Applicant Privacy Notice

VERTX APPLICANT PRIVACY NOTICE

This notice explains what we do with your personal data when you apply to VERTX. It covers two routes:

• the contracting service, where engineers apply, go through our assessment process and, if they join, work through VERTX from outside the United Kingdom. If you go on to work through VERTX, the VERTX Engineer Terms you accept and our Privacy Policy will also apply;
• UK direct hire, where people who live in the United Kingdom create a profile and are introduced to UK companies that hire them directly. VERTX does not assess UK direct-hire candidates. Section 2.4 says what we collect on this route, and the VERTX UK Talent Terms and our Privacy Policy also apply.

Sections 2.1 to 2.3 describe the contracting service. Where a section applies to only one route, it says so.

---

1Who we are#

VERTX Talent Ltd is the data controller for the personal data described in this notice.

• Registered in England and Wales, company number 16902446
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Registered with the Information Commissioner's Office, registration number ZC111335
• Privacy contact: privacy@vertxtalent.io

---

2What we collect#

2.1When you apply

• your name, email address and the country or city you are based in;
• your date of birth, your nationality, your home address and your country of tax residence;
• how you contract with us, and your company details if you contract through one;
• your phone number;
• the role you are applying for, your experience level and years of experience;
• your skills and primary technology stack;
• links you choose to give us, such as GitHub, LinkedIn or a portfolio;
• your CV, and the information we read from it to fill in your application.

We also record how far you get through the application form itself, so that we can see where it is going wrong for people and offer help to anyone who could not finish. If you leave partway through, we keep the name and email you had already entered, together with the step you reached, for 30 days, and then delete them. We do not keep them at all if you leave on the first screen, before you accept this notice.

2.2During assessment

• your written English exercise and your answers;
• the code you write in our online assessment environment, and the results of running it;
• audio and video recordings of your interviews, together with transcripts and written summaries;
• the assessment notes and scores our reviewers produce about your work;
• technical information about the connection and device you use for the application and the assessments: your IP address, the type of connection it belongs to, and basic characteristics of your browser such as screen size, time zone and platform;
• information about how you completed the written assessment, such as typing and editing patterns, whether text was pasted in, and whether other windows or screens were in use. This is part of the assessment itself and is described to you when you take it;
• a recording of your entire screen throughout the coding assessment, which you are asked to share before it begins. Recording pauses while you are on your break and resumes when you return. This is part of the assessment itself and is described to you before you start it.

2.3If you reach the final stage (contracting service)

• the result of an identity check of your identity document and a live selfie, carried out by our independent identity verification provider, Veriff (Veriff OÜ, based in Estonia, in the European Union). We receive only the outcome: the decision, the name as printed on the document, and the document's issuing country and type. We never receive or keep images of your document or selfie, or the document number. Matching your selfie to your document uses biometric data, so we ask for your explicit consent when you start the check; if you would rather not, tell us and we will check your document with you on a video call instead;
• if you are engaged, your payment and tax details, which are covered by the agreement you sign.

2.4UK direct hire

If you create a UK direct-hire profile, we collect:

• your name, email address and a UK mobile number. Where the check is switched on, we look the number up once with our phone-number provider to confirm that it is a mobile line and not an internet or virtual number, and where SMS confirmation is switched on, we send a code to it;
• your profile: CV, experience, skills, the roles you are looking for, links you choose to give us, and a profile photo and introduction video if you add them;
• your job preferences: where and how you want to work, your notice period, and any companies or industries you choose to hide;
• the salary you are looking for, which is shown to companies, and, if you give one, your private minimum salary, which is never shown to any company and only stops us showing you jobs that pay less;
• your own answer about your right to work in the UK;
• the record of the right to work check we carry out before your profile is shown to any company. You can sign up and build your profile first: the check is in your dashboard (see section 3 and our Privacy Policy, section 4). Depending on your documents, this is a digital check of a British or Irish passport through Veriff, a provider certified by the UK government, including a live selfie matched to your passport photo, or a Home Office online check with a share code followed by a short video call. We keep the date, the method, who carried it out and the result, in the form the law requires;
• if you choose the optional identity check for the "ID verified" badge, or we ask you to verify your identity because something on your profile needs a closer look, the result of a Veriff check, as described in section 2.3.

We ask for your date of birth on the contracting service, and only for one purpose: it is what lets us rule out a false match when we screen your name against sanctions lists. Names are shared by many people, and without a date of birth a match cannot be cleared, only raised again at every check. We do not ask for your marital status, your health, or any other special category data. Please do not include information of that kind in your CV or application.

