Volta Privacy Policy

1. Introduction

This Privacy Policy explains how Volta Infrastructure Holdings Limited ("Volta", "we", "us", "our") collects, uses, shares and protects personal data when you visit volta.com, use our products and services, or otherwise interact with us.

We take the privacy of personal data seriously - it sits at the heart of what we build. As a provider of confidential computing infrastructure, the protection of data is our core product proposition, and that mindset extends to the data we hold about the people who visit our website and engage with us.

This Privacy Policy concerns the personal data which Volta controls - primarily from website visitors, prospects, contacts and customers.

2. Who we are

Volta Infrastructure Holdings Limited is the data controller for the personal data we collect about you.

If you have any questions about this Privacy Policy, or if you would like to exercise any of your legal rights in respect of your personal data, please contact our Data Protection Representative using the following details:

• Registered company name: Volta Infrastructure Holdings Limited
• Company number: 16953078
• Registered office: 66 Lincoln's Inn Fields, London, WC2A 3LH
• UK Data Protection Representative: Thomas Muller, contactable at privacy@volta.com
• EU Data Protection Representative: Thomas Muller. In the first instance, we request that EU enquiries are sent to privacy@volta.com

3. The types of personal data we collect

We may collect and process the following personal information about you. We minimise collection to what is necessary for the purpose at hand.

Information you give us directly

• Contact details when you fill in a form on our website (e.g. your name, work email, company, role, country)
• Information you provide when you email us, call us or meet with us
• Information you provide if you become a customer (account details, billing information)
• Information you provide when subscribing to our newsletter, marketing communications or downloading gated content (your email address, phone number, subscriptions, communication preferences)

Information collected automatically

• Device and browser information (IP address, browser type, operating system, device identifiers)
• Website usage information (pages visited, the amount of time you spend on a page, referring URLs, interaction events)
• Behavioural and product analytics data (the electronic path you take through our services, your interactions with content)
• Cookie and similar technology data - see our Cookie Policy

Information from third parties

• Information from business intelligence providers (e.g. enriched contact data for B2B sales prospecting)
• Information from analytics and advertising platforms (e.g. ad campaign engagement attribution)
• Information from public sources (e.g. LinkedIn for verified business contacts)
• Information from lead generation form integrations (embedded HubSpot forms; LinkedIn Lead Gen Forms if/when paid campaigns launch - not active at launch)

We do not knowingly collect special category personal data (e.g. data concerning health, religion, or biometric data) through our website or marketing activities.

4. Why we process your personal data and the legal basis we rely on

5. Marketing communications and newsletter

If you subscribe to our newsletter, request gated content, attend our events, or engage with our marketing forms, we will send you communications related to your interest in Volta. This may include product updates, technical content, event invitations, and case studies.

We use HubSpot to deliver our marketing communications and to gather aggregate metrics around email opens, clicks and engagement. The information collected is used to improve the relevance of our communications and is not shared with third parties for their own use.

You can unsubscribe at any time by clicking the link at the bottom of any marketing email, by adjusting your preferences in the preference centre, or by contacting privacy@volta.com.

Lead generation form submissions are limited to the fields necessary to follow up - typically name, email and company - and are processed under legitimate interests.

6. Session recording and behaviour analytics

Where we use session recording or replay tools (currently Hotjar) to understand how users interact with our website, we configure those tools to anonymise or exclude sensitive fields (passwords, authentication tokens, payment data, support ticket content). Recordings are used for limited, internal analysis to support service reliability, performance and UX improvements.

7. How we share personal data

We share personal data only where it is necessary, and only with parties bound by appropriate confidentiality and data protection obligations. Examples of the categories of recipient that we share personal data with are as follows:

• Service providers acting on our instructions - e.g. cloud infrastructure providers, CRM platforms, analytics providers, email service providers, communication platforms, advertising platforms
• Professional advisors - e.g. lawyers, accountants, auditors
• Regulators, courts and law enforcement - for our compliance with our legal obligations including for tax and reporting requirements, or to report crimes. In this respect and if required, we will share your data with e.g. tax authorities, the police and other competent authorities
• Acquirers or successors - in the event of a corporate transaction e.g. a merger or acquisition, or for financing purposes
• Our customers - where you are a user of a service we operate and there exists an independent or joint controller relationship

We do not sell personal data.

