Data Protection & Privacy Policy

Governed by Virtual Human Resources Ltd

 

1.     Introduction and Group Scope

This Data Protection & Privacy Policy applies to the companies operating within the VHR Group, including recruitment, contractor management, workforce solutions and related business operations in the United Kingdom, European Union, United Arab Emirates, Kingdom of Saudi Arabia, State of Qatar, United States of America and Canada.

For this policy, references to “VHR”, “VHR Group”, “we”, “our” or “us” mean Virtual Human Resources Ltd and, where applicable, its affiliated companies, subsidiaries, branch operations and representative offices.

Virtual Human Resources Ltd, incorporated in England and Wales under company registration number 4739786, is the principal contracting entity for the VHR Group data, systems, platforms and services covered by this policy. It also provides group-level technology governance and data protection oversight.

The majority of the systems, platforms and services used throughout the VHR Group are contracted, licensed, administered, governed or managed through Virtual Human Resources Ltd, including recruitment systems, workforce management systems, financial systems, communications platforms, website technologies and other business applications. These systems support multiple VHR Group companies and form part of the VHR Group’s shared operational, compliance and data governance framework. 

Virtual Human Resources Ltd establishes and maintains the group-wide privacy, information security and data protection standards described in this policy. Each VHR Group company must also comply with any local law that applies to its processing activities.

This policy has been prepared in accordance with the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), where applicable. Due to the significant volume of VHR Group activity across Europe, it has also been written with specific regard to the European Union General Data Protection Regulation (EU GDPR). Where the EU GDPR applies to a processing activity, the relevant VHR entity will seek to meet its applicable requirements.

Where laws in the European Union, United Arab Emirates, Kingdom of Saudi Arabia, State of Qatar, United States of America or Canada impose additional or higher requirements, the relevant VHR Group company will comply with those requirements in addition to this group baseline.

VHR maintains separate notices for specialist processing. Website cookies, analytics, behavioural tracking, heatmapping, session recording and the VHR AI chatbot are explained in the Website Cookie, Tracking and AI Chatbot Policy. Where that policy contains different information specifically about those technologies on www.v-hr.com, it applies to that website processing.

Unless another law applies to a specific processing activity, this policy is governed by the laws of England and Wales.

2.     Governing entity and controller arrangements

Item	Details
Governing and Principal Contracting Entity	Virtual Human Resources LTD
Company Registration Number	4739786
Registered Office	Luna House, 37-39 Bermondsey Wall West, London, SE16 4RN, United Kingdom
Data Protection & Privacy Contact	Compliance@v-hr.com
Website	www.v-hr.com

 

Virtual Human Resources Ltd is the contracting entity for the VHR Group systems and services covered by this policy. Depending on the processing activity and applicable law, Virtual Human Resources Ltd, a local VHR Group company, or both may act as controller, joint controllers, processor or the local law equivalent. The entity that determines why and how particular personal data is processed is responsible for the relevant controller obligations.

Where required, a local or activity-specific data protection & privacy notice may identify the relevant VHR company, representative, regulator or additional rights. Such notices should be read with this policy.

 

3.  Who this policy covers 

This policy applies to personal data relating to:

·        Candidates and prospective candidates

·        Contractors, temporary workers and placed candidates

·        Client and prospective client contacts

·        Suppliers and service provider representatives

·        Referees, emergency contacts and other third parties

·        Website users and people who contact VHR

·        Other individuals whose data is processed through group systems or in connection with VHR services

 

Separate employee data protection & privacy information may apply to VHR employees and workers.

