How Vitae AI Ltd handles the rights, obligations, and disclosures that come with EU and UK data protection law. Plain language, no legalese where it isn’t needed.
Last updated · 25 September 2026
Our customer (the recruiter or employer using Vitae) is the controller of candidate data they upload or generate. Vitae acts as the processor, handling that data only on the customer’s lawful instructions and under our Data Processing Addendum (DPA).
For the marketing site, account signup, demo bookings, support, and direct communications, Vitae is the controller. This is covered in our Privacy Notice.
To exercise any of these rights, submit your request through our Trust Centre. We respond within one month, extendable by two further months for complex requests. If you are a candidate whose data sits inside a customer’s Vitae workspace, please contact that customer directly - we will assist them in responding.
We tell you how your data is used in our Privacy Notice and at the point of collection. No hidden processing.
You can request a copy of the personal data we hold about you and information about how we use it.
If anything we hold is inaccurate or incomplete, you can ask us to correct it.
Also known as the right to be forgotten. You can ask us to delete your data, subject to limited legal exceptions.
You can ask us to limit what we do with your data while we consider an objection or correct an inaccuracy.
You can ask for your data in a portable, machine-readable format and have it transmitted to another controller.
You can object to processing based on legitimate interests, including direct marketing. We will stop unless we have an overriding lawful ground.
You will not be subject to a decision based solely on automated processing that produces legal or similarly significant effects without a human in the loop.
Vitae is headquartered in the United Kingdom. Some of our sub-processors are based outside the UK and EEA, notably the United States. Where we transfer personal data internationally we rely on:
We notify customers in advance of any change and publish the current list in our Trust Centre.
Tools you connect with your own account are not on this list. That includes your email, calendar, CRM, ATS, job boards, and ad accounts. Your own agreement with each one covers that data.
In the event of a confirmed personal data breach, Vitae will:
Vitae has appointed an internal Data Protection Lead. Submit data protection requests through our Trust Centre. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or the supervisory authority in your EU member state.
Request the documents your privacy team needs through our Trust Centre.