Legal Privacy Policy

Privacy Policy

Version: 6.10
Effective: 13 October 2026
Governing law: England and Wales

On this page · 18 sections+

1Who We Are

VERTX Talent Ltd ("VERTX", "we", "us") is a UK company that runs two services on one platform:

Contracting service. Companies engage engineers through VERTX. The engineers are assessed by us, contract with us and work from outside the United Kingdom.
UK direct hire. Companies hire people who live in the United Kingdom directly, as their own employees or contractors. We introduce candidates to companies and the company employs or engages them, so for this service we act as an employment agency. We do not assess UK direct-hire candidates.

VERTX is the controller of the personal data described in this policy. When a company receives a candidate's profile from us, that company also becomes a controller of what it receives, and is responsible for how it uses it (see section 7).

Company No. 16902446 | Registered in England and Wales 71-75 Shelton Street, Covent Garden, London WC2H 9JQ Registered with the Information Commissioner's Office, registration number ZC111335 Data protection contact: privacy@vertxtalent.io

Engineers applying to the contracting service, and people creating a UK direct-hire profile, are also given our Applicant Privacy Notice, which describes the application stage in more detail.

2What Data We Collect

Everyone who uses the platform

Account information: name, email address, company name, job title, country of residence
Communications: messages sent through our platform, support conversations, reports you make about content on the platform, and the emails we send you
AI interactions: messages sent to Remi, our AI, and to other AI features within the platform
Safety checks: where our automated checks flag a message or profile text, a record of what was flagged, why, and what our team decided (section 6)
Interviews: when and how an interview is arranged. On the contracting service, an interview held on VERTX video is recorded only if both the company and the engineer agree on the join screen. UK direct-hire interviews take place in the company's own meeting tools, and VERTX does not record them
Usage data, with your consent: pages visited, features used, and masked recordings of a small share of visits (all text and media hidden), used to fix errors and improve the platform

Companies and the people who act for them

Company verification: the details needed to confirm the business and the authority of the person acting for it. Depending on the route, this includes Companies House records, a check of a record placed on the company's web domain, an identity check of a director through our identity verification provider matched against the company's registered officers, or a signed letter of authority
Payment information: card and Direct Debit details are collected and processed by our payment providers. We never receive or store a full card number or security code; we keep only a reference to the payment method, its type and the details needed to identify it to you (such as the last four digits), together with a record of each payment and refund. For Direct Debit, we also receive the name on the paying bank account, which we compare with the company's legal name before a first engagement starts
Billing contacts: the billing profiles a company sets up, including the names and email addresses of the people who should receive invoices and any purchase order number
Failed and reversed payments: a record of any payment that fails or is reversed (for example a chargeback), the amount that remains owed, and when it is settled
Roles and hiring: the roles a company creates, the criteria it sets, its conversations with Remi about each role, interview scorecards, and the decisions it records about candidates
What Remi remembers: facts a company asks Remi to keep about how it hires, which the company can read, edit and delete on its Remi memory page. If you ask Remi to forget something, or delete a line on the Remi memory page, Remi stops using it straight away and it is permanently deleted from our systems within 30 days. A line saved for one search is used only for that search
Remi corrections: where a company tells Remi that something about a candidate's match is wrong (for example that a candidate does or does not meet one of its criteria), we keep what was said, the grade before and after, who said it and when. This is information about the candidate as well as the company

Engineers on the contracting service

Applications and assessment: professional experience, CV, portfolio links, GitHub repositories, vetting submissions (video, code, written assessments, workspace photo where applicable), as set out in the Applicant Privacy Notice
Vetting recordings: screen and (where applicable) video captures of proctored technical assessments and interviews, analysed for assessment and integrity
Identity verification: the result of an identity check described in section 5
Bank account details: account holder, account number, IBAN, SWIFT/BIC, encrypted at rest

