Website Cookie, Tracking and AI Chatbot Policy

About this policy

This Website Cookie, Tracking and AI Chatbot Policy explains how Virtual Human Resources Ltd (“VHR”, “we”, “us” or “our”) uses cookies and similar technologies, website analytics, behavioural tracking, session recording and an AI-enabled chatbot on www.v-hr.com. These technologies support the website and services provided by companies within the VHR group.

This policy supplements the privacy notices issued by the relevant VHR group companies. Those privacy notices explain how the relevant VHR company processes personal data in connection with recruitment, employment, contractor placement and related services

Where this policy and another VHR privacy notice contain different information specifically concerning cookies, website tracking or the AI chatbot on www.v-hr.com, this policy shall apply to that website processing.

When you visit our website, we may automatically collect information such as your IP address, browser type, device information, cookie identifiers, the date and time of your visit, the pages you view, and how you interact with our website.

We may also collect information when you contact us through the website, including through enquiry forms, live chat or our chatbot.

Except for strictly necessary cookies, we only use cookies, analytics, heatmapping, session recording and similar technologies where you have given your consent. You can give, refuse or withdraw consent at any time through our cookie banner or Cookie Settings link.

 

Who is Responsible for the Website? 

Virtual Human Resources Ltd operates www.v-hr.com and owns or contracts for the website technology used by the VHR group.

Virtual Human Resources Ltd determines how and why the cookies, website analytics, behavioural tracking, session recording and AI-enabled chatbot described in this policy are used. It is the data controller responsible for the processing described in this policy.

You may contact us about any matter covered by this policy at: Email: compliance@v-hr.com


Address: Virtual Human Resources Ltd, Luna House, 37–39 Bermondsey Wall West, London SE16 4RN, United Kingdom.

 

1. How do we use your information?

Candidate Data

We use candidate personal data to provide recruitment and work-finding services, assess suitability for roles, manage applications and assignments, communicate with candidates, and comply with legal and regulatory obligations.

We may also use candidate data to improve our services and, where permitted by law, send relevant job opportunities, newsletters or recruitment updates.

Client Data

We use client personal data to provide recruitment services, manage business relationships, communicate with client contacts, administer contracts and assignments, and deliver our services effectively.

Supplier Data

We use supplier personal data to manage supplier relationships, administer contracts, process payments, and comply with legal, audit and compliance requirements.

Prospect Client and Supplier Data

We use prospective client and supplier data for business development, relationship management and marketing purposes.

Where required by law, we will only send marketing communications with consent. In other cases, we may rely on our legitimate interests in promoting our services and developing business relationships, provided your rights do not override those interests.

 

Referees and Emergency Contacts

We use referee details to verify employment, assignment history, qualifications, experience or suitability for a role.

We may contact referees about recruitment opportunities or services only where permitted by law.

We use emergency contact details only where necessary, such as in an accident, emergency or urgent situation.

 

Website Users 

We use website data to improve user experience, optimise website performance, maintain security, analyse website use, personalise content and show relevant vacancies or services.

With your consent, we use analytics, heatmapping and session recording tools to understand how visitors use our website. These tools may show pages viewed, clicks, scroll activity, mouse movement and form interactions. Text entered into forms is masked and passwords are never captured.

We also use a chatbot to provide website support. Chatbot conversations may be recorded and stored with details such as the page visited, browser type and any contact details you choose to provide. Please do not submit sensitive personal information through the chatbot.

Where necessary, we may use website data, emails, chatbot transcripts and telephone recordings for internal reviews, compliance, fraud prevention, dispute resolution or legal investigations.

 

Marketing and Business Development

We may use personal data to send information about our services, vacancies, newsletters, events, industry updates or business development opportunities.

For candidates, this may include job opportunities, assignment updates and recruitment updates.

For clients, suppliers and business contacts, this may include information about our recruitment services, market updates and relationship management communications.

You can object to or opt out of direct marketing at any time by using the unsubscribe link in our emails, contacting us, or updating your preferences where available.

If you opt out, we may keep limited details on a suppression list to ensure we do not send further direct marketing.

 

2. Who do we share your personal data with?

We do not sell your personal data.

We may share personal data where necessary with:

  • clients, candidates, contractors, referees, suppliers and business contacts
  • recruitment software, CRM and database providers
  • website hosting, analytics, cookie consent, session recording and heatmapping providers
  • chatbot, AI, communications and customer support providers
  • IT, cloud hosting, cyber security and system administration providers
  • payroll, accounting, banking and payment providers
  • professional advisers, auditors, insurers and legal advisers
  • VHR group companies and overseas offices
  • regulators, courts, law enforcement, government bodies or other authorities where required or permitted by law.

 

Some third parties process personal data on our behalf. Where they do, we require them to keep it secure, confidential and only process it in accordance with our instructions.

Other recipients, such as clients, advisers, insurers, regulators or authorities, may act as independent controllers and will be responsible for their own data protection compliance.

We may also share anonymised or aggregated information for analytics, reporting, marketing or advertising purposes.

 

3. How do we protect your information?

We use appropriate technical and organisational measures to protect personal data against unauthorised access, misuse, loss, alteration or disclosure.

These measures may include access controls, encryption, secure systems, confidentiality obligations, staff training, monitoring and internal policies.

Only authorised personnel may access personal data where there is a legitimate business need.

 

4. How long do we keep your information for?

We keep personal data only for as long as necessary for the purposes for which it was collected, including recruitment services, business relationship management, legal compliance, audit, dispute resolution and legal claims.

