Privacy policy

What we collect

What the portal holds depends on how you use it. It may include:

• Identity and contact details: your name, email address, the firm you work for, your title, where you are based and, if you give them, your phone number and the time zone you work in.
• Your professional history and track record: CVs, factsheets, strategy notes and track-record documents you upload, and what we read from them, such as the firms you have worked at, the books you have run and their figures (for example returns, Sharpe ratio, drawdown and assets under management).
• What you tell us: corrections and confirmations you make on How we read you, your answers to our questionnaires, what you would consider in a next role or an allocation, and the visibility settings you choose.
• Approvals and introductions: when you approve an introduction we record the firms you approve, the name you type, the signature you draw, the date and time, and the IP address and browser you used, so there is a reliable record of what you agreed to. We also record introductions you decline.
• Calls: times you offer or accept for calls arranged through the portal, and any feedback you give after a call.
• Connections you choose to make: if you connect a Slack, Google Chat or Microsoft Teams channel on the Connections page, we hold the webhook address you paste (we treat it as a password and show you only its last four characters), which updates you chose, and a log of each update we posted or could not post. If you connect your Google Calendar, we hold the Google account address and the access Google gives us, which lets us see only when you are free or busy (free/busy), never what your events are or who is in them. We use it only to suggest call times that suit you. We never read your email.
• Your account and security: your login, the fact that you have set up two-step sign-in (we do not hold your authenticator's codes), when you signed in, your acceptance of these documents (with the version, date, IP address and browser), and your email notification setting.
• How you use the portal: the pages you open and the profiles you view in the portal, so Vexis can follow up.
• Download marks: when you download a document the portal watermarks, we record who downloaded it, what and when, with a hidden mark in the copy, so a copy that is passed on can be traced.
• Cookies: a small number of strictly necessary cookies, described in our cookie notice.

Much of what the portal shows you about yourself was gathered by Vexis before you were invited, from conversations with you, from documents you sent us and from public professional sources such as LinkedIn and firm websites.

Why we use it, and our lawful bases

• To run your account and the portal, including signing you in securely and sending you emails when something needs you: necessary for the contract between us (these terms), and our legitimate interest in keeping the portal secure.
• To find and discuss suitable roles, candidates, teams or allocations with you: our legitimate interests in running a recruitment and capital-introduction business, balanced against yours. You can object at any time (see Your rights).
• To introduce you, by name, to a firm: only with your consent, given by approving and signing for that firm. You can withdraw consent for future introductions at any time; it does not undo an introduction already made.
• To keep records of approvals, acceptances and downloads: our legitimate interest in being able to show what was agreed and to protect confidential material, and to meet our legal obligations.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means alone. We may use software, including AI tools, to help us read documents you upload and keep your record accurate; a person at Vexis remains responsible for what is done with it.

Who sees it

• Firms you approve. A firm sees your name only after you approve and sign for that specific firm. Before that, a firm may see an anonymised profile that does not name you or your employers. Your current employer is never shown your profile through the portal.
• The other side of a capital introduction. A team's name and material are shown to an allocator only after the team approves the introduction; an allocator's name is shown to a team when the allocator asks to meet them.
• Vexis's consultants, who work with you, and no one else at Vexis without a need to.
• Our service providers, who process data on our behalf under contract and only on our instructions: Supabase (database, file storage and sign-in, hosted in the EU in Ireland), Vercel (hosting of the portal, run from Dublin), Google (email and calendar invitations for calls), and Anthropic (AI reading of documents you upload).
• Channels you connect. When you connect Slack, Google Chat or Microsoft Teams, we post short updates (with no figures and no names before the introduction allows them) to that channel, so Slack, Google or Microsoft receive them as your provider, under your own agreement with them, and anyone in that channel can read them. Disconnecting stops the posts straight away.
• Others where the law requires it, such as a regulator, a court or the police, or a professional adviser of ours under a duty of confidence.

International transfers

Our main database and hosting are in the EU (Ireland), which the UK recognises as giving adequate protection. Some of our providers are based in, or may access data from, the United States or elsewhere. Where personal data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or on the UK International Data Transfer Agreement or Addendum, with supplementary measures where needed. Ask us for details.

How long we keep it

We keep your record while we are working with you and for up to 2 years after our last contact, then delete or anonymise it, so that we can deal with any questions about introductions we made. Records of approvals, introductions, acceptances and downloads are kept for 6 years, the period in which a claim can be brought, so we can show what was agreed. Sign-in records are kept for 12 months after an account is closed. Closing your account switches off your login straight away; it does not on its own delete your data, and we will talk to you about what you would like done with it.

How we keep it safe

Every portal login needs two-step sign-in. A login can see only its own record and the introductions made to it, never anything else in Vexis's system. Sessions end after 12 hours. Data is encrypted in transit, access within Vexis is limited to the people who need it, and documents shared with you are watermarked.

Your rights

Under UK data protection law you have the right to:

• Access your data. Download my data, in the account menu, gives you a copy of what the portal shows you about yourself. Ask us for anything else we hold.
• Correct it. Use Correct on How we read you, or tell your Vexis consultant.
• Erase it, or restrict how we use it. Close my account, in the account menu, tells Vexis you want to stop; then ask us to delete or restrict what we hold, and we will do so unless the law lets or requires us to keep it.
• Object to our use of it on the basis of legitimate interests, including being contacted about opportunities.
• Withdraw consent to future introductions.
• Data portability, where the law gives it: Download my data is in a common machine-readable format.

We answer requests within one month. If you are unhappy with how we have handled your data, please tell us first; you can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Contact us

Email hello@vexisglobal.com, write to us at 12 Adshead Close, Manchester, M22 9RR, or speak to your Vexis consultant. Our data protection lead is Connor Akers, our founder.

Changes

If we change this policy in a way that matters, we will update the date above and ask you to read it again the next time you sign in.