A list of the third-party processors we use, including their location and the safeguards in place to protect personal data is published at volta.com/subprocessors

8. International transfers

Some of our service providers are based outside the UK and the EU. Where personal data is transferred outside the UK or the EU, in order to ensure that your personal data continues to have adequate protection when it is transferred out of the UK and the EU, your personal data will only be transferred on one of the following bases:

• a legal decision made by the UK or the EU provides that the country or territory to which the transfer is made ensures an adequate level of protection
• where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (for example, the International Data Transfer Agreement or other Standard Contractual Clauses adopted by the UK Secretary of State or the EU Commission, as applicable)
• where the transfer is to a US organisation which has an active certification under the EU-US Data Privacy Framework and, for UK transfers, the UK Extension to that framework
• there exists another situation where the transfer is permitted under applicable law (for example, where the transfer of your personal data is necessary for the performance of a contract with you, the transfer is occasional and none of the above bases apply)

A list of the countries we transfer data to, and the safeguards in place, is available on request from privacy@volta.com.

9. How long we keep personal data

We will retain your personal data for as long as we are interacting with you via the website, for as long as necessary to keep in touch with you where you have previously asked for this (e.g. where you have signed up for our email newsletter), and for as long as permitted or required for legal and regulatory purposes after the last such interaction we have with you or following the expiry or termination of your contract(s) with us.

Subject to any other notices that we may provide to you, we will typically retain your personal data for at least seven years after our last interaction with you.

10. Your rights

Under UK GDPR and EU GDPR you have rights in relation to your personal data:

• to obtain access to, and copies of, the personal data that we hold about you;
• to require us to correct the personal data we hold about you if it is incorrect;
• to require us to erase your personal data in certain circumstances;
• to require us to restrict our data processing activities in certain circumstances;
• to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on you;
• to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller; and
• where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal.

Note: If you have given your consent (e.g. to receive our email newsletters) and you wish to withdraw it, please contact us. Where our processing of your personal data relies on your consent and you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services.

Please note that the above rights are not absolute, and we may be entitled or required to refuse requests where exceptions apply.

If you are not satisfied with how we handle your data, you have a right to lodge a complaint with us. You also have a right to lodge a complaint with:

• UK: the Information Commissioner's Office (ICO) at ico.org.uk
• EU: the data protection authority in your country - a list of the various authorities is available at edpb.europa.eu

11. How we keep personal data secure

We take technical and organisational measures to protect personal data, including:

• Encryption in transit and at rest for personal data we hold
• Access controls
• Regular security review and penetration testing
• Staff training in data protection
• Incident response procedures

Volta is committed to industry-recognised security standards, such as SOC 2 and ISO 27001.

12. Cookies and consent management

We use cookies and similar technologies on our website. For details of which cookies we use, why, and how you can manage them, please see our Cookie Policy.

We use Cloudflare to manage your cookie and tracking preferences. You can update your preferences at any time by clicking "Cookie settings" in the footer of the website.

13. Third party links

Our website may include links to third party websites. We are not responsible for the privacy practices of those websites. Please read their privacy notices before providing personal data.

14. Children

Our website and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected personal data from a child, please contact privacy@volta.com.

15. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes. Where a change is material, we will draw it to your attention by an appropriate means - e.g. an email notice to active contacts or a prominent notice on the website.

16. How to contact us

For any privacy-related question or to exercise your rights:

• Email: Thomas Muller, privacy@volta.com
• Post: Volta Infrastructure Holdings Limited, 66 Lincoln's Inn Fields, London, WC2A 3LH