Privacy Policy

VOLTOX GmbH, An der Hessenhalle 1-3, 35398 Gießen, Germany
Effective date: 14.05.2026
Welcome to the Privacy Policy of VOLTOX GmbH (“the Company”).
This Privacy Policy explains how we collect, use, store, and protect your personal data when you access or use our Website or Product available at: http://www.voltox.ai (“Website”).
By accessing or using our Website or Product, you acknowledge that we may process your personal data in accordance with this Privacy Policy. We are committed to protecting your privacy and handling your personal data responsibly and transparently.

• 1. Introduction
• ‍Voltox AG ("Voltox", "we", "us") provides an AI-powered facial age estimation and age verification platform, including the Smile & Pay service. This policy explains how we collect, use, and protect your personal data when you visit our website (voltox.ai) or use our platform, and sets out your rights under applicable data protection law. Depending on where you are located, this may include the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (nDSG), the UK GDPR, or other applicable privacy legislation.
• 
  2.Audience
• This policy applies to website visitors, platform users (business administrators and end users), and prospective customers or partners who interact with Voltox.
• 
  3.What type of personal data do we collect and how do we use it?
• 3.1 Standard Personal Data
      Account & profile data: name, email address, job title, employer, login credentials
      Contact data: correspondence by email or live chat (via Zendesk support)
      Usage & log data: IP address, device type, pages visited, timestamps
      Marketing data: email address (newsletter opt-in, opt-out available at any time), LinkedIn interactions
      Financial data: invoicing and payment information (processed via Stripe)
  ‍
  3.2 Special Category Data‍
  We process facial biometric data in connection with two services:    
       1.Age verification: when you use our age-estimation service, we capture a live facial image solely to determine whether you meet the applicable minimum age threshold for access to age-restricted content or products. The image is processed in real time and deleted immediately upon completion of each verification event.
      2.Smile & Pay: when you use our Smile & Pay service, we capture a live facial image to authenticate your identity and authorise a payment transaction. As with age verification, the image is processed in real time. You may also choose to store your biometric template in the Voltox e-wallet to enable faster, repeated authentication for future payments
      
  Both services involve the processing of sensitive biometric data, which is subject to heightened protection under applicable data protection law. We process this data only with your explicit prior consent, which you may withdraw at any time. Users who store biometric data in the e-wallet retain full control and may delete their account and associated data at any time.
• 
  4.How and When We Use Your Data
• We use personal data to operate and improve our services, communicate with you, keep our platform secure, and meet our legal obligations. Specifically, we use it to:
      Provide our age verification and Smile & Pay services, including facial age estimation and payment authentication
      Manage and support customer accounts, including onboarding and ongoing client communication
      Detect and prevent fraud, abuse, and security incidents
      Process invoices and payments
      Carry out marketing activities such as LinkedIn posts and newsletters
      Understand how our website and platform are used through analytics and cookies
      Comply with legal obligations and respond to regulatory or law enforcement requests
• 
  5. Legal Basis for Processing
• We will only process your personal data where we have a lawful basis to do so. The basis that applies will depend on the purpose of processing and the law applicable to you:
• Performance of a contract: processing necessary to deliver our services or take steps at your request before entering into a contract. This applies to account management, onboarding, invoicing, and payment processing.
• Explicit consent: required for all processing of facial biometric data, including age verification and Smile & Pay authentication. You may withdraw consent at any time, though this will prevent completion of the relevant service.
• Legitimate interests: where our interests in operating a secure and effective platform are not overridden by your rights. This applies to fraud prevention, security monitoring, and certain marketing activities.
• Consent: for cookie-based analytics and newsletter communications, where we ask for your opt-in.
• Legal obligation: where processing is required to comply with applicable law or respond to regulatory or law enforcement requests.
• 
  6.How do we share personal data?
• We share personal data in accordance with our privacy policy and legal obligations, withthe following entities:
    1. Sub-processors: third-party service providers acting on our instructions.
    2. Professional advisors: lawyers, auditors, and accountants, under strict confidentiality obligations
    3. Law enforcement or regulators: where legally required or to protect rights and safety
    4. Business transfers: in the event of a merger, acquisition, or restructuring, subject to appropriate confidentiality obligations
  
