This document constitutes both a formal declaration of standards and an operational framework. Every person who works for, with, or on behalf of VML Kids and who comes into contact with personal data, safeguarding information, or platform systems is required to read this document in full, understand its obligations, and sign the declaration.
Signing this document is not a formality. It is a commitment. The obligations set out here are binding, enforceable, and in several respects carry legal weight independent of this document by virtue of UK law. Ignorance of an obligation is not a defence against breach of it.
This framework will be reviewed on a mandatory annual cycle and immediately upon any relevant change in legislation, statutory guidance or judicial interpretation. Staff will be required to re-sign on each review.
Section 1The Governing Principle
The protection of children is the absolute and non-negotiable priority of this platform. Every decision made by every member of staff — in every role, at every level — must be made with the best interests of the child as the primary consideration.
This principle is not aspirational. It is operational. Where any other consideration — commercial, reputational, procedural, personal or managerial — conflicts with the protection of a child, the protection of the child takes precedence. Without exception.
This principle derives from Article 3 of the United Nations Convention on the Rights of the Child (UNCRC), incorporated into this platform's Statement of Intent (VML-KIDS-SOI-001).
Section 2Scope — Who This Document Applies To
This document applies to all of the following, without exception:
- All permanent and temporary employees who have access to personal data, platform systems or safeguarding information
- All contractors, consultants and associates with access to personal data, platform systems or safeguarding information
- All members of the Independent Safeguarding Panel
- All human review queue staff
- All moderators
- All technical staff with access to platform infrastructure, databases or user data
- All management at any level
Section 3Core Obligations — All Roles
The following obligations apply to every person within the scope of this document, regardless of role.
3.1 Child Safety — Absolute Priority
- The safety and wellbeing of children on this platform takes precedence over all other considerations at all times.
- You are required to act on any concern about a child's safety that comes to your attention, regardless of whether it falls within your specific role.
- You must never allow process, hierarchy, commercial pressure or personal discomfort to delay action where a child's safety is at risk.
- You must never discourage, obstruct or fail to act on a safeguarding concern raised by any person.
3.2 Confidentiality
- All information accessed in the course of your work — including personal data, safeguarding concerns, escalation reports and platform data — is strictly confidential.
- You must not disclose any such information outside the platform except where required by law, authorised by the Safeguarding Director, or required as part of a formal escalation to statutory authorities.
- Confidentiality obligations continue after your employment or engagement ends. They do not expire.
- You must not discuss cases or individual children in any unsecured environment, including in public, by personal email, or by personal messaging applications.
- Breach of confidentiality is a disciplinary matter and may constitute a criminal offence under the Data Protection Act 2018 and UK GDPR.
3.3 Data Protection and GDPR
- All personal data processed in the course of your work is subject to UK GDPR and the Data Protection Act 2018. You are required to process personal data lawfully, fairly and transparently.
- You must access only the personal data necessary for the performance of your specific role. Access beyond what your role requires is a breach of this framework and of UK GDPR.
- You must not copy, download, print or transfer personal data except where expressly authorised as part of your role.
- You must report any actual or suspected personal data breach to your line manager and to the Data Protection Officer immediately upon becoming aware of it.
- Children's personal data carries the highest level of protection under UK GDPR. Special care must be taken at all times in its handling.
3.4 Mandatory Reporting
- Where you become aware of information that gives rise to a safeguarding concern, you are required to report it through the appropriate channel immediately — regardless of how you became aware of it.
- You must not investigate concerns yourself. Your obligation is to report, not to resolve.
- You must not promise confidentiality to any person who discloses a safeguarding concern to you.
- Failure to report a safeguarding concern is a disciplinary matter and may constitute a criminal offence.
3.5 Conduct and Professional Standards
- You must maintain the highest standards of professional conduct at all times in the performance of your role.
- You must not form personal relationships with children or parents on the platform outside of your professional capacity.
- You must challenge and report any conduct by a colleague that appears to breach this framework, regardless of their seniority.
- You must cooperate fully with any internal or external investigation conducted in connection with a safeguarding concern.
Section 4Immediate Escalation — Critical Alerts
The following categories of concern require immediate escalation without waiting for internal review, panel assessment or management approval. These are not judgment calls. Where evidence of any of the following is identified, the response is immediate.
