My Voice privacy policy

Effective date: 22 October 2026

1. About this policy

This privacy policy explains how personal information is handled when you use My Voice, an employee support and workplace concern-reporting app, and My Voice Business Hub, which authorised staff use to handle concerns. Both are provided by MKC Enterprises Ltd.

My Voice allows employees of participating organisations to raise concerns, access support resources, ask questions, request meetings and follow the progress of confidential concerns they have submitted.

The information processed through My Voice may be sensitive. We aim to limit access to people who are authorised to carry out the relevant work.

2. Who is responsible for your information

MKC Enterprises Ltd operates the My Voice platform.

When an employer uses My Voice to manage workplace concerns, the employer determines important aspects of the investigation, including its purpose, the decisions made and how employment-related records are handled. MKC Enterprises Ltd provides the technology and technical administration supporting that process.

The precise responsibilities of MKC Enterprises Ltd and each participating organisation depend on the processing activity and the arrangements governing that organisation’s use of My Voice.

You may contact MKC Enterprises Ltd about platform-related privacy matters. Requests concerning the substance of an employment investigation may need to be handled by the responsible organisation.

3. Information processed through My Voice

Depending on how you use My Voice, the following information may be processed:

• Account information: name, email address, password (held by our authentication provider and never readable by us), organisation membership, workplace location, role and account status.
• Workplace concerns: report categories, descriptions, dates, times and locations, people identified in reports (including people who do not use My Voice, such as witnesses), supporting information and investigation records, including notes made by the people handling a concern. A concern may also be recorded by your organisation’s HR team on behalf of someone who does not use My Voice.
• Photos and documents: JPG, PNG or PDF attachments on confidential concerns. Location and device information is removed from photos on your device before upload. PDF files are uploaded unchanged, including any information stored inside them.
• Sensitive information: information about health, wellbeing, discrimination, harassment or other matters that may be included in a workplace report.
• Questions and requests: questions and meeting or phone-call requests (topic, message, preferred times and format), replies, and records of contact made by the people handling them. Questions and requests are not anonymous.
• Technical and security information: account identifiers; sign-in sessions, including IP address, browser or device information and session times; records of actions taken on cases; and records needed to protect the service. For Business Hub staff, this also includes trusted-device and PIN-unlock records.
• Staff contact details: for authorised staff, a mobile phone number if their organisation turns on text-message alerts, and organisation contact details.
• On your device: your signed-in session (stored in the iOS Keychain, which can remain after you delete the app), unsent drafts (in encrypted storage), your app PIN (stored only as a protected hash) and a “remember me” setting.
• Support communications: information you provide when contacting customer service.

A concern may contain information about other people, including witnesses or individuals named in an allegation. Please provide information that is relevant to your concern and avoid including unnecessary personal details.

4. Confidential and anonymous concerns

My Voice supports confidential and anonymous reporting. Both are routed through the same escalation process.

• Confidential concerns: your identity is available only to people handling your concern who also hold a separate permission to see reporter details, and each time they view it is recorded. Access is controlled according to roles, permissions, involvement in the concern and investigation responsibilities. You can add attachments, exchange messages and follow updates.
• Anonymous concerns: organisation users are not shown the reporter’s identity through the reporting workflow and cannot use My Voice to contact the anonymous reporter. Anonymous concerns are one-way: you cannot add attachments, exchange messages or receive updates on them, and they are not added to your account.

Absolute anonymity cannot be guaranteed. A report’s contents, timing or circumstances, details known independently to other people, or the fact that the reporter is left out of the list of people who could be assigned to handle it, may allow someone to infer who submitted it.

Technical processing and limited security or conflict-prevention measures still occur as part of operating the service. For example, if you also hold a staff role at your organisation, a protected record is kept only to stop you being assigned to investigate your own anonymous report; it is not shown to your organisation. My Voice does not promise that no technical information is processed in connection with an anonymous submission.

5. How information is used

Information is processed to:

• Operate and secure employee and staff accounts.
• Verify access to participating organisations.
• Submit, assign, investigate and resolve workplace concerns.
• Show in-app updates on confidential concerns and support authorised communications.
• Process questions and meeting requests.
• Provide workplace support resources.
• Send account emails (email verification and password reset), schedule meeting and call reminders on your device, and send alerts to authorised staff.
• Provide reports and statistics to authorised staff of your organisation.
• Maintain security records, investigate misuse and prevent unauthorised access.
• Comply with applicable legal obligations and respond to lawful requests.

Employees do not receive push notifications, emails or text messages about their concerns. My Voice does not use advertising, analytics or crash-reporting tools and does not track you across other apps or websites. Workplace investigation decisions are subject to the responsibilities and policies of the relevant participating organisation.

6. Lawful processing and sensitive information

Personal information must be processed under an applicable lawful basis under UK data protection law. The applicable basis may differ depending on whether information is processed for account administration, platform security, an employment matter or a workplace investigation.

Some reports may contain special category personal information or allegations concerning criminal conduct. Such information requires additional legal safeguards and, where applicable, an appropriate condition under UK data protection law.

My Voice does not make these legal determinations on behalf of every participating employer. Each responsible organisation must establish the lawful basis and additional conditions applicable to its processing.

