DRAFT — not yet published. This text is awaiting review by Vettarya and a qualified UK data-protection adviser. Items marked [LEGAL REVIEW] must be confirmed before use.
Privacy Policy — United Kingdom
Applies to visitors and business enquiries from the United Kingdom. Last updated: [date of approval].
1. Who we are
Vettarya is a technology recruitment consultancy based in Brazil, operated by 55.197.231 YARA MEDEIROS DE MELO OLIVEIRA - ME (CNPJ 55.197.231/0001-29). We are the data controller for the personal data described in this policy. Contact: yara@vettarya.com.
Vettarya is not established in the United Kingdom and is not a UK-registered company, employer of record, immigration adviser or staffing agency.
[LEGAL REVIEW] Whether Vettarya must appoint a UK representative under Article 27 UK GDPR, or qualifies for the exemption for occasional, low-risk processing. If a representative is appointed, their name and contact details must be added here.
2. What we collect
Consultation form (vettarya.com/uk): full name, work email, company name, and optionally company website, job title, the roles you are hiring for, your hiring timeline, any additional requirements you write, and whether you ticked the optional marketing box. If you arrived from a campaign link, we also record campaign parameters (UTM tags) and, only if you have accepted advertising cookies, the Google Ads click identifier (gclid).
Website assistant: the messages you type into the Vettarya AI Assistant, the language used, and — only if you agree during the conversation — your name, company, country, email and hiring needs. We store a one-way coded (hashed) version of your IP address and session identifier to prevent abuse; we do not store your raw IP address.
Cookies and similar technologies: see our Cookie Policy.
Please do not include sensitive information (such as health data) in free-text fields.
3. Why we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Replying to your enquiry and preparing a recruitment proposal | Steps taken at your request before entering into a contract (Art. 6(1)(b)) and/or our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Sending occasional recruitment insights (only if you ticked the box) | Consent (Art. 6(1)(a)). You can withdraw at any time. |
| Measuring website use and advertising results (Google Analytics, Google Ads) | Consent, collected through our cookie banner (PECR and Art. 6(1)(a)) |
| Operating the AI assistant and preventing abuse | Legitimate interests (Art. 6(1)(f)); consent before saving your contact details |
| Keeping records and defending legal claims | Legitimate interests (Art. 6(1)(f)) and legal obligations |
[LEGAL REVIEW] Confirm the chosen lawful bases and complete a short Legitimate Interests Assessment for the items relying on Art. 6(1)(f).
4. Who receives your data
- Lovable — website hosting and the managed database platform (Lovable Cloud) where form submissions and assistant conversations are stored. The underlying database infrastructure is provided by Supabase on Amazon Web Services servers located in the United States (Ohio region).
- OpenAI, via Lovable's AI service — processes assistant messages to generate replies. The request is sent without storage enabled on our side.
- Google — Google Analytics 4 and Google Ads, only after you accept the relevant cookies; and Google Fonts, which loads typefaces from Google servers when you open the site.
- WhatsApp (Meta) — only if you choose to contact us through WhatsApp.
We do not sell your personal data. We do not send your name, email or phone number to Google Analytics or Google Ads.
[LEGAL REVIEW] Confirm the data processing terms (DPA) in place with each provider and whether OpenAI retains data under Lovable's terms.
5. International transfers
Vettarya operates from Brazil, and our database is hosted in the United States. Your personal data will therefore be accessed from Brazil and stored in the United States.
[LEGAL REVIEW] The UK has not issued adequacy regulations for Brazil, and the UK–US Data Bridge only covers US organisations certified under it. A transfer risk assessment and an appropriate safeguard (for example the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) must be identified for each transfer, and this section updated accordingly.
6. How long we keep data
- Assistant conversations that did not result in a saved contact are deleted automatically after 90 days.
- Consultation enquiries are kept while we discuss and deliver our services, and then for [period to be defined].
- Marketing preferences are kept until you withdraw consent.
[LEGAL REVIEW] Define the retention period for consultation enquiries and commercial records.
7. Your rights
Under UK data protection law you have the right to access, correct, delete, restrict or object to the use of your personal data, to data portability, and to withdraw consent at any time. To exercise any right, email yara@vettarya.com. We will respond within one month.
You can also complain to the UK Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113. We would appreciate the chance to address your concerns first.
8. Security
Access to stored enquiries is restricted to authorised Vettarya administrators through authenticated accounts, and database access rules prevent the public from reading submissions.
9. Brazilian visitors
Our Portuguese-language policy, based on Brazil's LGPD, remains available at vettarya.com/privacidade.