Privacy policy

This policy explains what personal data Datatoorder collects, why we collect it, how long we keep it, who we share it with, and what rights you have over it. It is written to satisfy the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), because we work with buyers, suppliers and speakers in all of those places.

In short: we collect the minimum needed to answer a business enquiry and to run a data project. We do not run advertising, we do not sell personal data, and we do not share it with data brokers. Speakers whose voices appear in a dataset are told concretely what the recording is for, and that consent is documented and travels with the dataset.

On this page

1. Who we are
2. Who this policy covers
3. Personal data we collect
4. Cookies and local storage
5. Why we process it, and our lawful bases
6. Voice and other sensitive data
7. Children
8. How long we keep it
9. Who we share it with
10. International transfers
11. Your rights
12. California residents (CCPA/CPRA)
13. Automated decision-making
14. Security
15. If something goes wrong
16. Links to other sites
17. Changes to this policy
18. How to complain
19. Contact

Who we are

Datatoorder is an AI data and trading platform: we collect, process and trade AI training data, and we work with vetted producers where a requirement needs capability we do not hold in-house.

Data controller. For the personal data described in this policy, Datatoorder is the data controller: meaning we decide why and how the data is processed, and we are accountable for it. Where we process personal data on a client's instructions under a delivery agreement, we act as a data processor for that client, and the client's own privacy notice governs that processing.

Our details. Registered business details, including the legal entity name, registration number and registered address, are stated in every contract we enter into and are available on request. We have not appointed a statutory Data Protection Officer; all data protection matters go through the contact route below and are handled by the person responsible for compliance.

Contact for privacy matters. Use the contact form and say it is a privacy matter, so it routes correctly.

Who this policy covers

Four groups of people, handled differently. If you are not sure which one you are, the section headings below will tell you.

• Website visitors: anyone browsing this site, whether or not you submit anything.
• Business contacts: people who send us an enquiry, subscribe to the newsletter, or correspond with us about a potential project, as a buyer or as a supplier.
• Speakers and contributors: the people whose voices, images, text or motion appear inside a dataset. These people usually never visit this website, and their data is collected under a separate, project-specific consent, not under this policy.
• Suppliers and producers: studios, annotation teams and field operations we work with, and the individuals at those organisations who deal with us.

Personal data we collect

From website visitors

Two things, and only two. First, the technical information your browser sends with every web request (IP address, user agent string, the page requested and the time) which our hosting provider records in standard server logs. Second, if you submit the request form, the information you type into it: your email address, company name, the language or data category you are asking about, approximate volume, and your message.

We do not use tracking pixels, advertising identifiers, social media plugins, or cross-site profiling. We do not attempt to identify individual visitors from server logs, and we do not enrich enquiry data with information bought or obtained from third parties.

From business contacts

Beyond the enquiry form itself, we keep a record of the correspondence: emails, the specification documents you send, quotes we issue, and notes on what was agreed. If a project proceeds, we also hold the contractual and billing records associated with it.

From suppliers and producers

When a supplier contacts us, we record the capability statement you provide: languages and dialects, recording conditions, annotation depth, monthly capacity, location: together with contact details and, where relevant, business documentation such as registration details or signed supplier terms.

From speakers and contributors in datasets

This is the category most people are asking about, so it is worth being precise. When we produce a dataset, the people recorded are asked for personal data that typically includes: their name, age band or date of birth, gender, region or accent background, language and dialect, a contact detail for consent withdrawal, and their signature or recorded verbal consent. Where a project calls for it, additional attributes such as a self-reported health or smoking status may be collected to characterise the acoustic sample, and where that happens, it is explained to the speaker at the time and covered by the same explicit consent.

This information is collected by us or by a producer working to our specification, under a consent form the speaker reads and signs, and it is delivered to the buyer as the dataset's consent documentation. It is never collected from this website.

What we deliberately do not collect

• Payment card details: invoicing is handled through bank transfer or a payment processor, and card data never reaches our systems.
• Any data from children, except where a specific project has guardian consent documented in advance.
• Recorded telephone calls, medical or clinical data, or scraped personal data. We decline these categories outright, so we never hold them.
• Biometric templates or voiceprints. We deliver audio recordings and their transcripts; we do not build speaker-identification models or extract voice embeddings.

Cookies and local storage

This site sets no cookies at all. That is a deliberate design choice, not an oversight. When you choose whether to accept or reject analytics, that choice is stored in your browser's local storage under the key dto-consent, not in a cookie. Local storage is never transmitted to us automatically. It stays on your device until you clear it, and we only read it from JavaScript running on this site.

If you accept analytics, we use a first-party analytics script served from this domain, which reports page views, scroll depth and call-to-action clicks to our own backend. It uses a randomly generated visitor identifier stored in your browser's local storage, containing no personal information, purely to avoid counting the same visit twice. The identifier is hashed again on our server before storage. Requests are sent without credentials, so no cookie or session is attached.

