In short. Rekro is software that recruitment agencies use to run their work, with a portal and a mobile app for the candidates, contractors and clients they work with.
- If an agency holds information about you in Rekro, that agency is responsible for it and we look after it on the agency’s instructions. Your agency is the first place to go with a question or a request.
- We are responsible for a smaller set of information: enquiries through this website, the sign-in and security information that keeps accounts safe, and the technical information we need to run the service.
- We do not sell personal information, we do not show advertising, and we do not use the information in Rekro to train AI models.
- Photographs taken for an identity check are looked at by a person at your agency. Nothing compares your face with your document automatically.
1. Who we are and what this policy covers
Rekro is provided by VirtuPay Limited, a company registered in England and Wales with company number 15260775. Our registered office is 19 Ullswater Crescent, London, England, SW15 3RG. In this policy “we” and “us” mean VirtuPay Limited.
This policy covers the Rekro website, the Rekro web application (including the candidate and client portals) and the Rekro mobile app. It explains how personal information is handled under the UK General Data Protection Regulation and the Data Protection Act 2018.
You can contact us about anything in this policy at privacy@virtupay.co.uk or by post at our registered office.
2. Who is responsible for your information
There are two situations, and which one applies decides who you should contact.
Information a recruitment agency holds about you
Agencies use Rekro to keep their recruitment records: candidate profiles and CVs, documents and identity evidence, notes, applications and placements, timesheets and invoices, and the details of the people they deal with at their clients. The agency decides what to collect, why, and how long to keep it. In data protection law the agency is the controller of that information and we are its processor: we store and process it for the agency, on the agency’s instructions, under our Data Processing Addendum.
If this is your situation, your agency’s own privacy notice tells you how it uses your information, and your agency is the right place to send a question or a request. The agency’s name is shown on the page where you sign in, in the mobile app, and in the invitation email you were sent. If you write to us instead, we will pass your request to your agency and tell you that we have.
Information we are responsible for
We are the controller of the information we collect for our own purposes: enquiries made through this website, the sign-in and security information for every account, the technical and diagnostic information we need to run and protect the service, and our dealings with the agencies that are our customers. Sections 4 and 5 describe it.
3. Information agencies hold in Rekro
What an agency records depends on the agency and on the features it uses. The table shows what Rekro is designed to hold.
| About | Information |
|---|---|
| Candidates and contractors | Name, contact details and addresses. Date of birth, nationality and right to work status, where recorded. CV, work history, education, skills, languages and certifications. Current and expected pay. Documents. Notes made by the agency. Applications, placements and the terms of an assignment. Timesheets and the notes on them. For contractors who are invoiced for: the billing name, address and VAT number they give, and the invoices raised. Identity and compliance evidence (section 6). A marketing preference. A grade the agency may give for its own use. Any additional fields the agency has defined. |
| Contacts at an agency’s clients | Name, job title, department and work contact details. A link to a professional profile, where recorded. Contact preferences. Notes made by the agency. Timesheet approvals and the invoices made available to them. |
| People who work for an agency | Name, work email, phone number and profile picture. Role and permissions. A record of the actions they take in the workspace. Conversations with the AI assistant, where the agency has switched it on. |
This information comes from you, when you fill in a form, upload a document or submit a timesheet; from your agency, which may have received it from you, from your CV, from a referee or from one of its clients; and from your use of the service.
Rekro does not ask for information about your health, ethnic origin, religion, trade union membership, sexual orientation or criminal record, and has no fields for them. A CV, a note, a document or a field an agency has added can nevertheless contain whatever you or your agency chose to put there, and an identity document shows your nationality and your photograph. Your agency is responsible for having a lawful reason to hold anything of that kind.
4. Information we collect for our own purposes
If you contact us through this website
When you ask for a demonstration we collect the details you put in the form: your name, your work email address, the name of your agency and anything you choose to tell us about your team and what you are looking for. The form sends those details to our team by email. They are not added to a marketing database.
If you have an account
Whether you are a member of an agency’s team or a portal user, we hold your email address, your name, and the information needed to sign you in and keep your account safe: your password (which is stored by our authentication provider in a protected form that we cannot read), any passkey you register, your Google account identifier if you choose to sign in with Google, your profile picture if you add one, and a record of your sign-ins and of the security codes sent to you.
