility for Audio Recording

The Customer (Data Controller) is solely responsible for ensuring that all audio recordings comply with applicable privacy, wiretapping, and surveillance laws. VoxFluo provides the technical capability only and bears no responsibility for unlawful recordings. See the Terms and Conditions, Section 8, for full details.

16. Business Card Images and OCR Data

16.1 Nature of Business Card Data

Business card images captured through the Mobile Application contain personal data of prospects, including names, job titles, email addresses, phone numbers, company names, and physical addresses.

16.2 How Business Card Data Is Processed

1. The End User photographs a business card using the Mobile Application's camera;
2. The image is stored locally on the Device;
3. When connectivity is available, the image is transmitted (encrypted in transit) to VoxFluo's servers;
4. The image is sent to OpenAI's API for OCR processing;
5. Extracted text is structured into fields (name, email, phone, company, etc.);
6. Results are stored in VoxFluo's database;
7. The original image is stored in VoxFluo's file storage for reference.

16.3 Data Minimization

VoxFluo processes only the data necessary to extract contact information from business cards. We do not intentionally extract or store data from the background of images or metadata beyond what is necessary for the Service.

17. Offline Data and Local Device Storage

17.1 Data Stored on Device

When offline, the Mobile Application stores the following data locally on the Device:

• Business card images;
• Audio recordings;
• Manually entered lead information;
• Authentication tokens and session data;
• Cached application data.

17.2 Security of Local Data

Data stored locally on the Device is subject to the security measures of the Device's operating system. VoxFluo implements application-level encryption where technically feasible but cannot guarantee the security of data on the physical Device. The End User is responsible for Device security (see EULA, Section 11).

17.3 Risk Acknowledgment

VoxFluo is not liable for any unauthorized access, loss, theft, or disclosure of personal data stored locally on an End User's Device. The Customer and End User accept the inherent risks of local data storage on mobile devices.

17a. Optional In-App vCard QR Feature

17a.1 Purpose

End Users may opt in to a feature that displays a QR code on their mobile dashboard. The QR code encodes the End User's own contact details as a vCard (vCard 3.0 standard) so that prospects at trade shows or events can scan the code with their phone camera and save the End User's contact information directly into their device's address book.

17a.2 Data Encoded in the QR Code

When the feature is enabled, the QR code encodes the following End-User-provided data, all of which is supplied by the End User themselves in the Settings screen of the Service:

• First name and last name
• Optional job title
• Email address (the address used to sign in to the Service)
• Optional phone number
• The End User's organization name
• The End User's organization domain (rendered as a website URL)

The QR code does not include credentials, lead data, organization-wide data, or any data about other Users or prospects.

17a.3 Data Flow and Transmission

The QR code is generated and rendered locally on the End User's Device. The vCard payload is never transmitted to a third-party service when the QR is displayed; anyone scanning the QR receives the vCard directly via the optical channel between the two devices.

17a.4 Opt-In and Revocation

This feature is off by default. End Users must explicitly enable it from their Settings (Web Portal or Mobile Application) after acknowledging an in-app consent dialog. End Users may disable the feature at any time, which immediately hides the QR widget. Each enable and disable action is recorded in the audit log for the organization.

17a.5 Administrator Override

Organization Administrators may disable the feature for all Users in their organization by setting the dashboard_qr_allowed organizational setting to false, in which case End Users will not be able to enable the QR code regardless of their personal preference.

17a.6 Risk Acknowledgment

By enabling this feature, the End User acknowledges that any person within line of sight of their device screen may scan the QR code and obtain the encoded contact information. The End User is solely responsible for deciding when and to whom to display the QR code.

18. Cookies and Tracking Technologies

18.1 Web Portal Cookies

The VoxFluo Web Portal may use the following types of cookies and similar technologies:

18.2 Mobile Application

The Mobile Application does not use cookies. Usage analytics and crash reporting (if implemented) use device-native SDKs subject to the permissions described in Section 7.2.

