Data Privacy

Last updated: 11th September 2026

Vertage Group is committed to protecting your privacy and handling personal data fairly, transparently and securely.

This notice explains how we collect, obtain, use, share, retain and otherwise process personal data in connection with our recruitment, staffing, workforce management, consulting, technology platform and related services.

It applies where you are:

• a candidate, prospective candidate or other work-seeker;
• a temporary worker, agency worker, contractor, consultant, independent professional or other person seeking or undertaking an assignment;
• an individual supplied by, or representing, a recruitment supplier or other workforce provider;
• a client, prospective client or client representative;
• a supplier, service provider or business partner;
• a referee, emergency contact, dependent, beneficiary or representative;
• a user of our websites, applications, portals or digital platforms;
• a recipient of our marketing, event or business communications; or
• another individual whose personal data we process in connection with our services or business operations.

This notice should be read with any country-specific supplement, candidate notice, worker or employee notice, platform notice, cookie notice, collection statement or other privacy information provided when we collect personal data.

The Vertage company responsible for your personal data depends on the brand, website or platform with which you interact, your location, the service provided, the company that recruits, employs, engages or places you, and the company that contracts with the relevant client or supplier.

Website controller

For the operation of this website, the controller is:

Vertage. Registered address: First Floor, Mulberry House, 750 Capability Green, Luton, Bedfordshire, LU1 3LU, England.

Other group companies and controller roles

Another Vertage group company may act as an independent controller or, where the purposes and means of processing are determined together, as a joint controller. In other arrangements, including certain recruitment process outsourcing or managed service arrangements, a Vertage company may process personal data on a client’s instructions as a processor.

Where required, we will make information about the essential features of any joint-controller arrangement available to you.

Questions about this notice or the way we use personal data may be sent to:

dpo@vertage.com.

Where appropriate, you may also contact the relevant local group company using the details shown on our group companies page.

The personal data we collect depends on your relationship with us, the services you use, the role or assignment involved, applicable law and relevant client requirements.

4.1 Candidates

We only collect personal data that is necessary to provide recruitment, work-finding and related workforce services to candidates, prospective candidates and work-seekers. This may include information needed to assess your suitability, match you with relevant opportunities, progress applications, introduce you to clients and, where applicable, establish and administer any resulting employment, assignment, consultancy, contractor or other working relationship. If you do not provide information that is necessary for these purposes, we may be unable to consider you for roles, progress your application or continue providing recruitment or work-finding services to you

Personal data you give us directly

This may include:

• your name, address and contact details;
• your CV or résumé, employment history, qualifications, education and training;
• information about your skills, experience, certifications, licences and professional memberships;
• your current and expected salary, pay rate, benefits, notice period, availability and working preferences;
• information you provide in applications, cover letters, forms, questionnaires, assessments or during registration;
• notes or records from interviews, meetings, telephone calls, video calls or other communications with us, including transcripts or recordings where these are used;
• bank account, tax, payroll or payment information where needed for an assignment, engagement or placement; and
• any other information you choose to provide, such as a photograph, date of birth, nationality, emergency contact or next-of-kin details.

Sensitive or special category information

Where lawful, relevant and appropriate, we may also collect and use more sensitive information, such as:

• health, disability or medical information where needed to consider workplace adjustments, support requirements or fitness for a particular role;
• equality, diversity and inclusion information, such as ethnicity, gender, sexual orientation, religion or other diversity data, where permitted by law and usually on a voluntary basis;
• vaccination, health screening or occupational health information where required for specific roles, client sites or legal obligations; and
• criminal record, background check or vetting information where this is lawful, proportionate and relevant to the role or assignment.

Personal data we receive from other sources

We may also obtain information about you from third parties or publicly available sources, including:

• referees, former employers, educational institutions or professional bodies;
• screening, identity verification, right-to-work, qualification-checking or background-check providers;
• clients or prospective clients who provide interview feedback, role-specific feedback or assignment-related information;
• publicly available professional sources, such as LinkedIn, job boards, professional directories or online profiles;
• other recruitment agencies, managed service providers, recruitment process outsourcing providers, umbrella companies or workforce suppliers; and
• other Vertage group companies where this is relevant to recruitment, work-finding, assignment management or related services.

