VERTX Legal

Privacy Policy

Version 6.3. Effective 11 September 2026. Governed by the laws of England and Wales.

VERTX PRIVACY POLICY

Version: 6.3 Effective date: 11 September 2026 Governing law: England and Wales

1. Who We Are

VERTX Talent Ltd ("VERTX", "we", "us") is a UK-based managed development platform connecting companies with pre-vetted engineers.

Company No. 16902446 | Registered in England and Wales 71-75 Shelton Street, Covent Garden, London WC2H 9JQ Data protection contact: privacy@vertxtalent.io

2. What Data We Collect

Account information: name, email address, company name, job title, country of residence
Payment information: processed securely by Stripe (we never store card details)
Identity verification: passport / national ID document data is processed by Stripe Identity. VERTX receives only the pass/fail result and confidence score (see Section 6)
Bank account details: account holder, account number, IBAN, SWIFT/BIC, encrypted at rest
Talent applicants: professional experience, CV, portfolio links, GitHub repositories, vetting submissions (video, code, written assessments, workspace photo where applicable)
Vetting recordings: screen and (where applicable) video captures of proctored technical assessments and interviews, analysed for assessment and integrity
Communications: messages sent through our platform, support conversations
AI interactions: messages sent to AI features within the platform
Usage data: pages visited, features used, session recordings (for platform improvement)
Account-status flags: where applicable, a Founding Member flag and Founding-Window timestamp recorded for billing eligibility and feature gating (no inference about you beyond this status)

3. How We Use Your Data

To provide and improve our platform services
To match clients with suitable engineering talent
To process payments and send invoices
To send service-related communications (transactional emails)
To verify identity during onboarding (Stripe Identity)
To power AI features within the platform (AI assistant, vetting scoring, brief generation, code analysis)
To monitor platform performance and security
To comply with legal obligations (tax, anti-money-laundering, HMRC, IR35 evidence retention)

We process your data under:

Contractual necessity (to deliver our service under the MSA/ICA)
Legitimate interests (platform improvement, fraud prevention, security, vetting integrity)
Consent (marketing emails, you can opt out at any time)
Legal obligation (accounting records, anti-money-laundering, HMRC, IR35 compliance)

5. Automated Processing and Artificial Intelligence (Article 22)

We use artificial intelligence to support parts of our work. It helps us review and summarise assessment material, prepare questions for interviews, match engineers to client requirements, and maintain quality across activity on the platform. We do not set out the individual tools or checks we use, because how our assessment works is confidential to us.

No decision that affects you is made solely by automated means. Every outcome, including a decision not to take an application further, is made by a person who reviews the underlying work. Automated output informs that person; it does not replace them.

Because our decisions are not taken solely by automated means, the additional rights in Article 22 UK GDPR do not arise. Your general rights, including the right to object to processing we carry out on the basis of our legitimate interests, are set out in section 10.

We do not give feedback on assessment outcomes, and we do not enter into correspondence about them. This applies to everyone equally.

We use a small number of service providers who process data on our behalf, each under a written data processing agreement. They fall into the following categories:

application hosting and content delivery
database, authentication and file storage
payment processing and international payments
identity verification. Identity documents and the selfie you provide are handled by a specialist verification provider, which returns only a result and a confidence score. We do not store copies of your identity documents.
malware scanning of uploaded files. Every CV is scanned before it is stored, and an infected file is rejected and never stored.
scheduling and calendar, used to offer interview times and to hold the appointments
video calls, video hosting and transcription
artificial intelligence services used for scoring, summarising and in-platform assistance
code execution for technical assessments. Assessment code runs inside our own sandboxed environment, on infrastructure we control, and is not sent to any third-party code-execution service.
email delivery
product analytics
error monitoring, rate limiting and caching

We publish categories rather than names because our supplier arrangements are commercially confidential. If you would like to know which providers process your personal data, write to privacy@vertxtalent.io and we will give you the current list.

We do not sell your personal data, and we do not use it to train publicly available artificial intelligence models.

7. Code and Repository Data

Where you give us links to public code repositories, we read them as part of your assessment. We look at the work and its history so that we can understand it and prepare questions about it. We do not set out the individual checks we run, because how our assessment works is confidential to us.

