Privacy Policy

1. Scope

This Privacy Policy applies to personal information processed through:

www.vertexworkforce.org;

professional and candidate registrations;

customer resource requests;

job applications;

talent profiles;

communications with Vertex Workforce;

interviews and assessments;

workforce engagements;

support requests;

marketing activities;

website analytics; and

other Vertex Workforce services.

2. Data Controller

For applicable privacy laws, the primary controller is:

Vertex Workforce [Legal Entity Name]
[Registered Address]
Privacy Contact: [privacy@vertexworkforce.org]
Data Protection Officer, where applicable: Kashan Khan

In some workforce arrangements, Vertex Workforce may act as an independent controller, joint controller, processor, service provider, contractor, or equivalent role depending on the particular relationship.

3. Personal Information We May Collect

Depending on your interaction with Vertex Workforce, information may include identity and contact details; professional information; CV or resume information; qualifications; educational history; employment history; technical skills; certifications; portfolio information; references; professional memberships; location; availability; language proficiency; work preferences; desired engagement type; compensation expectations; customer requirements; interview notes; assessment results; account information; communications; website usage information; IP address; device information; cookies; business contact information; billing information; and information reasonably necessary for engagement administration.

4. Sensitive or Special-Category Information

Certain engagements may require information considered sensitive or “special category” under applicable law.

This may include information relating to disability accommodations, health restrictions relevant to workplace safety, government identification, immigration or work authorization, background checks, or similar protected information.

Vertex Workforce will collect sensitive information only where reasonably necessary and supported by an appropriate legal basis, and where required will request explicit consent.

Users should not provide sensitive information that Vertex Workforce has not requested.

5. Sources of Information

Information may be collected directly from users, employers, customers, references, authorized representatives, recruitment partners, professional networks, publicly available professional sources, assessment providers, verification providers, communications, cookies, or other lawful sources.

Where information is obtained indirectly, required notices will be provided where applicable.

6. Purposes of Processing

Vertex Workforce may process personal information to provide workforce services; establish professional profiles; understand customer resource requirements; identify appropriate talent; match candidates to opportunities; recommend professionals; arrange interviews; perform screening and evaluation; verify qualifications; manage onboarding; administer engagements; communicate with users; provide customer service; operate and secure the Website; detect fraud; administer contracts; invoice customers; maintain business records; analyze and improve services; comply with law; defend legal claims; maintain network and system security; and conduct marketing where lawfully permitted.

7. Legal Bases for Processing

Where laws such as the GDPR or UK GDPR apply, Vertex Workforce may process personal information based on one or more legal grounds, including:

Contractual necessity: where processing is necessary to provide requested services or take steps toward an engagement.

Legitimate interests: where processing is reasonably necessary for workforce matching, recruitment administration, service improvement, network security, fraud prevention, business administration, or similar legitimate activities and those interests are not overridden by individual rights.

Consent: where you have voluntarily provided specific permission.

Legal obligations: where processing is necessary to comply with law, regulation, judicial orders, tax obligations, employment obligations, or regulatory requirements.

Legal claims: where processing is necessary to establish, exercise, or defend legal rights.

Other legal bases may apply under local laws.

Consent is therefore not the only legal basis Vertex Workforce may rely upon.

8. Consent to Candidate Profile Sharing

Where required or selected as the appropriate legal basis, Vertex Workforce will request separate consent before sharing a professional profile with prospective customers.

The user may be informed of the customer or relevant category of recipient, the purpose of sharing, the information involved, and other material circumstances required by law.

Consent may be withdrawn for future disclosures by contacting Vertex Workforce or using available privacy controls.

EU guidance requires consent to be freely given, specific, informed and unambiguous, while Canadian guidance similarly emphasizes meaningful consent and disclosure of the parties, purposes and consequences involved. European Commission

9. Sharing Personal Information

Vertex Workforce may disclose appropriate information to prospective or existing customers; organizations offering assignments; workforce partners; authorized recruiters; affiliated companies; professional assessment providers; identity or qualification verification providers; background-check providers where permitted; cloud infrastructure companies; IT vendors; communication providers; professional advisers; accountants; auditors; payment providers; analytics providers; government bodies; regulators; law-enforcement authorities; courts; or potential acquirers in connection with a legitimate corporate transaction.

Recipients will receive only information reasonably relevant to their role and purpose.

Service providers processing personal information on Vertex Workforce’s behalf will be subject to appropriate contractual and confidentiality protections where required.

10. Customer Responsibilities for Candidate Data

Organizations receiving candidate information must use it only for legitimate workforce, recruitment, evaluation, onboarding, compliance, or engagement purposes.

