Privacy Policy

VertexHR is an HR software platform built and operated by Arj Global Ltd, a company registered in England and Wales (company number 11174032), registered office 124 City Road, London, EC1V 2NX, VAT number GB 337789251 ("VertexHR", "we", "us", "our"). We are registered with the Information Commissioner's Office (ICO) under number ZB348598.

Contact us about privacy at support@vertex-hr.com or by post to our registered office.

We handle personal data in two different capacities.

• As a controller for data about our customers' account users, website visitors, prospects and billing contacts. This policy explains how we handle that data.
• As a processor for the employee data our customers upload into VertexHR (employee records, leave, timesheets, documents and similar). Each customer organisation is the controller of that data and decides how it is used. We process it only on their instructions under our Data Processing Agreement. If you are an employee of one of our customers, please contact your employer first about your data; we will help them respond.

• Account data: name, work email, job title, organisation name, phone number, login credentials (passwords are stored hashed), role and permissions.
• Billing data: billing contact, billing address, VAT number, subscription plan, employee count and payment history. We invoice customers and take payment by bank transfer, so we also hold invoice, payment and remittance records.
• Usage and technical data: IP address, browser and device type, log-in times, pages and features used, error logs and security logs.
• Communications: support requests, emails, demo bookings, feedback and survey responses.
• Website data: information you submit through forms, and cookie data as described in our Cookie Policy.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment.

VertexHR uses artificial intelligence to read uploaded documents and identify expiry dates (for example right-to-work documents, certificates and licences) so that alerts can be triggered. Documents are sent to Anthropic PBC (Claude), a US-based AI provider, for this purpose only. Under Anthropic's commercial terms, data sent through its API is not used to train its models. The AI output is a suggestion; customers should check extracted dates. No decisions with legal or similarly significant effects are made about anyone solely by automated means.

• Service providers who host, run or support VertexHR (hosting, email delivery, AI processing, accounting, analytics, customer support tools). They act on our instructions under written contracts. See our Sub-processor list.
• Our group company Arj Global Private Limited (India), which provides engineering and support services to us. Its staff are bound by confidentiality agreements with Arj Global Ltd, and transfers are covered by an intra-group data transfer agreement.
• Professional advisers such as accountants, lawyers and insurers.
• Authorities where required by law, or to protect our rights, our users or others.
• A buyer or investor if we sell, merge or restructure our business, under confidentiality obligations.

We do not sell personal data.

Our primary data is hosted with Amazon Web Services (AWS) in the European Union. Some providers, including Anthropic in the United States, and our Indian group company, may access data from outside the UK and EEA. Where this happens we use an adequacy decision or UK adequacy regulations where available, or the ICO's International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, together with supplementary measures where needed. Contact us for a copy of the relevant safeguards.

• Account data: for the life of your account, then up to 90 days after closure, then deleted or anonymised.
• Customer employee data: deleted or returned in line with the DPA, normally within 90 days of the subscription ending.
• Billing and transaction records: 6 years after the end of the financial year they relate to, as required by UK tax law.
• Security and audit logs: up to 24 months.
• Support and marketing records: up to 3 years from last contact, or until you opt out of marketing.

We use encryption in transit (TLS) and at rest, role-based access controls, row-level security separating each customer's data, multi-factor authentication for our own administrative access, logging of privileged access, and regular backups. No system is completely secure, so we also maintain an incident response process and will notify affected customers and the ICO of personal data breaches where required by law.

Under UK GDPR and EU GDPR you have the right to: access your personal data; have inaccurate data corrected; have data erased; restrict or object to processing (including an absolute right to object to direct marketing); data portability; and withdraw consent at any time where we rely on consent.

To exercise a right, email support@vertex-hr.com. We will respond within one month, which can be extended by two further months for complex requests. We may need to verify your identity. There is normally no fee.

Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, if you are in the EU, to your local data protection authority.

Our representative in the EU for GDPR purposes is [EU representative name and address].

VertexHR is a business service and is not intended for children. We do not knowingly collect data from children for our own purposes.

We may update this policy from time to time. We will post the updated version on our website with a new "Last updated" date and, for material changes, notify account holders by email or in the app.