UK direct-hire candidates

Profile: CV, experience, skills, the roles you are looking for, a profile photo and introduction video if you add them, and links you choose to give us
Job preferences: where and how you want to work (location, commute, relocation, office days, permanent or contract), your notice period, and companies or industries you choose to hide
Salary: the salary you are looking for, which is shown to companies, and, separately, your private minimum salary, which is never shown to any company and is used only to stop showing you jobs that pay less
UK mobile number: the UK mobile you give us. Where the check is switched on, we look the number up once with our phone-number provider to confirm it is a mobile line and not an internet or virtual number, and we keep the result. Where SMS confirmation is switched on, we send a code to the number
Right to work: your own answer about your right to work in the UK, and the record of the right to work check described in section 4
Identity: if we ask you to verify your identity because something on your profile needs a closer look, the result of that check (section 5)

3How We Use Your Data, and Our Lawful Basis

What we do	Lawful basis (UK GDPR Article 6)
Provide the platform and your account	Contract
Assess applicants to the contracting service	Legitimate interests (see the Applicant Privacy Notice)
Match engineers and UK candidates to companies' roles, including with Remi (section 6)	Legitimate interests, and contract where you have asked us to find you work or candidates
Show a UK candidate's profile, salary expectation and right to work indicator to companies with matching roles	Legitimate interests: introducing candidates to companies is the service the candidate signed up for
Decide, with Remi, which candidates are put forward to a company for a role (section 6)	Legitimate interests, with the safeguards in section 6
Confirm that a UK candidate lives in the UK through their UK mobile, and refuse virtual numbers	Legitimate interests: keeping the UK service to people based in the UK, and preventing fraud
Carry out right to work checks before a UK profile is shown to any company (section 4)	Legal obligation; legitimate interests where the obligation may not strictly apply
Verify identity (section 5) and verify a company and the authority of the person acting for it	Legitimate interests (fraud prevention, protecting companies and candidates); legal obligation where financial crime rules apply
Keep the records an employment agency must keep about introductions, and produce them to the Fair Work Agency on request	Legal obligation
Take payments, make payouts, issue invoices, pursue amounts owed and handle reversed payments	Contract; legitimate interests in recovering what is owed
Keep accounting and tax records	Legal obligation
Screen against sanctions lists, and meet anti-money-laundering, HMRC and IR35 record duties	Legal obligation
Keep and read Remi conversations, company memory and Remi corrections to run, check and improve the service	Legitimate interests
Check private messages and profile text automatically for threats, abuse and attempts to move contact or payment off the platform, and review what is flagged (section 6)	Legitimate interests: keeping people on the platform safe and enforcing our terms
Record and act on a failed right to work check, or a finding of fraud or identity misuse	Legal obligation; legitimate interests in preventing fraud (see "Information about offences" below)
Send service emails and in-app messages about your account, applications, matches and the service (section 9)	Contract; legitimate interests
Monitor platform performance and security	Legitimate interests
Usage analytics and masked session replay	Consent (you can withdraw it at any time, see section 14)

Where we rely on legitimate interests, we have weighed them against your interests and rights. You can object at any time (section 13).

Information about offences. Some of what we record can be information about a possible criminal offence (Article 10 UK GDPR): for example, that a right to work check showed a person does not have the right to do the work they applied for, that a document appears to be false, or that someone has tried to use another person's identity or to have someone else sit an assessment for them. We record such a finding only where we need it, keep it to the facts and the reasons, and limit it to authorised staff. For right to work checks we rely on paragraph 1 of Schedule 1 to the Data Protection Act 2018 (obligations in connection with employment). For fraud and identity misuse we rely on paragraph 10 of that Schedule (preventing or detecting unlawful acts). Both are covered by our appropriate policy document. We share such a finding only with the Home Office, the police or another authority where the law requires or allows it.

4Right to Work Checks (UK Direct Hire)

UK law requires an online matching service to check the right to work in the UK of the people whose details it gives to companies. We therefore check every UK direct-hire candidate's right to work before their profile is shown to any company, in the same way for everyone, whatever their nationality. You can sign up and build your profile first; the check is in your dashboard, and until it is passed no company can see your profile in any form.

How we check. One of the methods UK law prescribes:

for a British or Irish passport or Irish passport card, a digital check through Veriff, a provider certified by the UK government to carry out right to work checks. You scan the document and take a live selfie, and the provider matches your face to the photo in the document;
for anyone with an eVisa or other UK immigration status, a Home Office online check using a share code you give us, followed by a short video call in which a member of our team compares you with the photo on the Home Office record;
in other cases, a check of your original documents with you on a video call, or a check with the Home Office Employer Checking Service.