Repository content is held only for as long as the assessment needs it. What we keep afterwards is the assessment record itself: the summary, the questions and your answers, retained in line with section 9.

8. International Data Transfers

Some of our service providers, and some of the engineers and reviewers we work with, are based outside the United Kingdom, so your data may be processed or accessed from outside the UK, including from the European Economic Area and the United States.

Where we transfer personal data to a country that the United Kingdom has not found to provide an adequate level of protection, we put an approved safeguard in place. This is normally the United Kingdom International Data Transfer Agreement, or the United Kingdom Addendum to the European Commission's standard contractual clauses, together with an assessment of the transfer.

You can ask us which safeguard applies, and for a copy of it, by writing to privacy@vertxtalent.io.

9. Data Retention

Account data: retained while your account is active, and then for six years.
Application and assessment data: where an application does not succeed, retained for six months from the decision and then deleted completely. Where an applicant joins the network, retained for the duration of the engagement and then for six years, which is the period we need for contractual, tax and legal purposes.
Assessment recordings, screen and video: for engineers who join the network, 12 months from the session. Where an application does not succeed, deleted with the rest of the record six months after the decision.
Workspace photos: deleted on application closure, or on written request, except where we need them to evidence a prior placement.
Assessment integrity records: where we need to keep a record in order to protect the integrity of our assessment process, or to establish, exercise or defend a legal claim, we keep it for up to 24 months from the decision. It is limited to what is necessary for that purpose, held separately from our ordinary records, used for nothing else, and deleted at the end of that period.
Financial records: seven years, as tax rules require.
AI conversation data: retained while the account is active, deleted on account closure.
Support conversations: two years.
Analytics data: anonymised after 12 months.

Six months reflects the period in which a decision about an application can still be questioned or challenged, which is the only reason we need the record once a decision has been made.

Where an unsuccessful application is deleted, we keep a one-way record that an application was received and closed. That record is a set of scrambled values which cannot be turned back into your CV, your address, your device or anything else about you, and exists only so that we can recognise the same application arriving again.

You have the right to:

ask for a copy of the personal data we hold about you
have inaccurate data corrected
ask us to delete your data, in the circumstances where that right applies
ask us to restrict how we use your data
receive certain data in a portable, machine-readable form
object to our use of your data where we rely on legitimate interests
withdraw consent, where our processing is based on consent

To exercise any of these, email privacy@vertxtalent.io. We will respond within one month.

The right to erasure does not apply where we are required to keep information by law, or where we need to keep it in order to establish, exercise or defend a legal claim. Where that is the case we will tell you, and we will keep no more than is necessary for that purpose.

You also have the right to complain to the Information Commissioner's Office, the United Kingdom's data protection regulator, at ico.org.uk.

11. Cookies

We set a small number of strictly necessary cookies, which keep you signed in and remember the cookie choice you have made.

With your consent we also use a product analytics provider, which is configured to use browser local storage rather than cookies, and whose instance is hosted in the European Union. Declining analytics does not affect your access to anything.

We use no advertising cookies and no third-party tracking pixels.

Every entry we set is listed by name in our Cookie Policy, which also explains how to change your choice at any time using the Cookie settings control in the footer of any page.

12. Security

We use industry-standard measures to protect your data:

TLS encryption in transit
AES encryption at rest for sensitive fields (bank details, API keys, government IDs at Stripe)
Row-level security (RLS) on all database tables
Rate limiting on authentication and API endpoints
Multi-factor authentication for admin and high-risk operations
Malware scanning of every uploaded file before it is stored
Automated dependency and vulnerability alerting, reviewed and acted on
Internal security review of the platform, repeated as it changes

13. Children

Our Platform is not intended for use by anyone under the age of 18. We do not knowingly collect data from children.

14. Changes

We may update this policy. We will notify you of significant changes by email. The version number and date at the top of this page indicate when the policy was last revised. Previous versions are archived internally for reference.

15. Contact

VERTX Talent Ltd Company No. 16902446 71-75 Shelton Street, Covent Garden, London WC2H 9JQ General: hello@vertxtalent.io Data protection: privacy@vertxtalent.io Website: https://vertxtalent.io

VERTX Privacy Policy version 6.3, effective 11 September 2026, England and Wales.