---

3Why we use IT, and our lawful basis#

What we do	Why	Lawful basis
Assess your application and run the vetting process	To decide whether we can place you with a client	Legitimate interests: we cannot operate a vetted network without assessing applicants
Record interviews, with your camera on	Assessment is remote. A recording is the only way a decision about you can be reviewed afterwards, checked for consistency between reviewers, or defended if you challenge it. It is also how we confirm that the person assessed is the person who applied.	Legitimate interests
Verify your identity	To confirm the person assessed is the person engaged, and to protect clients and other engineers	Legitimate interests, and legal obligation where financial crime rules apply
Sanctions and financial crime screening	To meet our legal obligations. We screen when you apply and again before anyone is paid, and we use your date of birth to rule out a false match on a shared name	Legal obligation
Contact you about your application	To tell you what is happening and what happens next	Legitimate interests
Record how far you got through the application form	To find and fix the parts of the form that stop people applying, and to offer help to somebody who could not finish it	Legitimate interests
Keep records of assessments	To answer questions about a decision, and to defend a complaint or claim	Legitimate interests
UK direct hire: show your profile to verified UK companies with matching roles, and match you to roles with Remi (section 4)	To introduce you to companies, which is what you signed up for	Legitimate interests
UK direct hire: confirm you live in the UK through your UK mobile, and refuse virtual numbers	To keep the UK service to people based in the UK, and to prevent fraud	Legitimate interests
UK direct hire: check your right to work before your profile is shown to any company	UK law requires an online matching service to check the right to work of the people whose details it gives to companies	Legal obligation (and legitimate interests where it may not strictly apply). Facial matching: Article 9(2)(b) UK GDPR and Schedule 1 paragraph 1 of the Data Protection Act 2018. You can choose a video call instead
UK direct hire: keep a record of the introductions we make	Employment agencies must keep these records	Legal obligation
Check for identity substitution and repeat applications	To confirm that the person we assess is the person we place, and to detect an application that has already been refused returning under a different name. We compare connection, device and assessment-behaviour signals across applications.	Legitimate interests

Recording is not optional, and we would rather say so plainly than pretend otherwise. We cannot assess someone remotely without a camera and a recording: it is how a second person can check a decision, how we keep the bar the same between reviewers, and how we know the person on the call is the person who applied. Because it is a condition of being assessed rather than a free choice, we do not ask you to consent to it. Asking for consent we could not act on if you refused would be misleading. You accept it when you create your account, and you are told again before you book.

Where we rely on legitimate interests, we have considered your rights and have concluded that assessment is what you expect when you apply, and that we do no more than is needed for it. You can object to any of it: see section 8.

---

4Automated processing and artificial intelligence#

We use automated tools, including artificial intelligence, at several points in the assessment. They help us sort applications as they arrive, check and summarise the work you produce, and prepare for your interview. We do not set out the individual tools or checks we use, because how our assessment works is confidential to us.

No decision about your application is made solely by automated means. Every outcome that affects you, including a rejection, is made by a person who reviews the underlying work. The automated outputs inform that person; they do not replace them, and a reviewer can and does disagree with them.

Matching. On both routes, Remi, our AI, grades the evidence in your profile against each criterion a company sets for a role, and our software sorts the results using fixed rules, so that a company sees its strongest matches first. Which candidates are put forward for a role is decided this way without a person looking at each case, so we give you the safeguards UK law requires: you can find out the main reasons for the result, tell us your view, ask for a person to review it and contest it. Matching does not decide whether you are interviewed, offered work or hired: the company decides that. Our Privacy Policy, section 6, explains how matching works and how to ask for a review.

We do not give feedback on assessment outcomes, and we do not enter into correspondence about them. This applies to every applicant equally.

---

5Who sees your data#

Our team. VERTX staff who run the assessment process.

Our technical reviewers. Experienced engineers, engaged as independent contractors, who conduct technical interviews and write assessments. They are under written confidentiality and data protection obligations, may use your data only for your assessment, must not keep it afterwards, and must not contact you outside the process. Before your session they see a reference code rather than your name.

Our service providers, who process data on our behalf under contract, including:

• hosting, database and application infrastructure;
• malware scanning of your CV, which happens before the file is stored;
• scheduling, so that you can choose a time for your interviews and we can hold them;
• video interview, recording and transcription;
• code execution for the technical assessment;
• artificial intelligence providers used for scoring and summarising;
• identity verification and right to work checks (Veriff, in the European Union) and sanctions screening;
• phone number checks and SMS codes;
• email delivery;
• error monitoring and product analytics.