What we keep. The date of the check, the method, who carried it out, and the result: either the Home Office record of your right to work (which includes your photo, the type of permission, any end date and any work conditions) or the output of the digital check, including the images used to match your face to your document. We store this record ourselves, in private, access-controlled storage in the United Kingdom, in a form that cannot be changed. If your permission ends on a date, we keep that date and ask you for a follow-up check before it. We do not keep your share code once the check is complete.

Lawful basis. Legal obligation (Article 6(1)(c)): section 15 of the Immigration, Asylum and Nationality Act 2006 as extended by section 48 of the Border Security, Asylum and Immigration Act 2025, and the Immigration (Restrictions on Employment) Order 2007. Where that obligation may not strictly apply to us, we rely on our legitimate interest in running a lawful hiring service (Article 6(1)(f)). Facial matching uses biometric data, which is special category data. We process it under Article 9(2)(b) UK GDPR and paragraph 1 of Schedule 1 to the Data Protection Act 2018 (obligations in connection with employment), and we keep an appropriate policy document, as that Act requires. Before a digital check starts, we also ask you to confirm that you agree to the face match. If the legal obligation were found not to apply to us, we would rely on that explicit consent (Article 9(2)(a)) instead, and we would update this policy first. If you would rather not have your face matched digitally, you can choose a video call with our team instead.

Results we act on. Your profile stays hidden from companies until a check is passed. A failed, flagged or unclear result is always reviewed by a member of our team before we decide that a check cannot be passed, and we tell you what happens next.

Who sees it. Authorised VERTX staff, the provider that carries out the digital check on our behalf, and the Home Office where the law requires. Companies see only that the check has been completed and its date, through a "Right to work checked by VERTX" indicator. They never see your documents, your nationality or your immigration category.

What it does not do. Our check is made for our own legal compliance as a matching service. A company that hires you must still carry out its own right to work check before you start.

How long. See section 12.

5Identity Checks and Biometric Data

We use an independent identity verification provider, Veriff (Veriff OÜ, based in Estonia, in the European Union), at these points:

engineers on the contracting service, at the final stage of assessment;
a director of a company, where that is the route used to verify the company;
UK direct-hire candidates whom we ask to verify their identity because something on a profile needs a closer look. There is no optional identity check or identity badge for UK candidates: the right to work check in section 4 is the check every UK candidate completes.

You scan your identity document and take a live selfie, and Veriff checks that the document is genuine and that the selfie matches it. For these identity checks, VERTX receives only the result of the check, the name as it appears on the document, and the document's issuing country and type. We do not receive or keep images of your document or selfie, or the document number. (The right to work check in section 4 is different: there the law requires us to keep the record described in that section.)

Matching a selfie to a document uses biometric data, which is special category data. For these identity checks we rely on your explicit consent (Article 9(2)(a) UK GDPR), which we ask for when you start the check. If you would rather not have your face matched digitally, tell us and we will arrange a video call in which a member of our team checks your document with you instead. You can withdraw consent at any time, which does not affect a check already completed.

6Automated Processing and Artificial Intelligence (Article 22)

We use artificial intelligence to support parts of our work. It helps us review and summarise assessment material, prepare questions for interviews, match people to companies' roles, and maintain quality across activity on the platform. We do not set out the individual tools or checks we use in our assessment, because how our assessment works is confidential to us.

How Remi matches people to roles. A company describes a role and sets its criteria, each marked as a must-have, a strong preference or a nice-to-have. Remi, our AI, reads each person's profile, CV and, for engineers on the contracting service, their assessment record, and grades the evidence against each criterion: met, partly met, evidence against, or not evidenced. Our software, not the AI, then sorts the results using fixed rules. A person is a strong match when every must-have is met and most strong preferences are met; a near match is shown with what is missing; and where the evidence is against a must-have, the person is not shown for that role. Nice-to-haves never decide whether someone is shown. Matching only ever uses criteria about the work. Criteria based on protected characteristics, such as age, sex, race, religion or disability, are refused. Saved searches are matched again when new people join.

Which decisions are made solely by automated means. On both services, Remi and our software decide, without a person looking at each case, which people are put forward to a company for a role. We treat that as a decision based solely on automated processing that can significantly affect you, because it decides whether you are considered for that role. It is the only decision of that kind we make, and the safeguards below apply to it on both services.