7. Who may access information

Access to workplace concern information is restricted through organisation membership, assigned roles, case-handling permissions and conflict-of-interest protections.

• Depending on the concern, authorised Store Managers, HR staff, Supervisors or Owners of your organisation may have access, following the route Store Manager → HR → Supervisor → Owner.
• People identified as involved in a concern who have a My Voice account are kept out of handling and deciding it. People named who do not use My Voice cannot be excluded technically.
• For a concern about an Owner of your organisation, or where nobody at the right level can handle it, an independent reviewer appointed by MKC Enterprises Ltd sees a summary without the reporter’s identity and may appoint one investigator. That investigator may be from your organisation’s HR or Supervisor staff, or independent, and has access to that case only, ending when it closes.
• MKC Enterprises Ltd platform administrators may access information across organisations where needed to operate, support and secure the service.
• Licensed workplace material (for example an employer’s employee-assistance details) is shown only to active members of that employer’s organisation, and only while the employer has it enabled.

Access is designed so that one participating organisation cannot view another organisation’s information.

8. Service providers and data sharing

My Voice uses these technology providers to operate the service:

• Supabase: database, authentication, file storage and related backend services.
• Vercel: hosting for My Voice Business Hub and supporting web services.
• Resend: email delivery, including account emails to you (email verification and password reset) and notification emails to authorised staff.
• Twilio: text-message alerts to authorised staff, only where their organisation turns this feature on.

These providers may process information necessary for their respective functions, subject to applicable arrangements and safeguards.

Information may also be disclosed where required by law, to address security incidents, or to authorised individuals and organisations responsible for handling a workplace matter.

My Voice does not operate as an advertising service and does not use workplace concern contents for targeted advertising.

9. Where information is processed

The primary My Voice database is hosted in London, United Kingdom.

Some supporting service providers may process information in other countries, depending on their infrastructure and contractual arrangements. Where personal information is transferred internationally, the responsible parties must ensure that an appropriate legal transfer mechanism and relevant safeguards are in place.

10. How long information is kept

We do not currently delete information automatically. Concerns, investigation records, evidence, messages and their audit history are kept so investigations stay complete and verifiable, and your employer may need them for its own legal obligations. My Voice does not yet provide retention controls for organisations; until a retention schedule is in place, these records are kept. If we introduce defined retention periods, we will update this policy before they apply.

Account information is removed or unlinked when an account is deleted (see Account deletion), while workplace investigation records remain.

The platform also keeps technical records and backups needed for security, operation and recovery. Supabase provides automatic database backups, currently retained for approximately seven days. Other recovery copies of the database are held separately where required for system maintenance or recovery.

For information about the retention of a specific workplace concern, contact the organisation responsible for handling it, or contact us for help identifying the appropriate route.

11. Account deletion

You can delete your account in the app: More › Security and privacy › Data privacy › Delete my account. It is also available before your workplace approves you. Deletion takes effect straight away.

• Removed: your account, profile, memberships, roles and sign-in sessions, and the link between you and any confidential concern you raised.
• Kept by your organisation: concerns, investigation records, messages, questions and meeting requests remain without a link to you, attributed to a deleted user.
• Anonymous reports: not changed, because they were sent without your name.

Deleting an account does not remove an employer’s existing investigation records, which may need to be retained for legal, regulatory, employment-related or evidential reasons. Where they are retained, access remains subject to the permissions and safeguards described above.

Staff and administrator accounts cannot be deleted in the app; your organisation can remove your access, or contact us.

Contact customerservice@mkcenterprises.co.uk if you need help with account deletion or a privacy request. Your choices in the app are summarised on Your privacy choices.

12. Your privacy rights

Depending on the circumstances and applicable law, you may have rights to:

• Be informed about how your personal information is used.
• Request access to your personal information.
• Request correction of inaccurate information.
• Request erasure where applicable.
• Request restriction of processing.
• Object to certain processing.
• Request data portability where applicable.
• Challenge certain automated decisions where legal conditions apply.

These rights are subject to applicable legal conditions and exemptions. Where a request concerns employer-controlled investigation data, it may need to be referred to the responsible employer.

You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

13. Security

My Voice uses access controls, authentication, organisation-specific permissions and server-side restrictions designed to protect personal information. Workplace cases are subject to additional rules governing access, escalation and conflicts of interest.

No internet-based service can guarantee absolute security. Please protect your sign-in details and report suspected unauthorised access.

14. Support and external resources

My Voice may provide links to resources operated by participating employers or external organisations, such as helplines, employee-assistance services or surveys. Opening a link takes you to that organisation’s website or service; My Voice does not add your personal details to the link. That provider may process information under its own privacy practices, which you should review.

15. Changes to this policy

We may update this privacy policy to reflect changes to the platform, applicable law or our processing practices. The current version and its effective date are published on this page. We will notify participating organisations of material changes.

16. Contact us

For questions about this privacy policy, your account information or the operation of My Voice, contact:

MKC Enterprises Ltd
4th Floor Llanthony Warehouse, The Docks
Gloucester, Gloucestershire, England, GL1 2EH
Email: customerservice@mkcenterprises.co.uk

• Support
• Privacy policy
• Terms of use
• Privacy choices