Customer organizations must implement appropriate confidentiality and security measures.

Candidate data must not be sold, publicly disclosed, used for unrelated advertising, or retained indefinitely without an appropriate purpose and legal basis.

Customers may themselves become independent data controllers and may therefore have separate privacy obligations.

11. International Data Transfers

Because Vertex Workforce connects organizations and professionals internationally, personal information may be processed in countries different from the individual’s country of residence.

Where legally required, appropriate mechanisms will be used, which may include adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, applicable Brazilian transfer mechanisms, contractual protections, or other legally recognized safeguards.

EU rules require safeguards for transfers outside the EEA, and current UK guidance similarly provides for appropriate safeguards for restricted international transfers. Brazil has also adopted specific regulations governing international data transfers and contractual mechanisms. European Commission

Vertex Workforce will provide additional information about relevant transfer mechanisms upon a valid request where required by law.

12. European Economic Area and United Kingdom Rights

Where GDPR or UK GDPR applies, individuals may have rights including access to personal information; correction; deletion; restriction of processing; data portability; objection to certain processing; withdrawal of consent; and the right to lodge a complaint with an appropriate supervisory authority.

Where applicable, individuals may also have protections concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Rights are subject to statutory limitations and exceptions.

13. California Privacy Rights

Where the California Consumer Privacy Act, as amended, applies, California consumers may have rights concerning knowledge/access, correction, deletion, information concerning collection and disclosure, opt-out from sale or sharing where applicable, limitation of certain uses of sensitive personal information where applicable, and non-discriminatory treatment for exercising privacy rights.

California authorities confirm rights including knowing how information is collected and shared, deletion, opt-out of sale/sharing, and protection against discrimination for exercising CCPA rights. California Privacy Protection Agency

Where legally required, Vertex Workforce will provide mechanisms such as “Do Not Sell or Share My Personal Information” and recognition of applicable opt-out preference signals.

14. Brazil — LGPD

Where Brazil’s Lei Geral de Proteção de Dados Pessoais (LGPD) applies, data subjects may have applicable rights concerning confirmation of processing, access, correction, anonymization, blocking or deletion where appropriate, portability, information concerning sharing, deletion of information processed on consent where legally applicable, and withdrawal of consent.

Brazil’s ANPD also requires international transfers to follow recognized legal mechanisms and emphasizes transparency concerning such transfers. Serviços e Informações do Brasil

15. Canada

Where Canada’s PIPEDA or applicable provincial privacy laws apply, Vertex Workforce will follow applicable requirements concerning accountability, identifying purposes, meaningful consent, collection limitation, use/disclosure/retention limitation, safeguards, accuracy, openness, access, and challenging compliance.

The Office of the Privacy Commissioner of Canada identifies these as core PIPEDA principles and emphasizes meaningful consent for applicable collection, use, and disclosure. Office of the Privacy Commissioner

16. Australia

Where Australia’s Privacy Act and Australian Privacy Principles apply, Vertex Workforce will manage information according to applicable requirements relating to transparency, collection, notification, use/disclosure, direct marketing, cross-border disclosure, data quality, security, access, and correction.

Australian guidance requires applicable organizations to maintain a clearly expressed and up-to-date privacy policy and addresses cross-border disclosure through the Australian Privacy Principles. OAIC

17. Singapore

Where Singapore’s Personal Data Protection Act applies, Vertex Workforce will observe applicable requirements concerning accountability, notification, consent, purpose limitation, accuracy, protection, retention, international transfers, access, correction, and breach notification.

Singapore’s PDPC expressly identifies these obligations, including requirements for cross-border transfers to maintain a comparable standard of protection. Personal Data Protection Commission

18. Other Countries

Vertex Workforce intends to apply appropriate privacy safeguards wherever it operates and will comply with other applicable national, federal, provincial, state, or sector-specific privacy and data-protection laws.

Where local law provides stronger or additional rights, those mandatory provisions will apply.

Nothing in this Policy is intended to reduce rights granted under applicable law.

19. Automated Processing and AI-Assisted Tools

Vertex Workforce may use software, search algorithms, analytics, or artificial-intelligence-assisted tools to help organize profiles, identify skills, search professional information, rank potential relevance, detect duplicate information, or assist workforce matching.

Where applicable, such tools will support rather than unlawfully replace appropriate human decision-making.

If Vertex Workforce implements solely automated decision-making that produces legal or similarly significant effects, it will provide required disclosures, safeguards, and rights under applicable law.

20. Data Accuracy

Users should keep their information accurate and current.

Vertex Workforce may request verification or corrections where information appears incomplete, outdated, inconsistent, or inaccurate.