Personal data collected when you use our websites, platforms or systems

• When you interact with our websites, apps, portals, online recruitment systems or marketing communications, we may collect technical and usage information, such as:
• IP address, device identifiers and approximate location information;
• browser type, operating system, device details and network information;
• dates, times and records of your access to our websites, platforms or online services;
• cookie, tracking and consent information, where applicable;
• records of pages viewed, jobs searched for or viewed, applications started or submitted, links selected and interactions with our online services; and
• engagement information from emails or marketing communications, such as whether a message was delivered, opened or selected.

General note

The categories above are intended to describe the types of personal data we may process and are not exhaustive. The information we collect will depend on your relationship with us, the services you use, the role or assignment involved, applicable legal requirements, client requirements and the choices you make when interacting with us.

4.2 Workers, contractors, consultants and independent professionals

• employment, engagement, assignment and contract documentation;
• payroll, tax, pension, bank-account, payment and benefit information;
• timesheets, attendance, expenses, leave, availability and location information;
• performance, conduct, grievance, complaint and disciplinary information;
• health and safety, accident, incident and insurance information;
• equipment, access, account and security records;
• training, accreditation and compliance records;
• company, registration, tax and insurance information for independent professionals; and
• emergency contact, dependant and beneficiary information.

4.3 Client and prospective-client contacts

• name, and professional contact details;
• recruitment, resourcing and workforce requirements;
• purchasing, contracting, billing and account information;
• enquiries, meetings, communications, service history and feedback;
• marketing preferences, event participation and content interests;
• publicly available professional information; and
• website, email and campaign engagement information.

4.4 Suppliers, workforce providers and business partners

• business contact, role and organisation details;
• contracting, invoicing, payment and bank information;
• due diligence, tax, insurance and compliance information;
• details of supplied professionals and authorised users;
• service, meeting, communication and complaint records; and
• building, platform, account and system-access information.

4.5 Website, application and platform users

• IP address and approximate location derived from it;
• device, browser, operating-system and network information;
• pages viewed, links selected, searches, referring website, dates, times and visit duration;
• cookie, consent, advertising and device identifiers;
• form submissions, account registration and profile information;
• login, authentication, chat and support interactions; and
• security, diagnostic, event and audit records.

Further information about cookies and similar technologies is available in our Cookie Notice | Vertage.

4.6 Referees, emergency contacts and other individuals

Where another person gives us your details, we may collect your name, contact details, relationship with that person, reference or emergency information, and other information reasonably necessary for the stated purpose. The person providing your details should tell you that they have done so.

We may obtain personal data:

• directly from you;
• when you use our websites, applications, portals or platforms;
• from candidates, workers, referees, emergency contacts or representatives;
• from clients, prospective clients, suppliers and workforce providers;
• from job boards, professional networks, CV databases and recruitment sources;
• from publicly available sources and professional profiles;
• from former employers, educational establishments, referees and professional bodies;
• from screening, identity, right-to-work, assessment and verification providers;
• from government, tax, immigration, law-enforcement or regulatory authorities;
• from other Vertage companies;
• through business development and marketing platforms, including HubSpot;
• through recruitment and workforce platforms, including Striive; and
• from technology systems that generate usage, security, matching, workflow or audit information.

Where required by law, we will provide relevant privacy information after obtaining your personal data from another source, unless an exemption applies.

The table below describes our principal purposes and the legal bases typically relied upon under UK and EEA data- protection law. Other lawful bases or local-law provisions may apply in other countries.

Where we rely on legitimate interests, these may include delivering and developing recruitment and workforce services, identifying suitable professionals, responding to client needs, maintaining business relationships, protecting systems, preventing fraud, improving services, managing the group and exercising or defending legal rights. We balance these interests against the rights, interests and reasonable expectations of affected individuals.

If information is required by law or contract, or is necessary to enter into a contract, we will explain the consequences of not providing it where these are not already apparent.