• 
  7.Where do we transfer personal data?
• Voltox's infrastructure is primarily EU/EEA-based, with core hosting and data processing located in Germany and Switzerland. This minimises cross-border data transfers.  
  Where we engage third-party sub-processors that operate outside the EEA (such as providers of communications, analytics, support, and payment services), we ensure that appropriate safeguards are in place. These include transfers to countries covered by an EU adequacy decision, reliance on the EU-US Data Privacy Framework where applicable, or the use of Standard Contractual Clauses (SCCs) approved by the European Commission.  
  All sub-processors are subject to contractual data protection obligations and are permitted to process personal data only on our documented instructions.  
• 
  8. Data Retention
• We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law.
• Biometric images (age verification): deleted immediately upon completion of each verification event. Images are never retained beyond the live session
• Biometric images (Smile & Pay, single-use): deleted immediately upon completion of each payment authentication event
• Biometric templates (Smile & Pay e-wallet): retained until the user deletes their account or removes the stored template
• Account and contract data: retained for the duration of the contract plus 6 years (statutory limitation period)
• Marketing data: until you withdraw consent or opt out
• Website analytics (Google Analytics): in line with Google's standard retention settings
• 
  9. Data Security
• Security is critical to our objectives, and we take the security of personal data as a priority item. We use up-to-date industry standards and practices to protect personal data from loss, misuse, and unauthorized access or disclosure. These steps take into account the sensitivity of the personal data we collect, process, and store, and the current state of technology. Given the nature of communications and technology, we cannot guarantee that personal data in our care will be absolutely safe from intrusion by others during transmission through the internet or while stored on our systems or otherwise.
• 
  10. Third-Party Links
• Our website or platform may link to third-party websites. This policy does not cover those sites. We recommend reading the privacy policy of any third-party site before providing personal data.
• 
  11.Children's Data
• The website and platform are not intended for children under the age of 16. We do not knowingly or intentionally collect personal data about children who are under 16 years of age.
  If you are under the age of 16, you may not use the website and platform unless parental or guardian consent is provided. If you believe that we may have any personal data from or about a person under the age of 16, please contact  privacy@voltox.ch.
• 
  12. Artificial Intelligence and Automated Decision Making
• Two of our services involve automated biometric processing: our facial age estimation service (which determines in real time whether you meet the applicable age threshold) and our Smile & Pay service (which authenticates your identity to authorise a payment transaction). In both cases the AI model processes a live facial image and produces an outcome without human intervention. Where applicable data protection law requires it, we rely on your explicit consent as the lawful basis for this processing. You have the right to:
• Request human review of any automated decision that produces a significant effect for you
• Express your point of view regarding the outcome
• Contest the decision
• To exercise these rights, contact us at privacy@voltox.ch.
• 
  13.Cookies
• We use cookies to understand how visitors use our website and platform. We will ask for your explicit consent before placing any cookies that identify you or track your behaviour.  You may manage your preferences through our cookie banner at voltox.ai, or adjust your browser settings. Rejecting non-essential cookies may limit some functionality  
• 
  14. Your Rights
• You have the right at any time to exercise your rights under the applicable data protection law. Note that we may ask that you verify your identity first.
  Your rights include:
• Being informed about the personal data we process about you;
• Accessing the personal data we process about you;
• Rectifying or updating the personal data you have provided;
• Requesting the deletion of your personal data;
• Opting out or objecting to certain uses of your personal data;
• Withdrawing consent at any time;
• Exercising the right to data portability; and
• Ask us to review any automated decisions made about your personal data.
• To exercise your rights, contact privacy@voltox.ch. We may ask you to verify your identity before processing your request. We will respond within the timeframe required by applicable law.  End users of our customers' platforms should contact the relevant business administrator in the first instance.  
• 
  15. Contact and DPO Details
• For any questions about this policy or your personal data"
      Email: privacy@voltox.ch
      Phone: +49 (0) 641/559274-0
  We will update this policy from time to time. Material changes will be communicated by a prominent notice on our website or, where appropriate, by email.