Companies. On the contracting service, if you pass vetting and we propose you for an engagement, we share a professional profile with the company. We never share your CV contact details, your identity documents, or your assessment recordings with a company.

On UK direct hire, no company sees your profile until your right to work check is passed. Once it is, we share your profile with verified UK companies whose roles or searches you match: your name, photo, profile, introduction video, the salary you are looking for, your job preferences except the private ones, and whether you have the "ID verified" badge and the "Right to work checked by VERTX" indicator. Companies never see your private minimum salary, the companies or industries you have hidden, your documents, your nationality or your immigration category. We never show your profile to your current employer unless you have told us we may. A company that receives your profile is responsible, as a separate controller, for how it uses it.

We do not sell your personal data, and we do not use it to train publicly available artificial intelligence models.

---

6Transfers outside the united kingdom#

We work with engineers and reviewers in a number of countries, so your data may be accessed from outside the United Kingdom, including from the United Arab Emirates, Pakistan, Ukraine and the European Economic Area, and from the United States where a service provider is based there.

Where we transfer personal data to a country that the United Kingdom has not found to provide an adequate level of protection, we put in place an approved safeguard, which is normally the United Kingdom International Data Transfer Agreement, or the United Kingdom Addendum to the European Commission's standard contractual clauses, together with an assessment of the transfer.

You can ask us for a copy of the safeguard we use by writing to privacy@vertxtalent.io.

---

7How long we keep IT#

• If you start an application and do not finish it: we keep the name and email you entered, and the step you reached, for 30 days, and then delete them. Nothing identifying you is kept if you leave on the first screen.
• If your application does not succeed: we keep your application and assessment records for six months from the decision, and then delete them completely. This includes your CV, your assessment answers and any recording of your interviews or your screen. Six months reflects the period in which a decision about your application can still be questioned or challenged, which is the only reason we need the record once it has been made. You may ask us to delete sooner.
• After that, we hold nothing about you beyond a one-way record that an application was received and closed. That record is a set of scrambled values, which cannot be turned back into your CV, your address, your device or anything else about you, and which exists only so that we can recognise the same application arriving again. It includes scrambled forms of the connection and device information in section 2.2, together with the type of connection you used.
• If you join the network: we keep your records for the duration of your engagement and then for six years, which is the period we need for contractual, tax and legal purposes.
• Interview and assessment recordings (video and screen): if you join the network, we keep these for 12 months from the session. If your application does not succeed they are deleted with the rest of your record, six months after the decision.
• Identity and screening records: we keep these for as long as financial crime rules require.
• UK direct hire: your profile is kept while your account is open. When you delete it, it is removed from every company's view straight away and deleted, except two records the law requires us to keep: the record of the introductions we made (kept for one year from the last time we provided a service to you), and the record of your right to work check (kept for two years after your profile stops being available to companies).
• Assessment integrity records: where we need to keep a record in order to protect the integrity of our assessment process, or to establish, exercise or defend a legal claim, we keep it for up to 24 months from the decision instead of deleting it at six months. It is limited to what is necessary for that purpose, is held separately from our ordinary records, is accessible only to the company owner, is used for nothing else, and is deleted at the end of that period.

---

8Your rights#

You have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete your data, in the circumstances where that right applies;
• ask us to restrict how we use your data;
• receive certain data in a portable, machine-readable form;
• object to our use of your data where we rely on legitimate interests, including the recording of interviews and assessments and the identity-substitution checks described above.

To exercise any of these, write to privacy@vertxtalent.io. We will respond within one month.

If you object to being recorded, tell us before you book and we will explain what it means. We cannot assess you without it, so in practice it means we cannot take your application further. That is a limitation of a remote process, not a penalty, and we would rather you knew before spending your time than after. Nothing is held against you and you are welcome to apply again in future.

---

9If you are unhappy#

Please tell us first at privacy@vertxtalent.io so we can put it right. We acknowledge every complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office, the United Kingdom's data protection regulator, at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

---

10Changes#

If we change this notice we will publish the new version here and update the version and date at the top. If a change materially affects you, we will tell you directly.

---

VERTX Talent Ltd, vertxtalent.io Applicant Privacy Notice, version 2.2, 12 October 2026.