GDPR Compliance
Your data rights and how we ensure GDPR compliance across all our services.
Last updated: April 2026
GDPR Compliance Overview
The General Data Protection Regulation (GDPR) gives you important rights over your personal data. As a UK-based service, we are committed to full GDPR compliance and transparency in how we handle your information.
This page explains your rights and how to exercise them with Vantae.
Your Data Protection Rights
1. Right of Access (Article 15)
You have the right to know what personal data we hold about you and how we use it.
How to exercise: Contact us at hello@vantae.co.uk with your request.
Response time: Within 30 days (may be extended to 60 days for complex requests).
What you'll receive: A copy of your personal data and information about processing activities.
2. Right of Rectification (Article 16)
You can request correction of inaccurate or incomplete personal data.
How to exercise: Update your profile directly in your account settings, or contact us for data we cannot update ourselves.
Response time: Within 30 days.
3. Right of Erasure / "Right to be Forgotten" (Article 17)
You can request deletion of your personal data in certain circumstances.
How to exercise: Delete your account through settings, or contact us at hello@vantae.co.uk.
Response time: Within 30 days.
Limitations: We may retain some data for legal compliance, fraud prevention, or legitimate business purposes.
4. Right to Restrict Processing (Article 18)
You can request that we limit how we use your data while we resolve a dispute or verify accuracy.
How to exercise: Contact us at hello@vantae.co.uk with your specific request.
5. Right to Data Portability (Article 20)
You can receive your personal data in a machine-readable format to transfer to another service.
How to exercise: Export your data through account settings, or request a comprehensive export via hello@vantae.co.uk.
Format: JSON or CSV format for structured data; PDF for documents.
6. Right to Object (Article 21)
You can object to processing based on our legitimate interests or for direct marketing.
Marketing: Unsubscribe from marketing emails at any time using the unsubscribe link.
Other processing: Contact us at hello@vantae.co.uk to object to specific processing activities.
Automated Decision Making
We use AI to analyse CVs and provide recommendations. This automated processing:
- Does not make decisions that significantly affect you legally or similarly
- Provides suggestions that you can accept, modify, or reject
- Can be reviewed by our support team upon request
You have the right to request human review of any AI-generated recommendations.
Data Processing Lawful Basis
We process your personal data based on the following lawful bases under GDPR Article 6:
- Contract (6.1.b): To provide CV services you've subscribed to
- Legitimate Interest (6.1.f): To improve our services, prevent fraud, and provide customer support
- Consent (6.1.a): For marketing communications and non-essential features
- Legal Obligation (6.1.c): To comply with financial and tax regulations
Data Transfers Outside UK/EEA
Some of our service providers are located outside the UK/EEA. We ensure adequate protection through:
- Standard Contractual Clauses (SCCs): EU-approved contract terms
- Adequacy Decisions: For countries deemed adequate by the European Commission
- Additional Safeguards: Technical and organisational measures
Current international transfers include OpenAI (US) for AI processing and AWS (US) for cloud infrastructure.
Data Retention Periods
- Account Data: Retained while your account is active
- CV Content: Retained for 12 months after account deletion
- Payment Data: Retained for 7 years for tax purposes (legal requirement)
- Marketing Data: Retained until you unsubscribe or object
- Usage Analytics: Anonymised after 24 months
Making a Complaint
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with:
UK Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113
We encourage you to contact us first at hello@vantae.co.uk so we can try to resolve your concern directly.
Data Protection Contact
For any GDPR-related questions or to exercise your rights:
Vantae Data Protection Team
London, UK
We aim to respond to all data protection requests within 30 days.