Technical, security and diagnostic information
- Connection data. Like any online service, our systems and our hosting providers process your IP address, the type of device and browser you use, and the time of each request, in order to deliver pages, apply rate limits and detect misuse.
- Error reports. When something goes wrong we receive a technical report: the error, the page it happened on with any access codes removed from the address, and the internal identifiers of the account and workspace involved. We have switched off the collection of form contents, request bodies, cookies and headers, and we do not record your screen or your session.
- Usage and performance statistics. We measure which pages are visited and how quickly they load, using a service that does not use cookies to do so and does not follow you from one website to another. On the public website only, and only if you agree to it, we can also use Google Analytics. Section 15 says more about both.
If you are a customer or deal with us on one’s behalf
We hold the names and work contact details of the people we deal with at our customers, our correspondence with them, including support requests, and the records of our contracts and invoices.
5. What we use information for, and our legal bases
For the information we are responsible for, the law requires us to have a legal basis for each use. Where we rely on legitimate interests, we have considered whether those interests are outweighed by yours, and you have the right to object (section 13).
| What we do | Our legal basis |
|---|---|
| Reply to an enquiry and arrange a demonstration | Our legitimate interest in responding to people who ask about our product, and taking steps at your request before a contract |
| Create accounts, sign people in, and send security codes and invitations | Performing our contract with you or with the agency you belong to, and our legitimate interest in running a secure service |
| Protect the service: rate limits, detecting misuse, investigating incidents, keeping an audit trail | Our legitimate interest, and that of our customers, in keeping the service and the information in it secure |
| Find and fix faults, and measure and improve performance | Our legitimate interest in providing a reliable service |
| Measure how the public website is used with Google Analytics | Your consent. It is not used unless you have agreed, and you can withdraw your agreement at any time |
| Provide support and manage our relationship with customers | Performing our contract with the customer, and our legitimate interest in running our business |
| Keep business, accounting and tax records | Legal obligation |
| Establish, bring or defend legal claims, and respond to lawful requests from courts and regulators | Legal obligation, and our legitimate interest in protecting our legal position |
Where we process information on an agency’s behalf, the agency decides the legal basis and its privacy notice explains it.
We do not send marketing emails to candidates, contractors or client contacts. The emails the service sends, such as invitations, security codes, timesheet requests and invoices, are sent because they are needed for the work your agency is doing with you, and are sent on your agency’s behalf. If you have asked us about Rekro for your own business we may reply and follow up about that enquiry, and you can ask us to stop at any time.
6. Identity documents and photographs
Agencies often have to check who someone is, and whether they have the right to work, before placing them. Rekro gives an agency a way to collect the evidence for that check and to record the decision of the person who reviews it. This section applies only if your agency has asked you for that evidence.
What is collected
- Still photographs or uploaded copies of the documents your agency asks for, such as a passport or a proof of address.
- Where your agency asks for it, a still photograph of your face.
- A right to work share code, if you provide one.
- The details a reviewer records from your document: the type of document, the country that issued it, its expiry date, and your name and date of birth as they appear on it.
Your choice
Before your camera is used you are told what will happen and asked for your consent, and the time you gave it is recorded. You can say no. There is another way to complete the request, checked by a person, and your agency can tell you what it involves.
What does not happen
- Nothing compares your face with your document automatically. A person at your agency looks at the photographs and decides.
- No biometric template, measurement or “faceprint” is created or stored.
- No video is recorded, and there is no liveness test.
- Your photographs are not sent to an identity verification company.
- No decision is made about you by a machine.
While you take a photograph, a guide on the screen helps you position the document or your face. That guide runs entirely on your own phone or in your own browser. All it produces is the position of a face in the picture, and nothing from it is stored or sent anywhere.
Who sees it, and for how long
Identity evidence is classed as confidential inside Rekro. Only people at your agency whose role allows it can open it, they must confirm a code sent to their email before they can, and each viewing is logged.
Your agency decides how long to keep the evidence, and the law may require it to keep some of it for a set period: for a right to work check in the United Kingdom, that is generally for as long as the engagement lasts and for two years afterwards. Rekro works out a retention date for the agency once a placement has ended and gives the agency the means to destroy the evidence when that date is reached.