 

4.       Personal data we collect

Candidates and prospective candidates

·                Identity and contact details

·                CV, employment history, skills and experience

·                Qualifications, training, licenses and memberships

·                Role, location, remuneration and work preferences

·                Availability and notice period

·                Interview, assessment and recruitment notes

·                References and referee information

·                Right-to-work, nationality, passport, visa and immigration information where required

·                Security clearance and vetting information where required

·                Applications, submissions, offers, placements and communications

 

Contractors and placed candidates

·                Date of birth and tax identification details

·                Bank, payment, payroll and timesheet information

·                Contract, assignment and remuneration details

·                Emergency contacts

·                Compliance and client onboarding information

·                Health, occupational health or adjustment information where lawful and necessary

·                Criminal record or security screening information where lawful and necessary

 

Clients, prospects and suppliers

·        Names, titles and business contact details

·        Company, vacancy, hiring and relationship information

·        Contractual, commercial, billing, payment and due diligence information

·        Communications and service records 

 

Website and digital users

·        IP address, browser, device, operating system and approximate location

·        Cookie, session and pseudonymous analytics identifiers

·        Pages viewed, referral and campaign information

·        Clicks, scrolling, mouse movement and form interactions

·        Consent and communication preferences

·        Website enquiries, support chat and AI chatbot conversations

·        Server logs, security events and usage information 

 

We may produce anonymised or aggregated information. If it can no longer identify an individual, it is not personal data for this policy.

 

5.       How we collect personal data

·        Directly from you through registration, applications, forms, calls, emails, meetings or other communications

·        Through VHR websites, portals and shared group systems

·        From job boards, CV databases, LinkedIn and professional networks

·        From clients, managed service providers, neutral vendors and supply-chain partners

·        From employers, referees and referrals

·        From umbrella companies, payroll bureaux and onboarding providers

·        From identity, right-to-work, qualification, security and background-check providers

·        From events, conferences, professional registers and public sources

·        Automatically through cookies, analytics, behavioural tracking, heatmapping, session recording, server logs and similar technologies, subject to consent requirements

 

Where required, we will provide data & privacy information when data is obtained from another source unless an exemption applies.

 

6.       How and why we use personal data

 

Purpose	Typical Data	Typical Basis
Recruitment registration, sourcing and applications	Identity, contact, CV, employment, skills and preferences	Contract or pre-contract steps; legitimate interests
Candidate submissions, interviews, offers and placements	CV qualifications, availability, assessments and eligibility	Contract or pre-contract steps; legitimate interests
Contractor and assignment management	Identity, contract, payroll, tax, timesheet and compliance	Contract; legal obligation; legitimate interests
Right-to-work, identity, qualification and screening checks	Identity, eligibility, immigration, qualifications and checks	Legal obligation; contract; legitimate interests; additional condition where needed
Client and supplier management	Identity, business contact, contract, finance and communications	Contract; legitimate interests; legal obligation
Payments, invoices and financial records	Identity, financial, transaction and contract data	Contract; legal obligation; legitimate interests
Relevant job, service and business messages	Identity, contact, profile and preferences	Legitimate interests or consent, subject to marketing law
Website operation, security and improvement	Technical, usage, security and profile data	Legitimate interests; legal obligation; consent for non-essential technologies
Enquiries, complaints, rights, disputes and claims	Identity, contact, communications and case data	Legal obligation; legitimate interests; legal claims

 

7.       Lawful bases and data protection principles

·        Contract or steps before entering a contract

·        Legitimate interests, after balancing those interests against individual rights

·        Legal obligation

·        Consent, which may be withdrawn at any time

·        Vital interests

·        Public task, only where supported by applicable law

 

In line with UK GDPR and, where applicable, the European Union General Data Protection Regulation (EU GDPR), VHR applies the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

 

8.       Sensitive and criminal offence data

Special category information may include health or disability information, racial or ethnic origin, religious beliefs, trade union membership or biometric information used for identification. We process it only where an ordinary lawful basis and an applicable additional legal condition are satisfied.

Criminal conviction and offence data are subject to separate safeguards. It is processed only where authorized by law and necessary for a relevant role, client, security or regulatory purpose. Appropriate access, confidentiality and retention controls apply.

Please do not submit sensitive personal information through the website AI chatbot.

