International data transfers from the EU, UK, and Switzerland

VoiceThread is a U.S. company and stores customer data on servers in the United States. This page details how transfers of personal data from the EEA, UK, and Switzerland are handled.

Our role: Under an institutional license, VoiceThread acts as a processor on behalf of the institution. The institution remains the controller of its users’ personal data and determines the purposes for which it’s used.

Transfer mechanism: VoiceThread’s standard institutional agreement includes a Data Processing Addendum incorporating the European Commission’s Standard Contractual Clauses and, for UK institutions, the UK International Data Transfer Addendum. These are the mechanisms VoiceThread relies on for transfers of personal data from the EEA, UK, and Switzerland. If your institution needs a DPA in place, get in touch and we’ll send one over.

Security and subprocessors: VoiceThread maintains a SOC 2 Type II report, available on request. Our current list of third-party service providers is published here.

A note on Privacy Shield: This page previously described VoiceThread’s participation in the EU-U.S. Privacy Shield Framework. The Court of Justice of the European Union invalidated Privacy Shield in July 2020, and it has not been a valid transfer mechanism since. VoiceThread does not rely on Privacy Shield, or on its successor the EU-U.S. Data Privacy Framework, for international transfers. Transfers are governed by the Standard Contractual Clauses and UK IDTA described above.

Questions about data protection can go to support@voicethread.com.