18.3 Cookie Consent

Where required by the Austrian Telekommunikationsgesetz (TKG 2021) and the ePrivacy Directive, VoxFluo will obtain consent before setting non-essential cookies via a cookie banner or consent management platform.

19. Children's Privacy

19.1 Age Restriction

The VoxFluo Service is designed for B2B use and is not intended for use by individuals under the age of 18 (or the age of digital consent in their jurisdiction, whichever is higher -- 14 in Austria per ss 4(4) DSG).

19.2 No Knowing Collection

VoxFluo does not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will take immediate steps to delete such data.

19.3 Parental Contact

If you believe that a child under the applicable age has provided personal data to VoxFluo, please contact us immediately at privacy@voxfluo.com.

20. Data Breach Notification

20.1 VoxFluo's Obligations

In the event of a personal data breach (as defined in Article 4(12) GDPR), VoxFluo will:

• Notify the affected Customer(s) without undue delay and in any event within 72 hours of becoming aware of the breach (Article 33 GDPR);
• Provide all information required under Article 33(3) GDPR, including:
  • The nature of the breach;
  • Categories and approximate number of data subjects affected;
  • Categories and approximate number of personal data records affected;
  • Likely consequences of the breach;
  • Measures taken or proposed to address the breach;
• Cooperate with the Customer in fulfilling the Customer's own notification obligations to supervisory authorities and data subjects;
• Document the breach and remedial measures.

20.2 Customer's Obligations

As Data Controller for Lead Data, the Customer is responsible for:

• Notifying the competent supervisory authority within 72 hours of becoming aware of a breach that poses a risk to data subjects' rights and freedoms (Article 33 GDPR);
• Notifying affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR);
• Documenting the breach and its effects.

21. Data Protection Officer

21.1 Contact

VoxFluo's Data Protection Officer (DPO) can be contacted at:

• Email: privacy@voxfluo.com
• Postal Address: Data Protection Officer, [VoxFluo Legal Entity Name], [Address], Vienna, Austria

21.2 Role

The DPO is responsible for monitoring compliance with GDPR and the DSG, advising on data protection obligations, conducting data protection impact assessments, and serving as the point of contact for data subjects and the Austrian Data Protection Authority.

22. Changes to This Privacy Policy

22.1 Right to Update

VoxFluo reserves the right to update this Privacy Policy at any time. Material changes will be communicated via:

• Email notification to Customer Admins;
• In-app notification in the Web Portal and/or Mobile Application;
• Updated "Last Updated" date at the top of this document.

22.2 Review Obligation

Customers and End Users are encouraged to review this Privacy Policy periodically. Continued use of the Service after publication of a revised Privacy Policy constitutes acceptance of the changes.

22.3 Objection

If you do not agree with a change to this Privacy Policy, you should discontinue use of the Service and contact VoxFluo to close your account.

23. Governing Law and Supervisory Authority

23.1 Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Austria, including the GDPR as directly applicable in Austria and the Austrian Datenschutzgesetz (DSG).

23.2 Supervisory Authority

The competent supervisory authority for VoxFluo is the:

Osterreichische Datenschutzbehorde (Austrian Data Protection Authority) Barichgasse 40-42 1030 Wien Austria Email: dsb@dsb.gv.at Website: https://www.dsb.gv.at

23.3 Right to Complain

Every data subject has the right to lodge a complaint with the Austrian Data Protection Authority or the supervisory authority of the EU/EEA member state of their habitual residence, place of work, or place of the alleged infringement.

24. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or VoxFluo's data processing practices:

• Data Protection Officer: privacy@voxfluo.com
• General Inquiries: legal@voxfluo.com
• Security Incidents: security@voxfluo.com
• Company: [VoxFluo Legal Entity Name]
• Address: [Registered Office Address, Vienna, Austria]
• Commercial Register: [FN XXXXXX, Handelsgericht Wien]

This Privacy Policy was last updated on April 17, 2026. Document Version: 1.0