 

9.       Automated processing and artificial intelligence

VHR may use software, automation and AI to support candidate searches, role matching, communications, data management, analytics, reporting and administration. Significant recruitment, employment and placement decisions involve meaningful human review. 

VHR does not intend to make decisions producing legal or similarly significant effects based solely on automated processing unless lawful and supported by appropriate safeguards. Where applicable, individuals may request information, challenge a decision or request human intervention. 

The website AI chatbot provides general support and is not used to make recruitment, employment, placement, contractual or legal decisions without meaningful human involvement. The Website Cookie, Tracking and AI Chatbot Policy explains its operation and retention.

 

10.    Sharing personal data

Where necessary and lawful, personal data may be shared with:

·        Other VHR Group companies, branches and authorised personnel

·        Clients, prospective employers, end clients and hiring organisations

·        Managed service providers, neutral vendors and supply-chain partners

·        Umbrella companies, payroll bureaux and payment providers

·        Background, identity, right-to-work, qualification and security-check providers

·        Recruitment, CRM, database, financial, workforce, cloud, communications and website providers

·        Website analytics, consent, behavioural tracking, heatmapping and session-recording providers

·        AI chatbot, IT, customer support and cyber-security providers

·        Professional advisers, insurers, auditors, accountants and lawyers

·        Government departments, regulators, courts and law enforcement

·        Potential purchasers and advisers during a business sale or reorganisation, subject to appropriate controls

 

Candidate information shared with UK and overseas clients

Where you have applied for an opportunity, asked VHR to represent you, or otherwise agreed that suitable clients may be approached, relevant information may be shared to assess suitability. In other circumstances, VHR may contact you before disclosing identifying information unless disclosure is lawful and consistent with the privacy information provided to you.

 

·        CV and employment history

·        Qualifications, licences and certifications

·        Skills, experience, preferences and availability

·        Remuneration expectations

·        Right-to-work and eligibility information where required

·        Relevant assessment, interview or recruitment information

·        Other necessary recruitment, onboarding or placement information

 

VHR does not sell personal data. Processors acting for VHR must follow appropriate purpose, confidentiality, security and data-protection restrictions. Other recipients may act as independent controllers.

 

11.    Group systems and international transfers

The VHR Group uses shared systems across the United Kingdom, European Union, United Arab Emirates, Kingdom of Saudi Arabia, State of Qatar, United States of America and Canada. As Virtual Human Resources Ltd is the principal contracting entity for the systems and data covered by this policy, it may contract with suppliers, administer systems and set group controls on behalf of VHR operations.

Authorised personnel in different VHR Group entities may access shared systems where necessary for recruitment, contractor management, workforce mobilisation, finance, payroll, reporting, compliance, communications and business operations, subject to role-based access and appropriate safeguards.

Transfers between VHR entities and suppliers may include transfers from the EEA to the UK, from the UK to the EEA, and to other countries. Website, analytics, tracking, session-recording and AI providers may also process or permit access internationally.

 

Transfer safeguards

·        Applicable UK or EU adequacy decisions

·        UK International Data Transfer Agreement

·        UK Addendum to the EU Standard Contractual Clauses

·        EU Standard Contractual Clauses where the European Union General Data Protection Regulation (EU GDPR) applies

·        Contractual, technical and organisational controls

·        Transfer risk assessments and supplementary measures

·        Another permitted transfer mechanism or legal exception

 

Further information about relevant safeguards may be requested from the Data Protection Team. Confidential or commercially sensitive content may be redacted where appropriate.

 

12.        Data retention

VHR keeps data only as long as reasonably necessary for its purposes and legal, regulatory, tax, audit, contractual and dispute requirements. Group retention standards may be supplemented by local requirements.