⚠ CRITICAL ALERT — IMMEDIATE ESCALATION REQUIRED — Click each alert for the full procedure
Missing or Kidnapped Child with Active Account
Where a child has been reported missing, abducted or kidnapped and their VML Kids account shows activity — immediate escalation to Duty Safeguarding Director, immediate contact with police, immediate capture and preservation of all account logs, device data, location data and communications. Account must be monitored in real time. This constitutes live intelligence in an active police investigation.
Adult Confirmed Posing as a Child
Where biometric verification, facial recognition or document integrity checks produce evidence that an adult has attempted to register as a child — immediate account freeze, automatic escalation package generated, immediate referral to Independent Safeguarding Panel and Duty Safeguarding Director. Police referral without delay.
Document Fraud — Faked or Tampered Identity Document
Where a government-issued identity document shows evidence of tampering, photograph substitution or data manipulation — same response as above. Two simultaneous failure signals (document integrity and biometric mismatch) constitute essentially no innocent explanation.
Child Removed from Resident Parent in Breach of Court Order
Where platform data indicates that a child is in the presence of a person prohibited from contact by a court order, or has been removed from a resident parent without lawful authority — immediate escalation to Duty Safeguarding Director who must call a Safeguarding meeting and liaise with the resident parent's local Police force..
In all Critical Alert situations — without exception:
- Do not wait for authorisation before escalating — escalate and notify simultaneously
- Do not contact the account holder, the parent or any third party — preserve the integrity of the situation
- Capture and preserve all relevant logs, data and communications immediately
- Document every action taken with timestamp from the moment the alert is identified
- Do not delete, modify or allow access to any data connected to the concern without an explicit written instruction from the Duty Safeguarding Director.
Section 5Role-Specific Obligations
The following obligations apply in addition to the core obligations in Section 3. Every member of staff must read the obligations for their own role. Management must read all role obligations.
Moderators
- Monitor public communications on the platform in accordance with documented monitoring procedures and risk thresholds.
- Flag any content or behaviour that meets or approaches the risk threshold into the human review queue without delay.
- Do not make safeguarding decisions. Your role is to flag, not to adjudicate. When in doubt, flag.
- Do not engage with, respond to or warn any account holder about a flag you have raised.
- Document all flags with sufficient detail to enable the human review queue to assess the concern without requiring follow-up.
- Report any pattern of concern — including concerns that individually fall below threshold but collectively give rise to concern — to your line manager and into the safeguarding review queue.
- Escalate immediately to the safeguarding review queue supervisor if you identify content that may constitute a Critical Alert as defined in Section 4.
Human Review Queue Staff
- Review all flagged content referred to the queue promptly and in accordance with documented review procedures.
- Your standard response is to assess the concern and escalate to the Independent Safeguarding Panel where the higher threshold is met.
- You have authority to take immediate action — without waiting for panel review — in any situation that constitutes a Critical Alert as defined in Section 4. In those situations, escalate to the Duty Safeguarding Director immediately and simultaneously escalate to the Police where sufficient threat exists.
- Document every review decision with your assessment, the evidence considered, and the action taken or rationale for no action.
- A decision not to escalate must be as well-reasoned and documented as a decision to escalate.
- You must not contact any account holder, parent, school or third party in connection with a concern under review without explicit authorisation.
- Report any pressure — from any source — to assess a concern differently than your professional judgement indicates to the Duty Safeguarding Director immediately.
- If you are concerned about the behaviour of colleagues or that reasonable concerns raised are not being acted upon, you must raise these concerns to the Independent Safeguarding Panel, not the Duty Safeguard Director, or via the Whistleblower reporting system at your first opportunity.
Safeguarding Reviewers — Independent Panel Members
- You are independent of platform management. Your safeguarding decisions are not subject to direction, approval or override by platform management.
- Assess all concerns referred to the panel in accordance with established safeguarding standards, UK child protection law and the principles set out in this framework.
- Where the threshold for escalation to statutory authorities is met, you have authority to refer directly to the appropriate child protection authority — police, social services, CEOP or other relevant body — without requiring management approval.
- Generate formal escalation reports in the standardised format, containing all relevant platform data, for use by statutory authorities.
- Where you identify management pressure, obstruction or interference in a safeguarding decision, you are required to document it and report it directly to statutory authorities where necessary.
- Your independent status does not exempt you from the confidentiality, GDPR and conduct obligations in Section 3 of this framework.
Technical Staff
- You may have access to platform infrastructure, databases and personal data that exceeds what most staff encounter. This access carries heightened responsibility.