To withdraw your consent, or to ask for a photograph to be deleted, contact your agency. Withdrawing consent does not affect what was done before you withdrew it, and your agency will tell you if the law requires it to keep anything.
7. AI features
Rekro has two features that use an AI language model supplied by a third party.
- The assistant, Simon. It is switched off unless an agency switches it on. When a member of the agency’s team asks it something, the question, the conversation and the content of the records needed to answer it are sent to the model provider, and the conversation is stored in the agency’s workspace. Simon can only reach what the person using it is permitted to see.
- Reading a CV. When a member of an agency’s team uploads a CV to be read into a candidate record, the CV is sent to the model provider, which returns the details it finds. A person reviews those details before they are saved.
The model provider is named in our list of sub-processors. It processes this content to return a result to us, and our terms with it do not allow it to use the content to train its models. It states that it deletes what it receives and what it returns within 30 days, unless it has to keep something for longer to enforce its usage policies or to comply with the law.
AI output can be wrong. Rekro is designed so that a person reviews it, and so that people, not software, make decisions about candidates.
8. The mobile app
The Rekro mobile app is for candidates, contractors and client contacts who have been given an account by an agency.
Permissions
- Camera. Used only when you choose to take a photograph in the app: one your agency has asked for, a picture for your profile, or something you want to attach.
- Photos and files. Used only when you choose a file to upload. The app does not browse your library.
- Notifications. If you allow them, we register your device so that you can be told about things like a new message or a change to a timesheet.
- Face ID, fingerprint or device passcode. If you turn on the app lock, the check is done by your device. We never receive your biometric data, and the lock is not used to identify you to us.
The app does not ask for your location, your contacts or your advertising identifier, and it contains no advertising or tracking software.
What is kept on your device
So that the app opens quickly and can show you what you have already seen when you have no connection, it keeps on your device your sign-in token, held in the secure storage your phone provides; a copy of information you have viewed, such as timesheets, applications and notifications, for up to 30 days; and the documents you have opened. Signing out removes them.
Notifications and updates
To deliver a notification we store a token that identifies your installation of the app, with the type of device and the app version, and we send the notification through Google’s Firebase Cloud Messaging service, which passes it to Apple’s notification service on an iPhone. Google’s messaging software in the app creates an identifier for the installation and reports basic details of the device, such as its model and operating system version. We remove the token from our systems when you sign out.
The app also checks with our update provider for a newer version. That request carries your phone’s operating system and a random token for the installation; it does not carry your name, your account or a device identifier.
Deleting your account
In the app, go to your profile and choose “Delete your account”. Your sign-in is switched off straight away and your agency is told. Because the records about you belong to your agency, and the law may require it to keep some of them, the agency then decides what is deleted and will tell you. You can also ask your agency directly, or write to us at privacy@virtupay.co.uk and we will pass your request on.
10. Where information is held and international transfers
The Rekro database and the documents stored in it are held in the United Kingdom. The servers that run the application’s back end are in the Netherlands, and error reports are held in Germany. The United Kingdom treats the countries of the European Economic Area as providing adequate protection for personal data.
Other providers process information in the United States or, in some cases, in other countries where they operate: the services we use for sign-in, for delivering web pages, for sending email and keeping a record of what was sent, for the AI features, for mobile notifications, for app updates and, where you have agreed to it, for measuring use of the public website. When personal information is transferred outside the United Kingdom to a country that is not covered by UK adequacy regulations, we rely on a safeguard recognised by UK law: the provider’s certification under the UK Extension to the EU–US Data Privacy Framework, or the International Data Transfer Addendum issued by the Information Commissioner, which forms part of our contract with the provider.
Our list of sub-processors shows where each provider processes information. You can ask us for more detail about the safeguards at privacy@virtupay.co.uk.
11. How long information is kept
Information an agency holds about you
Your agency decides how long to keep its records, and can tell you. Rekro gives agencies a review date for each candidate, which by default is two years after the last meaningful contact and which the agency can change, and the tools to anonymise or erase a record when that date passes. Some records have to be kept for longer by law: an invoice that has been issued keeps the details that were on it, and the evidence for a right to work check is kept for the period described in section 6. If you use a candidate portal, the “Your data” page shows your current review date.