Depending on the jurisdiction, sensitive information may include racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, health or disability information, sexual orientation, genetic or biometric information, criminal allegations or convictions, government identifiers and financial-account information.

We process such information only where an additional legal condition applies, for example where processing is necessary for employment and social-protection law, substantial public interest, occupational health, legal claims, or another condition permitted by law. We use explicit consent only where it is appropriate, freely given and genuinely withdrawable.

Criminal-record and background-screening information is processed only where lawful, relevant and proportionate to the role, assignment, client requirement or regulatory obligation.

We use technology to help deliver recruitment, workforce and platform services. Depending on the service, technology may assist with searching candidate records, identifying potentially relevant experience, matching role criteria to profiles, organising applications, detecting duplicates, creating summaries, scheduling communications, identifying incomplete information, detecting fraud or security risks, transcribing approved interactions, cross-checking information and analysing service performance.

Where we use AI or automated tools, we apply proportionate governance, due diligence, access controls, testing, data-minimisation measures and human oversight. We assess material risks, including accuracy, bias, explainability, security, confidentiality and the effect on individuals.

Material decisions

We do not make decisions that produce legal or similarly significant effects about candidates or workers solely by automated means. Technology may support our personnel, but an appropriately authorised person remains involved in material recruitment, placement, engagement and screening decisions.

If we introduce solely automated decision-making that has legal or similarly significant effects, we will provide specific information about the decision, the main factors and logic involved, likely consequences, applicable legal basis, and the available rights to obtain human intervention, express a view and challenge the outcome.

9.1 HubSpot

We may use HubSpot to manage professional and business contacts, website forms and enquiries, client and prospective-client relationships, marketing communications, communication preferences, live chat, meeting bookings, events, content downloads, campaign reporting and website engagement.

Depending on our configuration, HubSpot may process names, professional contact details, organisation and role information, correspondence, form responses, marketing preferences, IP addresses, device information, website activity and cookie or tracking identifiers. Optional tracking technologies will be used only in accordance with applicable cookie and electronic-marketing requirements.

9.2 Other recruitment and workforce platforms

We may use other recruitment, work-finding and workforce management platforms to support candidate or professional registration, vacancy and assignment applications, profile management, matching, onboarding, contracting, assignment administration, timesheets, document handling, worker communications and related workforce processes.

Depending on the platform and how it is configured, these systems may process identity and contact information, account and login details, CVs or professional profiles, work history, experience, skills, qualifications, application information, role and assignment preferences, onboarding and right-to-work documentation, communications, placement and assignment records, timesheets, availability, platform activity, audit records, and information generated through matching, workflow or administration processes.

9.3 Other service providers and systems

We may use providers supporting applicant tracking, candidate relationship management, payroll, invoicing, identity and right-to-work checks, screening, assessments, video interviewing, electronic signatures, document management, cloud hosting, communications, job advertising, sourcing, web hosting, analytics, security, workforce and vendor management, business intelligence and AI-assisted productivity or administration.

We may identify key providers where this materially assists transparency.

We may send information about services, events, insights, vacancies or business opportunities where you have consented, where applicable law permits communication within an existing relationship, or where we rely on legitimate interests and electronic-marketing law permits that approach.

You can opt out at any time using the unsubscribe option in a marketing email, changing your preferences by contacting us on our group companies page. Opting out of marketing will not prevent service, contractual, legal, security or administrative communications.

We may measure whether an email is delivered, opened or selected, and use campaign engagement information to improve communications, where permitted and subject to required choices or consent.

We may share personal data with:

• Vertage group companies;
• clients and prospective clients;
• managed service, recruitment process outsourcing and workforce partners;
• recruitment suppliers and other providers of professionals;
• payroll, pension, benefits and payment providers;
• screening, identity, right-to-work and assessment providers;
• technology, hosting, communications, analytics and cybersecurity providers;
• professional advisers, auditors, insurers, banks and financial institutions;
• government, tax, immigration, law-enforcement and regulatory authorities;
• courts, tribunals and legal representatives;
• parties involved in a merger, acquisition, financing, restructuring or sale; and
• other recipients where you direct or authorise us to share information or where law permits or requires it.