No other decision about you is made solely by automated means:

Assessment on the contracting service. Every outcome, including a decision not to take an application further, is made by a person who reviews the underlying work. Automated output informs that person; it does not replace them.
Interviews, offers and hiring. Matching does not decide whether anyone is interviewed, offered work or hired. The company makes those decisions, after looking at the profile and talking to the person.
Checks and safety. A result from an identity or right to work check that involves biometric data never stops you being put forward without a member of our team reviewing it first, and our automated safety checks never restrict or close an account on their own (see below).

A company can tell Remi that a grade is wrong, and the grade is changed and recorded. Not being put forward for one role has no effect on any other role, and your profile stays available for other matches. Our How Remi works page (vertxtalent.io/legal/how-remi-works) explains matching in more detail.

Your safeguards (Article 22C UK GDPR). You can:

find out whether you were put forward for a role, and the main reasons for the result: which of the company's criteria the evidence met, partly met or did not meet;
tell us your view, and add evidence to your profile;
ask for a person on our team to review the result. They can change the grades and put you forward;
contest the result.

Write to privacy@vertxtalent.io, or ask through Support in your dashboard. We record every request and its outcome.

Matching never uses special category data, such as health, ethnicity or religion, and we never infer it. If our use of automated decision-making changes, we will tell you first.

Automated safety checks on messages and profiles. Private messages sent on the platform, and the text of profiles sent for publication, are checked automatically, by fixed rules and by an AI classifier, for threats, abuse, harassment, hate, sexual content, the sharing of sensitive personal data, breaches of confidentiality, and attempts to move contact or payment off the platform. What happens next depends on what is found:

a message that appears to contain threats or serious abuse is not sent, and the sender is told why, so that they can rephrase it;
contact details in a message (such as an email address, phone number or link) are hidden until an engagement through VERTX has started;
on the contracting service, a message in which an engineer discusses pay with a company is not sent, because pay is agreed with VERTX;
anything else that is flagged is delivered as normal, and a record of what was flagged is kept for our team to review.

No account is restricted or closed because of an automated check alone: a member of our team looks at the record first. If you think a check stopped or changed a message of yours by mistake, or you want to challenge a restriction or removal of your content or account, you can appeal as set out on our Report content page (vertxtalent.io/legal/report-content), and a person will review it.

We do not give feedback on assessment outcomes, and we do not enter into correspondence about them. This applies to everyone equally.

Companies you are matched with. We share profiles only with companies that we have verified and that have a matching role or search.

Contracting service: a professional profile of an engineer we propose. We never share an engineer's CV contact details, identity documents, assessment recordings or what VERTX pays them.
UK direct hire: nothing until your right to work check is passed (section 4). After it, your profile (name, photo, headline, experience, skills, work history and links), your introduction video if you add one, your job preferences except the private ones, the salary you are looking for, and the "Right to work checked by VERTX" indicator with the date of the check. Companies never see your private minimum salary, the companies or industries you have hidden, your documents, your nationality or your immigration category. We never show your profile to your current employer unless you have told us we may.

A company that receives a profile is a separate controller of what it receives. It may use it only to consider you for its roles, must not share it onward or keep it longer than it needs it, and must delete it when it no longer needs it.

Our team and technical reviewers. VERTX staff and the people who work for us under our direction, and the independent technical reviewers who assess contracting-service applicants, all under written confidentiality and data protection obligations. Some of our team members work outside the United Kingdom (section 11).

Service providers. Providers that process data on our behalf under a written data processing agreement (section 8).

Authorities. HMRC, the Home Office, the Fair Work Agency, the Information Commissioner's Office, the police or a court, where the law requires us to share information or allows us to do so to prevent fraud or crime.

We do not sell your personal data, and we do not use it to train publicly available artificial intelligence models.