 

Category	Indicative Approach
Candidate records	Normally up to 6 years from the last meaningful interaction, subject to purpose, applicable law and the approved retention schedule.
Placement, contractor and assignment records	Normally up to 6 years after the relationship ends, unless another period is required.
Client and supplier records	Normally up to 6 years after the relationship or contract ends, subject to legal and dispute requirements.
Financial records	For the period required by applicable tax, accounting and legal obligations.
Marketing records	Until opt-out or withdrawal where consent applies, with limited suppression data retained.
Website analytics, tracking, recordings, chatbot transcripts and enquiries	The specific periods are stated in the Website Cookie, Tracking and AI Chatbot Policy.
Rights requests and complaints	For the period needed to respond, demonstrate compliance and manage related disputes or regulatory matters.

 

When no longer required, data is securely deleted, anonymised or otherwise disposed of.

 

13.        Your rights

·        Right to be informed

·        Right of access

·        Right to rectification

·        Right to erasure in applicable circumstances

·        Right to restrict processing

·        Right to object, including an absolute right to object to direct marketing

·        Right to data portability where applicable

·        Right to withdraw consent

·        Rights concerning solely automated decisions and profiling where applicable

 

Requests may be sent to compliance@v-hr.com. VHR may verify identity and seek clarification. No fee is normally charged, though a reasonable fee may be charged or a request declined where legally permitted because it is manifestly unfounded or excessive. VHR will respond within the period required by the law applicable to the request.

Where the European Union General Data Protection Regulation (EU GDPR) applies, individuals may benefit from its rights and protections. Local laws may provide additional rights.

 

14.        Marketing

VHR may contact candidates about relevant roles and services and business contacts about recruitment and related services where lawful. Depending on the circumstances, VHR may rely on legitimate interests or consent. Electronic marketing is also handled under PECR and applicable local marketing laws.

You may opt out at any time using the unsubscribe method or by contacting us. Limited suppression information may be retained to respect that preference. Necessary service, contractual, compliance or administrative messages may still be sent.

 

15.        Website cookies, tracking and AI chatbot

The separate Website Cookie, Tracking and AI Chatbot Policy explains cookies and similar technologies used on www.v-hr.com, analytics, behavioural tracking, heatmapping, session recording, the AI chatbot, consent choices, providers and website-specific retention periods. 

Except for strictly necessary technologies, non-essential cookies and tracking are used only where required consent has been provided. Where the two policies differ specifically on this website processing, the dedicated website policy applies.

 

16.        Security and personal data breaches

VHR uses appropriate technical and organisational measures designed to protect data. These may include role-based access, encryption, multi-factor authentication, secure cloud and backup arrangements, monitoring, staff training, supplier controls and incident-response procedures.

Where a personal data breach occurs, VHR will assess it and notify affected individuals and relevant authorities where required by applicable law.

 

17.        Complaints and regulators

Please contact the Data Protection Team first so VHR can investigate and seek to resolve concerns. This does not affect the right to complain to a competent regulator.  

As the governing UK entity, Virtual Human Resources Ltd is primarily accountable in the UK to the Information Commissioner’s Office (ICO): https://ico.org.uk. 

Where the European Union General Data Protection Regulation (EU GDPR) applies, individuals in the EEA may have the right to complain to a competent EU supervisory authority. Other local regulators may also have jurisdiction. VHR will cooperate with lawful enquiries from relevant authorities.

 

18.        Contact us

Data Protection Team
Virtual Human Resources Ltd
compliance@v-hr.com
Luna House
37-39 Bermondsey Wall West
London SE16 4RN
United Kingdom 

 

Where required by local law, a local VHR notice may provide additional entity, representative or regulator contact details.

 

19.        Third-party links

VHR websites may contain links to third-party websites, plug-ins or applications. VHR does not control them and is not responsible for their privacy notices or processing. Please read the privacy information of each site visited.

 

20.        Changes to this policy

VHR may update this policy to reflect changes in law, regulation, technology, group structure, services or processing. The current version and effective date will be published. Where a change materially affects individuals, VHR will take reasonable steps to notify them where required.