- Access only the data and systems necessary for the performance of your specific technical role. Any access beyond operational necessity is a breach of UK GDPR and this framework.
- You must never modify, delete or allow access to data connected to a safeguarding concern or investigation without explicit written instruction from the Safeguarding Director.
- Where you encounter personal data, content or system logs that give rise to a safeguarding concern, you are required to report it immediately — regardless of whether you were looking for it.
- You must report any actual or suspected data breach, system compromise or unauthorised access attempt immediately to your line manager and the Data Protection Officer.
- Technical development and changes to platform systems that affect safeguarding functionality require sign-off from the Safeguarding Director before implementation.
Management
- Ultimate responsibility for the delivery of this framework rests with senior management. That responsibility cannot be delegated away.
- You must ensure all staff within your area of responsibility have read, understood and signed this framework and receive appropriate training to fulfil their obligations.
- You must create and maintain an environment in which safeguarding concerns can be raised without fear of negative consequence. Any culture of silence or suppression around safeguarding is a management failure.
- You must never direct, pressure or incentivise any member of staff to assess a safeguarding concern differently than their professional judgement indicates.
- You must never obstruct, delay or interfere with an escalation to the Independent Safeguarding Panel or to statutory authorities.
- You are required to report any management conduct that breaches this framework to the Safeguarding Director and, where necessary, directly to statutory authorities.
Section 6Escalation Pathway
The standard escalation pathway for safeguarding concerns is as follows:
-
1Moderator flags concern → Human Review Queue
-
2Human Review Queue assesses concern → Escalation to Independent Safeguarding Panel where threshold met
-
3Independent Safeguarding Panel reviews → Formal escalation report generated where concern confirmed
-
4Safeguarding Panel refers → Appropriate child protection authority (Police, Social Services, CEOP, as relevant)
-
5All actions documented → Case record maintained
Section 7Data Retention and Log Preservation
- All safeguarding related records must be retained for a minimum of 10 years from the date of creation.
- Where a safeguarding matter has resulted in a referral to statutory authorities, records must be retained indefinitely or until the relevant authority confirms they are no longer required.
- Where a Critical Alert has been raised in connection with a missing or kidnapped child, all related logs, data and communications must be preserved in their original state and not modified, deleted or accessed except with the explicit agreement of the investigating police authority.
- All primary Critical Alert Logs that are subject to criminal proceedings must have two sealed duplicates copies made and each copy must be stored in individual digital archives on separate servers to ensure that the original cannot be accidentally lost due to technical faults or human error.
- Routine deletion schedules must include a safeguarding hold mechanism to prevent automatic deletion of data connected to an active or historical concern.
Section 8Whistleblowing
Any member of staff who becomes aware of conduct that breaches this framework — including conduct by colleagues, line managers, senior management or panel members — is required to report it.
Reports may be made to the Duty Safeguarding Director, the Data Protection Officer, The Independent Safeguarding Panel, the Senior Management Team, or directly to statutory authorities where the concern is serious enough to warrant it.
Section 9Breach of This Framework
Breach of any obligation set out in this framework will be treated seriously and may result in immediate suspension, disciplinary action up to and including summary dismissal, referral to relevant professional regulatory bodies, or referral to the police where the breach constitutes or contributes to a criminal offence.
The following breaches will always result in immediate suspension and referral to the police:
- Any breach that directly or indirectly causes harm to a child
- Deliberate obstruction of a safeguarding escalation
- Unauthorised access to or disclosure of children's personal data
- Deliberate destruction or modification of data connected to a safeguarding concern
- Any conduct that constitutes a criminal offence under UK, or local jurisdiction, child protection laws
- Any misuse of any personal data relating to a colleague or any adult registered as a parent/guardian on the site.
Section 10Version Control and Review
| Document Reference | VML-KIDS-SDF-006 |
| Version | 1.0 — Initial Issue |
| Date of Issue | April 2026 |
| Mandatory Review Date | April 2027 |
| Triggered Review | Immediate, on any relevant legislative or statutory guidance change |
| Owner | Teravoxus Holdings Limited — Senior Leadership |
Section 11Declaration
I confirm that I have read this document in full. I understand the obligations it places upon me. I understand that these obligations are binding, that several carry independent legal weight, and that breach of them may result in disciplinary action, termination of my engagement, regulatory referral or criminal prosecution.
I confirm that I will act at all times in accordance with this framework. I understand that I am required to re-sign this declaration on each annual review and at any point when a new version is issued.