When an agency stops using Rekro, we delete its records from our live systems within 90 days of the end of its agreement with us, after giving it the opportunity to take a copy.
Information we are responsible for
| Information | How long we keep it |
|---|---|
| Enquiries through this website | While we are in discussion with you, and for up to two years after our last contact |
| Account and sign-in information | For as long as you have an account. When a member of an agency’s team is removed from their last workspace, their sign-in identity is deleted |
| Security codes and expired access tokens | Deleted within seven days of expiring |
| Error reports | Up to 90 days |
| The audit trail of actions in a workspace | For as long as the workspace exists |
| Support correspondence | For up to two years after the matter is closed |
| Contracts, invoices and accounting records | Six years after the end of the financial year they relate to |
| Information kept on your phone by the mobile app | The copy of what you have viewed: up to 30 days. Documents you have opened: until you sign out. Signing out removes both |
Information may be kept for longer where we need it to deal with a dispute or where the law requires it. Deleted information can remain in backups for a limited time before it is overwritten.
12. How information is protected
We protect the information in Rekro with measures that include:
- encrypting information in transit, and holding it with hosting providers that encrypt it at rest;
- keeping each agency’s information separate, so that one agency’s users cannot reach another’s;
- roles and permissions that an agency controls, with access denied unless it has been granted;
- storing documents privately, never at a public address, and requiring an emailed code before a confidential document can be opened;
- a code sent by email when someone signs in from a device we have not seen before, and support for passkeys;
- single-use, time-limited links for invitations and other sensitive actions;
- limits on how often sensitive requests can be made, to resist automated attacks;
- a record of who did what in a workspace; and
- restricting our own staff’s access to what they need to run and support the service.
No system is perfectly secure. If a breach of security is likely to put your rights at risk, we, or your agency where it is responsible for the information, will tell you and the regulator as the law requires. You can help by keeping your password to yourself and by locking your phone.
13. Your rights
Data protection law gives you the right to:
- be told how your information is used, which is the purpose of this policy;
- ask for a copy of the information held about you;
- have inaccurate information corrected;
- have information erased, in some circumstances;
- have the use of your information restricted, in some circumstances;
- object to its use, where the use is based on legitimate interests, and at any time to its use for direct marketing;
- receive information you provided in a portable form, in some circumstances; and
- withdraw your consent at any time, where consent is the basis for the use.
How to use them
For information your agency holds, contact your agency. If you use a candidate portal, the “Your data” page lets you change your marketing preference and send your agency a request to remove your details, and the mobile app lets you delete your account (section 8). If you contact us, we will pass your request to your agency.
For information we are responsible for, write to privacy@virtupay.co.uk. We will respond within one month. We do not charge for this. We may need to ask for information to confirm who you are.
14. Automated decisions
We do not make decisions about you that are based solely on automated processing and that have a legal or similarly significant effect on you. Rekro does not score, rank or match candidates, and it does not approve or reject anyone.
Some routine steps are automatic: for example, a document is marked as expired when its expiry date passes, and an agency can set up rules that send a message or update a record when something happens. If you want to know how your agency uses those rules, ask your agency.
16. Children
Rekro is a tool for professional recruitment. It is not directed at children, agencies must not invite anyone under 16 to use a portal, and we do not knowingly collect information from children for our own purposes. If you believe a child has been given an account, tell us at privacy@virtupay.co.uk.
17. Complaints
If you are unhappy with how your information has been handled, please tell us at privacy@virtupay.co.uk, or by post at our registered office, saying what has happened and what you would like us to do. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed, and tell you the outcome.
If your complaint is about information your agency is responsible for, we will tell you and, with your agreement, pass it to your agency, which has the same duty to deal with it.
You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data protection regulator, which generally expects you to have raised the matter with the organisation first. You can reach it at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
18. Changes to this policy
We will update this policy when what we do changes. The version number and effective date at the top of the page show which version is current. If a change is significant we will tell the owners of each agency’s workspace by email, or by a notice in the service, before it takes effect.
19. Contacting us
About privacy and data protection: privacy@virtupay.co.uk.
For help with the service: support@virtupay.co.uk.
By post: VirtuPay Limited, 19 Ullswater Crescent, London, England, SW15 3RG.