Where you are decides whether we ask first. Visitors in the European Union, the wider European Economic Area, the United Kingdom and Switzerland are asked for consent before anything is sent, and nothing is sent unless they accept. Visitors elsewhere, including the United States, have this first-party analytics switched on by default, because those jurisdictions regulate analytics on an opt-out basis rather than an opt-in basis. You can switch it off at any time with the control below.

If you reject, or you are in a region where we ask first and you do not respond, nothing is sent at all. Not a reduced payload, not an anonymised ping. No network request is made.

Turn analytics off

We do not use cookies or local storage for advertising, and there are no third-party trackers of any kind on this site. Fonts, stylesheets and scripts are all served from our own domain, so loading a page makes no request to any external provider.

Why we process it, and our lawful bases

Under the GDPR we must have a lawful basis for each purpose. This is the mapping. Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that the processing does not override your rights. You can ask to see the reasoning, and you can object to it.

We do not use personal data for automated marketing, profiling, or any purpose incompatible with the one it was collected for. If we ever want to use data for a new purpose, we will tell you first and, where the law requires it, ask for consent again.

Voice and other sensitive data

A voice recording can be linked to the person who made it, and a voice can be used to identify someone. That makes voice data a sensitive category in practice, even where the law does not label it as one, and we treat it accordingly.

Our consent process requires that every speaker is told, concretely and before recording: what the recording will be used for; who it may be shared with and on what terms; how long it will be retained; that it may be used to train machine learning models; and how to withdraw consent afterwards. Consent is documented on a signed form, or as a recorded verbal statement where a project requires it, and that documentation is delivered with the dataset so the buyer can evidence the chain.

We do not produce datasets where consent was obtained through an employer or a platform's general terms and conditions, because a blanket acceptance of terms is not specific consent for a recording to be used in model training. Where a project would depend on that kind of implied consent, we decline it.

Where a speaker withdraws consent, we pass the withdrawal to the buyer of the affected dataset along with the identifiers needed to act on it, and we remove the speaker's records from our own systems. Because a delivered dataset is a copy held by the buyer, erasure from the buyer's copy depends on the terms of the delivery agreement, which is exactly why we require buyers to accept a withdrawal-handling clause before delivery.

Children

This website is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18 through this site.

In datasets, recordings of minors are produced only where guardian consent has been obtained and documented in advance, where the permitted use is stated explicitly, and where the project has a legitimate purpose that requires child voices, for example, speech recognition for children's educational products. We do not produce children's voice data without that documented consent, and we do not accept projects where it cannot be obtained.

How long we keep it

These are our retention periods. They are commitments, not estimates. When a period ends we delete the data or, where deletion is not immediately possible, irreversibly anonymise it.

Where a legal claim, an audit or a regulatory obligation requires it, we may keep a specific record beyond these periods. If that happens we keep only what is needed for that purpose.

Who we share it with

We do not sell personal data, and we do not share it with data brokers, advertising networks or list vendors. Sharing is limited to the following, and only to the extent a specific project or purpose requires it.

• Producers and annotation teams. When a project involves production capacity outside our own teams, those partners receive the minimum needed to do the work, typically the specification and any speaker records for their part of the project, under written terms restricting them to that purpose, requiring confidentiality, and requiring the same standard of consent handling we apply ourselves.
• Buyers of a dataset. A delivery includes the consent documentation for the speakers in that dataset, because without it the data is not usable. That documentation contains the speaker attributes listed above; it does not contain contact details beyond what is needed to operate a consent withdrawal.
• Service providers. Hosting, email delivery and accounting providers process data on our instructions and under contract. They are listed in the sub-processor register described below.
• Professional advisers. Lawyers and accountants, where they need it to advise us, and under professional confidentiality.
• Authorities. Where we are legally required to disclose, or where it is necessary to establish, exercise or defend a legal claim. If we are compelled to disclose, we will tell the affected individuals unless we are legally prohibited from doing so.
• A successor entity. If the business is sold or reorganised, personal data may transfer to the buyer as part of the assets. The new owner remains bound by this policy for data collected under it, and we will tell affected contacts before any transfer takes effect.

Sub-processor register. A current list of the service providers that process personal data on our behalf, with their locations and purposes, is available on request through the contact form. Clients with a delivery agreement receive it as part of the contract pack, and are notified before a new sub-processor is added for their project.

International transfers

We work across borders, so personal data may be processed outside the country where it was collected. Where personal data collected in the European Economic Area, the United Kingdom or Switzerland is transferred to a country that has not received an adequacy decision, we put a lawful transfer mechanism in place before the transfer happens.

In practice that means the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, or the Swiss equivalent, together with a transfer risk assessment that considers the laws of the destination country and what additional safeguards are needed. Where a provider is certified under an approved framework, we may rely on that instead.

For speaker data in a dataset delivered to a buyer, the transfer mechanism is stated in the delivery agreement and in the consent documentation the speaker receives. Buyers can request the specific mechanism in writing, and we will state it before a contract is signed.

Your rights

Depending on where you live, you have some or all of the following rights. We honour all of them for everyone, regardless of location, because operating two standards of privacy is not worth the complexity.