8Service Providers

We use a small number of service providers who process data on our behalf, each under a written data processing agreement. They fall into the following categories:

application hosting and content delivery
database, authentication and file storage (hosted in London)
payment processing: taking card and Direct Debit payments from companies, and making international payouts to engineers
identity verification and right to work checks
phone number checks and SMS codes
malware scanning of uploaded files. An uploaded file found to be infected is rejected and never stored, and a file that could not be checked is held unopened until it has been checked
scheduling and calendar, used to offer interview times and to hold the appointments
video calls, video hosting and recording
artificial intelligence services used for matching, scoring, summarising and in-platform assistance
code execution for technical assessments. Assessment code runs in an isolated sandbox with no network access, operated by us or by a specialist provider under a written agreement. It is used only to run and grade the assessment
email delivery
business email, documents and calendars for our own team
product analytics
error monitoring, rate limiting and caching
bot protection on our forms

The providers in each category, what they do, where they process data and the safeguard for any transfer are listed on our Service providers page, at vertxtalent.io/legal/subprocessors. Payment providers are listed by category only; write to privacy@vertxtalent.io if you would like their names.

9Emails We Send

Service messages. We email you about your account, your application, your matches and introductions, your roles and plan, payments and invoices, and changes to the service or to our terms. That includes occasional updates telling you what is happening at VERTX and what it means for you, such as companies starting to hire on the platform. These are part of the service you signed up for. If you would rather not receive general updates, reply to the email or write to privacy@vertxtalent.io and we will stop them. Messages we must send, such as security alerts and notices about your account, will continue while you have an account.

Companies can choose which notification emails they receive in their notification settings.

Marketing. We do not send marketing emails. If we ever do, we will ask first where the law requires it, and every message will let you opt out.

10Code and Repository Data

Where you give us links to public code repositories, we read them as part of your assessment. We look at the work and its history so that we can understand it and prepare questions about it. We do not set out the individual checks we run, because how our assessment works is confidential to us.

Repository content is held only for as long as the assessment needs it. What we keep afterwards is the assessment record itself: the summary, the questions and your answers, retained in line with section 12.

11International Data Transfers

Our database is hosted in London and our application runs in London. Some of our service providers, and some of the engineers and reviewers we work with, are based outside the United Kingdom, so your data may be processed or accessed from outside the UK, including from the European Economic Area, the United States and Pakistan. Until we delete it, a read-only backup copy of our database is also held by our database provider in Australia.

Where we transfer personal data to a country covered by United Kingdom adequacy regulations, we rely on those regulations. Otherwise we put an approved safeguard in place, so that the protection your data receives is not materially lower than in the United Kingdom. This is the United Kingdom International Data Transfer Agreement, the United Kingdom Addendum to the European Commission's standard contractual clauses, or, for a United States provider certified under it, the UK Extension to the EU-US Data Privacy Framework, together with an assessment of the transfer where one is needed. The safeguard for each provider is shown on our Service providers page.

Our team members outside the United Kingdom. Some of the people who work for us, as staff or under our direction, do so from outside the United Kingdom. They may access personal data from there to run the service, for example to review right to work checks, support requests and safety reports. They use our own systems, with access limited to what their role needs, under a written agreement that binds them to confidentiality and to our data protection instructions. Where a country does not have UK adequacy regulations, that agreement includes the United Kingdom International Data Transfer Agreement, or equivalent contractual safeguards, together with an assessment of the transfer.

You can ask us which safeguard applies, and for a copy of it, by writing to privacy@vertxtalent.io.

12Data Retention

Account data: retained while your account is active, and then for six years.
Application and assessment data: where an application does not succeed, retained for six months from the decision and then deleted completely. Where an applicant joins the network, retained for the duration of the engagement and then for six years, which is the period we need for contractual, tax and legal purposes.
Assessment recordings, screen and video: for engineers who join the network, 12 months from the session. Where an application does not succeed, deleted with the rest of the record six months after the decision.
Workspace photos: deleted within 30 days of the application closing, or sooner on written request, except where we need them to evidence a prior placement.
Assessment integrity records: where we need to keep a record in order to protect the integrity of our assessment process, or to establish, exercise or defend a legal claim, we keep it for up to 24 months from the decision. It is limited to what is necessary for that purpose, held separately from our ordinary records, used for nothing else, and deleted at the end of that period.
UK direct-hire profiles: kept while your account is open. When you delete your profile, it is removed from every company's view straight away and your profile data is deleted, except the records below that the law requires us to keep.
Introduction records (UK direct hire): the record of which candidates we introduced to which companies, for which roles, when, and what was shared, kept for one year from the last time we provided a service to the candidate or the company, as the Conduct of Employment Agencies and Employment Businesses Regulations 2003 require.
Right to work check records: kept while your profile is available to companies and for two years after it stops being available (for example, because you close your account), as the right to work rules require. Then they are securely deleted.
Identity check results: the result of a contracting-service identity check is kept with the rest of the application or engagement record, and for as long as financial crime rules require. The result of an identity check we ask a UK candidate to complete is kept while the profile exists.
Remi corrections: kept while the role they relate to is open, and deleted six months after it closes.
What Remi remembers (company memory): kept until the company deletes it (a deleted line is permanently removed within 30 days), and deleted when the company's account closes.
Financial records, including invoices, billing contacts, payment records and records of amounts owed: seven years, as tax rules require.
AI conversation data: retained while the account is active, deleted on account closure.
Support conversations: two years.
Analytics data: anonymised after 12 months.