21. Data Minimization

Vertex Workforce will seek to collect personal information that is reasonably relevant and proportionate to the stated purposes.

Users should avoid submitting information unnecessary for workforce matching or engagement.

22. Data Retention

Personal information will be retained only for as long as reasonably necessary for the purposes for which it was collected, including workforce matching, active and potential engagements, contract administration, dispute resolution, security, regulatory requirements, accounting, tax, legal obligations, and establishment or defense of claims.

Different categories of information may have different retention periods.

Where data no longer needs to be retained, Vertex Workforce will take reasonable steps to delete, anonymize, de-identify, or securely dispose of it.

23. Security

Vertex Workforce will maintain reasonable administrative, organizational, physical, and technical safeguards appropriate to the nature and sensitivity of the information processed.

Measures may include access controls, encryption where appropriate, authentication, system monitoring, backup processes, security reviews, confidentiality obligations, vendor controls, and staff awareness.

No internet-based information system can be guaranteed completely secure, and users should also maintain appropriate account and device security.

24. Personal Data Breaches

Vertex Workforce will maintain processes for identifying, assessing, containing, investigating, and responding to personal-data breaches.

Where applicable law requires notification to affected individuals, supervisory authorities, customers, or other parties, Vertex Workforce will provide the required notification within the legally prescribed period.

25. Marketing Communications

Vertex Workforce may send information about workforce services, opportunities, events, insights, or related offerings where legally permitted.

Where consent is required, marketing communications will be sent only after appropriate opt-in.

Recipients may unsubscribe using the mechanism included in communications or by contacting Vertex Workforce.

Withdrawal from marketing does not prevent necessary service, account, security, contractual, or transactional communications.

26. Cookies and Similar Technologies

Vertex Workforce may use cookies, pixels, local storage, analytics technologies, and similar tools.

Strictly necessary technologies may operate without optional consent where legally permitted.

Analytics, advertising, personalization, or other non-essential technologies requiring consent will be managed through an appropriate cookie-consent mechanism.

Users should be able to modify applicable cookie preferences after making an initial selection.

27. Do Not Track and Global Privacy Control

Where applicable law requires recognition of browser-based privacy preference signals, Vertex Workforce will process supported signals in accordance with those requirements.

28. Individual Privacy Rights

Depending on jurisdiction, individuals may have rights to request access, correction, deletion, restriction, objection, portability, information concerning disclosures, withdrawal of consent, opt-out from particular data practices, or review of certain automated decisions.

To exercise a privacy right, contact:

[privacy@vertexworkforce.org]

Vertex Workforce may need to verify identity before acting on a request.

Authorized agents may submit requests where permitted by law and subject to appropriate authorization and verification.

Vertex Workforce will not unlawfully discriminate against individuals for exercising privacy rights.

29. Withdrawal of Consent

Where processing is based on consent, consent may generally be withdrawn at any time.

Withdrawal applies prospectively and does not normally affect processing that was lawful before withdrawal.

Certain services may become unavailable where the information is necessary to provide the requested service.

30. Complaints

Privacy concerns should first be submitted to:

Data Protection / Privacy Team
Vertex Workforce
Email: [privacy@vertexworkforce.org]

Individuals may also have the right to submit complaints to an applicable data-protection regulator or supervisory authority.

31. Children and Young Persons

Vertex Workforce Services are not intended to knowingly collect professional recruitment information from children.

If Vertex Workforce becomes aware that information was collected from a person below the applicable minimum age without legally required authorization, reasonable steps will be taken to address the information in accordance with applicable law.

32. Third-Party Websites

Links to third-party websites are provided for convenience.

Third parties maintain their own privacy practices, and users should review their policies before supplying information to them.

33. Corporate Transactions

If Vertex Workforce undergoes a merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction, relevant information may be disclosed to appropriate participants subject to applicable confidentiality and data-protection requirements.

34. Legal Disclosures

Vertex Workforce may disclose information where reasonably necessary to comply with law, respond to lawful legal process, protect rights or safety, investigate fraud, enforce agreements, prevent security incidents, or establish, exercise, or defend legal claims.

35. Changes to This Privacy Policy

This Policy may be updated periodically.

Material changes will be communicated in accordance with applicable law, and renewed consent will be obtained where legally required because of a new purpose or materially changed processing activity.

The “Last Updated” date will indicate the most recent revision.

36. Contact Us

For questions concerning this Policy or use of personal information:

Vertex Workforce [Legal Entity Name]
Website: www.vertexworkforce.org
Privacy Email: [privacy@vertexworkforce.org]
Data Protection Officer: Kashan Khan