Candidate, client, supplier and employee data may be retained during the relevant assignment, contract, employment relationship or business relationship, and for up to 6 years afterwards where required for legal, audit, contractual or compliance purposes.

Where we have not entered into an employment, assignment or services contract with you, and have had no meaningful contact with you for at least 3 years, we will delete or anonymise your personal data unless we need to keep it for legal, regulatory, compliance, dispute resolution or legitimate business purposes.

 

Website analytics and behavioural tracking data is retained for up to 400 days.

Session recordings are retained for up to 30 days.

Chatbot transcripts and website enquiry records are retained for up to 180 days, subject to any longer period required by law or reasonably necessary in connection with legal claims.

Marketing suppression records may be kept for as long as necessary to respect your preference not to receive direct marketing.

At the end of the relevant retention period, personal data will be securely deleted, destroyed or anonymised, unless we are required or permitted to keep it for longer.

 

5. How can you access, amend or take back your personal data?

You have certain rights under applicable data protection laws. These rights may apply only in certain circumstances and may be subject to legal exemptions.

You may have the following rights:

  • Right to be informed: to know how we collect and use your personal data
  • Right of access: to ask for a copy of the personal data we hold about you.
  • Right to rectification: to ask us to correct inaccurate or incomplete personal data.
  • Right to erasure: to ask us to delete your personal data in certain circumstances.  
  • Right to restrict processing: to ask us to restrict how we use your personal data in certain circumstances.
  • Right to data portability: to receive certain personal data in a commonly used, machine-readable format, or ask us to transfer it to another controller where technically feasible.
  •  Right to object: to object to processing based on legitimate interests. You also have an absolute right to object to direct marketing at any time.
  • Right to withdraw consent: where we rely on consent, you can withdraw it at any time. This will not affect processing carried out before consent was withdrawn.
  • Rights related to automated decision-making: we do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Our chatbot may generate automated responses, but it is not used to make recruitment, employment, contractual or legal decisions about you without human involvement.
  • Right to complain: you can complain to the Information Commissioner’s Office if you are unhappy with how we handle your personal data. We would appreciate the opportunity to deal with your concerns first.

 

We may ask you to verify your identity or provide more information about your request.

Where legally permitted, we may decline a request, but we will explain why.

We will respond within one month of receipt of your request, unless an extension is permitted under applicable law.

We may need to retain certain personal data for legal, regulatory, audit, compliance or dispute resolution purposes, even where you ask us to erase or restrict it.

 

6. How do we store and transfer your data internationally?

Virtual Human Resources operates globally and may need to access, transfer or store personal data internationally to provide our services and operate our business.

VHR is headquartered in the United Kingdom, but some of our website, analytics, session-recording and AI service providers may process or permit access to personal data from other countries. Where personal data is transferred outside the United Kingdom, we use appropriate safeguards as required by applicable data-protection law.

Where personal data is transferred outside the UK or EEA, we will ensure appropriate safeguards are in place. These may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, EU Standard Contractual Clauses, or another lawful transfer mechanism.

 

7. Cookies, analytics and similar technologies

Cookies and similar technologies are small pieces of information stored on or accessed from your device. We use them to make our website work, understand how visitors use it, improve performance, personalise content and support our recruitment services.

Except for strictly necessary cookies, we only use these technologies where you have given consent. You can give, refuse or withdraw consent at any time through our cookie banner or Cookie Settings link.

Withdrawing consent will prevent further collection through non-essential cookies and similar technologies. Existing cookies may also be removed through your browser settings or, where available, our cookie preferences tool.

 

Website analytics and behaviour tracking

With your consent, we use SourceFlow analytics to understand how our website is used. It stores a pseudonymous, randomly generated visitor identifier and collects information such as pages viewed, referral pages, campaign parameters, screen size, clicks, scroll activity, mouse movement and form interactions.

It records which form fields you interacted with and whether you completed them. It does not record what you typed.

This data is retained for up to 400 days.

 

Session recording

With your consent, we may record website sessions to help diagnose usability issues and improve website performance.

Recordings may capture pages viewed, clicks, scrolling and mouse activity. Text entered into forms is masked and passwords are never captured.

Recordings are retained for up to 30 days and are accessible only to authorised staff.

 

Chatbot

Our chatbot stores a transcript of your conversation, the page you were on, your browser type and any contact details you choose to provide.

Responses may be generated using a third-party AI service, which processes your messages on our behalf and does not use them to train its models.

 

Please do not enter sensitive personal information into the chatbot.

 

Chatbot transcripts are retained for up to 180 days to respond to enquiries, support service quality, maintain business records, and deal with legal, compliance or dispute-related matters. We may retain particular transcripts for longer where required by law or reasonably necessary in connection with legal claims.

 

Legal bases for processing

We only process personal data where we have a lawful basis to do so. Depending on the circumstances, we may rely on:

  • Contract: where processing is needed to enter into or perform a contract.
  • Legal obligation: where processing is needed to comply with the law.
  • Legitimate interests: where processing is needed for our business interests, including recruitment services, business relationship management, service improvement, security, fraud prevention, dispute handling and marketing, provided your rights do not override those interests.
  •  Consent: where you have given consent, including for non-essential cookies, analytics, heatmapping, session recording and certain marketing communications.
  • Vital interests: where processing is needed to protect someone’s life.

 

Cookies and similar technologies we use

__sentinel_sid

Session storage

Distinguishes a single browsing session

End of session

__sentinel_visits

Local storage

Counts repeat visits

Until cleared

sf_src

First-party cookie

Records how you arrived at our site, to tailor content

400 days

 

You can also control cookies through your browser settings, and we honour "Do Not Track" and Global Privacy Control browser signals.