• Access. To be told whether we hold personal data about you and to receive a copy of it.
• Rectification. To have inaccurate data corrected, and incomplete data completed.
• Erasure. To have your data deleted, where no overriding legal basis requires us to keep it.
• Restriction. To have processing limited while a dispute about accuracy or lawfulness is resolved.
• Objection. To object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Portability. To receive data you provided in a structured, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Withdraw consent. To withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Non-discrimination. To exercise any of these rights without being denied service or charged differently.

To exercise any right, use the contact form and say it is a privacy request. We will respond within 30 days, and we will tell you if we need longer and why. We may ask for information to confirm your identity, but we will not ask for more than is needed, and we will never ask you to pay to exercise a right.

If you are a speaker whose recording is inside a dataset we delivered, tell us the project or dataset name if you know it, and any approximate recording date. We will trace your record through the consent documentation. Where your consent is withdrawn, we will remove your records from our systems and notify the buyer of the affected dataset, as described above.

If you are a supplier or a producer's staff member, we may hold your data in our supplier records rather than in a project record. The same address handles it.

California residents (CCPA/CPRA)

This section applies to you if you are a California resident, and it supplements the rest of this policy. It uses the terminology of the California Consumer Privacy Act as amended by the California Privacy Rights Act.

Categories of personal information we collect. Identifiers (name, email address, company, IP address); commercial information (records of services enquired about or purchased); internet or network activity (pages viewed, if you accept analytics); professional information (job title, employer, where you provide it); and, for speakers in datasets, characteristics collected as part of the recording specification. We do not collect biometric information as defined by the CPRA. We do not create voiceprints or speaker-recognition templates.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information. Where speaker data includes characteristics that the CPRA treats as sensitive, it is used solely to characterise the acoustic sample and to evidence consent: never to infer characteristics about a person or to build a profile. We do not use or disclose sensitive personal information for purposes beyond those permitted by the CPRA, so no limitation request is necessary, though you may still make one.

Your California rights. You have the right to know what categories and specific pieces of personal information we hold, to delete it, to correct it, to opt out of sale or sharing (there is nothing to opt out of, but the right stands), to limit the use of sensitive personal information, and to be free from discrimination for exercising any of these. You may also designate an authorised agent to act for you; we will ask the agent for written authorisation and may still contact you to verify.

Global Privacy Control. We honour the Global Privacy Control signal. Because we do not sell or share personal information for advertising, a GPC signal does not change what we do, but it is recorded as a preference, and we do not treat a browser's "Do Not Track" header as consent to anything.

To exercise a California right, use the contact form. We will acknowledge within 10 business days and respond substantively within 45 days, extending once by a further 45 days where needed and telling you why.

Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects or similarly significantly affects you. Decisions about quotes, projects and supplier relationships are made by people. Our analytics reports aggregate visit data; no individual visitor is scored, ranked or targeted as a result of it.

Security

We restrict access to personal data to the people who need it to do their work, and access to speaker consent records is limited further. Data is encrypted in transit, stored on access-controlled infrastructure, and backed up so it can be restored. Where we work with producers and service providers, we require them to apply equivalent protections under contract, and we assess them before they receive personal data.

We hold no payment card data, which removes an entire class of risk from our systems. No system is perfectly secure, and we do not claim otherwise. What we commit to is the response: see the next section.

If something goes wrong

If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where the law requires it, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to individuals, for example, where speaker consent records are exposed . We will notify the affected individuals directly, in clear language, telling them what happened, what data was involved, what we have done, and what they can do.

Where a breach affects a dataset we have delivered, we notify the buyer as well, because they hold a copy and may have their own notification obligations.

Links to other sites

This site links to external websites, for example, to supervisory authority guidance or to industry references. We are not responsible for their privacy practices, and this policy does not apply to them. If you follow a link and are asked for personal data, read that site's own notice first.

Changes to this policy

We review this policy at least once a year, and whenever we change how we handle personal data. When we make a material change, we update the date at the top of this page and, where the change affects people we can reasonably reach, for example, where it concerns how speaker data is handled. We will tell affected contacts directly rather than relying on this page alone.

Continuing to use the site after a change takes effect indicates acceptance of the revised policy for website use. It does not, and cannot, replace the consent a speaker gives for a recording, which is always obtained separately and specifically.

How to complain

If you are unhappy with how we have handled your personal data, tell us first through the contact form. Most issues are resolved faster that way, and we would rather fix the problem than have it escalated.

You also have the right to complain to a supervisory authority. If you are in the European Economic Area, you can complain to the authority in the country where you live, where you work, or where the alleged infringement happened. If you are in the United Kingdom, that is the Information Commissioner's Office. If you are in Switzerland, it is the Federal Data Protection and Information Commissioner. If you are in California, you may contact the California Privacy Protection Agency or the Attorney General. You do not need to complain to us first, and exercising this right will not affect how we treat you.

Contact

All privacy questions, requests and complaints: use the contact form and say it is a privacy matter. If your message concerns a specific dataset or project, include its name and we will route it to the right record.

For anything that is not about privacy. A data enquiry, a supplier approach, or a correction to something on this site: use the contact page instead, which reaches the right person faster.