Privacy Notice
Who we are
Veridex (a trading name of Antal AI Recruit Ltd) (“AIR”, “we”, “us”) is the controller of the personal data described in this notice. We are a recruitment firm placing candidates in permanent and contract technology and digital roles.
Registered office: 51 Welbeck Street, London W1G 9HL
Company number: 17229532
Contact for data-protection queries: privacy@veridexrecruitment.com (or by post to the registered office above, marked for the attention of Data Protection).
Data protection officer: none appointed. DPO and EU/UK representative requirements are assessed under the Antal International group data-protection framework.
The personal data we process
Identity and contact details; CV and work history; qualifications and professional-register membership; right-to-work documents; salary/day-rate expectations and current package; references; and, for contract placements, payment/tax details (bank, NI number, PAYE starter information, PSC/umbrella details). We also process data we source from public and third-party platforms (see section 3).
Special-category and criminal-conviction data are processed only where necessary and with an appropriate lawful condition and policy document.
Where we get your data
- Directly from you (registration, CV, correspondence).
- From job boards and CV databases where you have posted your CV or applied (e.g. Reed, Indeed, CV-Library).
- From professional networking and developer platforms where your profile is publicly available (e.g. LinkedIn, GitHub, Stack Overflow).
Why we process it, and our lawful bases
AI-assisted sourcing and how decisions are made
We use AI-assisted tools, including our “CV Sifter”, to help source and score candidates against a role’s requirements.
A human reviews the CV Sifter scoring and reads the CVs before any outreach; the human decides who to contact and makes contact. There is no automated rejection and no automated decision-making.
Because a human reviews the scoring and the CVs and makes the contact decision, the CV Sifter operates as decision-support, and our processing does not constitute a significant decision based solely on automated processing (that is, one taken with no meaningful human involvement) within the meaning of Articles 22A to 22D UK GDPR (which replaced Article 22 from 5 February 2026). You are not rejected by an algorithm.
EU AI Act. Where we process the data of candidates located in the EEA (including for placements in DACH and Benelux markets), automated CV-screening systems can be high-risk AI systems under Annex III of the EU AI Act. Although AIR is UK-based, the EU AI Act can apply to a UK provider/deployer whose system outputs are used in the EU, so we treat these obligations as likely engaged, not out of scope. Deployer obligations apply from 2 August 2026. (A “Digital Omnibus” amendment to defer those obligations to 2 December 2027 was provisionally agreed on 7 May 2026 but has not been formally adopted or published in the Official Journal; until it is, 2 August 2026 remains the operative date, so we plan to do it.) These obligations include transparency to affected persons and meaningful human oversight, reflected in the design described above.
International transfers
Where we transfer personal data outside the UK (e.g. to US-based tooling vendors, or for US-market placements in Year 2), we rely on an appropriate safeguard: UK adequacy regulations, the UK Addendum to the EU SCCs, or the UK Extension to the EU–US Data Privacy Framework.
How long we keep it
We keep your data only as long as we need it, then delete or anonymise it. Our standard periods are:
- Active candidates (in process with us): for the duration of our engagement and 2 years after our last meaningful contact, then reviewed.
- Talent bench (kept for future roles): 2 years from last contact, then deleted or re-confirmed with you.
- Right-to-work records: kept for the statutory period (typically the duration of any assignment plus 2 years).
- Tax and payroll records (contract placements): 6 years, as required by HMRC.
- Suppression / ‘do not contact’ list: kept for as long as needed to honour your opt-out.
Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw any consent you have given. To exercise these, contact us at privacy@veridexrecruitment.com. You also have an absolute right to object to direct marketing at any time; if you do, we will stop and keep you on our suppression list so we do not contact you again for marketing. We respond to requests within one month.
Electronic communications and marketing
When we contact you about specific live roles that match your profile, we do so to provide our recruitment service (our legitimate interests).
Separately, where we send you general updates or market other opportunities beyond a role you have applied for, that is direct marketing. We comply with the Privacy and Electronic Communications Regulations 2003 (PECR): we only send electronic marketing where we are permitted to, and every message has an easy way to opt out.
You can object to direct marketing at any time and we will stop. Where we make marketing calls, we screen against the TPS/CTPS where applicable.
Complaints
If you are in the UK you may complain to the Information Commissioner’s Office (ICO), ico.org.uk. If you are in the EEA, you may complain to your local supervisory authority.
Changes
We will update this notice as our processing changes and will tell you about material changes.