Six months reflects the period in which a decision about an application can still be questioned or challenged, which is the only reason we need the record once a decision has been made.

Where an unsuccessful application is deleted, we keep a one-way record that an application was received and closed. That record is a set of scrambled values which cannot be turned back into your CV, your address, your device or anything else about you, and exists only so that we can recognise the same application arriving again.

You have the right to:

ask for a copy of the personal data we hold about you, including what companies have said about you through Remi corrections
have inaccurate data corrected
ask us to delete your data, in the circumstances where that right applies
ask us to restrict how we use your data
receive certain data in a portable, machine-readable form
object to our use of your data where we rely on legitimate interests, including matching
withdraw consent, where our processing is based on consent
be told the main reasons you were or were not put forward for a role, ask for a person to review it, give your view and contest it (section 6)

To exercise any of these, email privacy@vertxtalent.io. We will respond within one month.

The right to erasure does not apply where we are required to keep information by law, or where we need to keep it in order to establish, exercise or defend a legal claim. Where that is the case we will tell you, and we will keep no more than is necessary for that purpose.

Complaints. If you are unhappy with how we have used your personal data, please tell us first, by email to privacy@vertxtalent.io or through Support in your dashboard. We acknowledge every complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office, the United Kingdom's data protection regulator, at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

14Cookies

We set a small number of strictly necessary cookies and browser storage entries. They keep you signed in, remember the cookie choice and display preferences you have made, and keep what you have typed into a form until you send it.

With your consent we also use a product analytics provider, which is configured to use browser local storage rather than cookies and whose instance is hosted in the European Union, and a masked session replay of a small share of visits, used only to fix errors. Declining analytics turns both off and does not affect your access to anything.

When you play a video on the platform, the player from our video provider sets a cookie that counts views and measures playback quality. The Cookie Policy describes it.

We use no advertising cookies and no third-party tracking pixels.

Every entry we set is listed in our Cookie Policy, by name or by the prefix it carries. The Cookie Policy also explains how to change your choice at any time using the Cookie settings control in the footer of any page.

15Security

We use industry-standard measures to protect your data:

TLS encryption in transit
AES encryption at rest for sensitive fields (bank details, API keys). Identity documents checked for an identity check are held only by our identity verification provider, never on our systems. Right to work check records are kept in private, access-controlled storage in the United Kingdom
Row-level security (RLS) on all database tables
Rate limiting on authentication and API endpoints
Multi-factor authentication for admin and high-risk operations
Malware checks on uploaded files, as described in section 8
Automated dependency and vulnerability alerting, reviewed and acted on
Internal security review of the platform, repeated as it changes

16Children

Our Platform is not intended for use by anyone under the age of 18. We do not knowingly collect data from children.

17Changes

We may update this policy. We will notify you of significant changes by email or in your dashboard. The version number and date at the top of this page indicate when the policy was last revised. Previous versions are archived internally for reference.

18Contact

VERTX Talent Ltd Company No. 16902446 71-75 Shelton Street, Covent Garden, London WC2H 9JQ General: hello@vertxtalent.io Data protection: privacy@vertxtalent.io Website: https://vertxtalent.io

VERTX Privacy Policy version 6.10, effective 13 October 2026, England and Wales.

Questions about this document? Write to privacy@vertxtalent.io.