We require processors acting on our instructions to protect personal data and use it only for authorised purposes. Clients, employers, suppliers, insurers and other organisations may act as independent controllers where they determine their own purposes and means. Their own privacy notices will apply to that processing.

Vertage operates internationally. Personal data may therefore be accessed from, transferred to or stored in countries outside the country in which it was collected.

Where transfer restrictions apply, we use an appropriate mechanism, such as an adequacy regulation or decision, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, binding corporate rules, an approved certification framework, another approved mechanism or a legally permitted derogation.

Where appropriate, we assess the laws and practices of the destination and implement supplementary technical, contractual or organisational measures. Information about applicable safeguards may be requested using the contact details above, subject to legitimate confidentiality and security restrictions.

We keep personal data only for as long as necessary for the purposes described in this notice, including to provide recruitment, work-finding, workforce, platform and related services, and to meet legal, regulatory, tax, payroll, accounting, immigration, audit, insurance, contractual and dispute-resolution requirements.

Retention periods vary depending on the type of information, our relationship with you, the relevant service, applicable legal limitation periods, statutory obligations, client requirements and local laws. For example, candidate and work-seeker records are usually kept for a limited period after your last meaningful contact with us, while records relating to assignments, payroll, tax, right-to-work checks, screening, contracts, audits, complaints or legal claims may be kept for longer.

As we operate across multiple countries, retention periods may differ between jurisdictions, including Belgium, the Netherlands, the United Kingdom and other regions. Where local law, client requirements or a country-specific notice requires a different retention period, we will apply the relevant local requirement.

When personal data is no longer needed, we will delete it, anonymise it, restrict it or securely archive it in line with our retention standards and applicable law. We may keep limited information where needed to respect opt-out requests, maintain suppression lists, evidence compliance, manage disputes or prevent fraud.

We use appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful access, accidental loss, misuse, alteration, destruction or unauthorised disclosure. Measures may include access controls, authentication, encryption, network protection, logging, monitoring, secure development, staff training, supplier due diligence, incident management, resilience and business- continuity arrangements.

No system is completely secure. You should take reasonable care when sending information electronically and when using online accounts.

Depending on the law that applies and subject to legal conditions or exemptions, you may have rights to:

• receive information about our processing;
• access personal data we hold about you;
• correct inaccurate or incomplete personal data;
• Request deletion (with lawful exceptions)
• Restrict certain processing
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent, without affecting earlier lawful processing;
• receive certain information in a portable format;
• obtain human intervention and challenge certain automated decisions; and
• complain to our data protection team or a data-protection regulator.

To exercise a right, contact the Global Data Protection Officer at dpo@vertage.com. 

We may request information that is reasonably necessary to verify identity, clarify the request and locate relevant records.

Where a Vertage company acts only as a processor for a client, we may refer or forward the request to the relevant controller as appropriate.

We encourage you to contact us first so that we can investigate and respond to your concern. You may also complain to the data-protection authority responsible for your location or the relevant Vertage company.

United Kingdom: Information Commissioner’s Office - https://ico.org.uk.

European Economic Area - Contact | European Data Protection Board.

Our services are not generally directed at children. Where we lawfully provide apprenticeships, work-experience opportunities or other services involving younger people, we will provide age-appropriate information and safeguards and involve a parent or guardian where required by law.

Our websites and platforms may link to websites, platforms and services operated by other organisations. Those organisations control their own privacy practices. You should review their privacy information before providing personal data.

We may update this notice to reflect changes in our organisation, services, systems, technologies or legal obligations. The current version will be published on this page. Where a change is material, we may provide additional notice through our website, platform, email or another appropriate channel.

The following supplements should be developed and linked where relevant:

• United Kingdom;
• European Economic Area, including specific Netherlands and Belgium provisions where needed;
• United States, including applicable state privacy disclosures;
• Canada;
• Australia and New Zealand;
• India; and
• other countries in which Vertage actively recruits, supplies personnel, operates a platform or markets services.