Privacy Policy

1. Introduction

CODEGENIX LTD. ("we," "our," or "us"), Company Number: 16808123, registered at Academy House 11 Dunraven Place, Bridgend, Mid Glamorgan, United Kingdom, CF31 1JF, is committed to protecting your privacy and personal data in accordance with the UK GDPR (the retained EU General Data Protection Regulation, as it forms part of UK law), the Data Protection Act 2018, and - for personal data of users based in the European Union - the EU GDPR.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Vertex platform and services.

We are the data controller for the personal data we process.

2. Personal Data We Collect

This is everything we collect, when we collect it and why. We collect nothing else.

Cookies and browser storage are listed in our Cookie Policy. We do not use analytics or advertising cookies.

We do not buy personal data or receive it from data brokers. Our payment processor tells us whether a payment succeeded.

3. Lawful Basis and Purposes for Processing

We process your personal data only when we have a lawful basis:

3.1 Contractual Necessity

To provide our services, process transactions, and fulfill our contractual obligations to you.

3.2 Legitimate Interests

• Platform improvement and optimization
• Fraud prevention and security
• Customer support and relationship management
• Understanding how the service is used, from our own account and order records

3.3 Legal Obligations

To comply with legal requirements including accounting and anti-money laundering obligations.

3.4 Consent

Where we ask for your consent (for example to the Terms when you sign up), you may withdraw it at any time. We do not send marketing emails and we do not use non-essential cookies.

4. Data Sharing and Disclosure

We do not sell your personal data. We share data only as follows:

4.1 Service Providers

We engage trusted third-party processors for:

• Payment processor (to take card payments)
• Hosting provider (servers, database and file storage)
• Email delivery provider (sign-in codes, receipts and account emails)
• AI model provider (to suggest matching specialists from the brief you write)
• Messaging app provider (only for partners who link a messaging app for notifications)

Internal staff alerts: so a person on our team can act on them, we send ourselves alerts through a messaging service. They can contain:

• your name and email address when you sign up, and your email when you sign in
• the country and IP address you signed up or signed in from
• messages you send through the contact form
• the first part of a brief you submit, and the partners matched to it
• hires (partner first name, service and credits) and partner application events
• payment attempts and their outcome, with the amount and the last 4 digits of the card

All processors are bound by data processing agreements ensuring GDPR compliance.

4.2 Specialists

When you engage a specialist, relevant project information is shared to facilitate service delivery.

4.3 Legal Requirements

We may disclose data when required by law, to protect our rights, or in response to valid legal requests from authorities.

5. International Data Transfers

Your data is primarily hosted with infrastructure providers based in the United States. If you are located in the UK or the European Economic Area (EEA), this means your personal data is transferred outside the UK/EEA to be processed and stored. Where this happens, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK International Data Transfer Addendum where applicable
• Adequacy decisions by the European Commission or the UK government, where they apply
• Other legally recognized transfer mechanisms

6. Data Retention

We retain personal data only as long as necessary:

• Account data: While your account is active and up to 7 years after closure for legal obligations
• Transaction records: 7 years for accounting and legal purposes
• Technical logs: 90 days

Self-service deletion (Settings → Data & Privacy → Delete Account) deletes your account. If it has no purchases or paid projects, everything is erased at once. If it has financial history, your personal details (name, email, photo, sign-in methods) are erased immediately, while the transaction and invoice records and identity-verification records we are required to keep are retained under an anonymous account for the periods above (see also our AML Policy, section 8) and then deleted. You can export your own copy first.

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (HTTPS)
• Access controls and authentication
• Employee training on data protection
• Incident response procedures

In the event of a data breach affecting your rights, we will notify you and the UK Information Commissioner's Office (ICO) - or, where required, the relevant EU supervisory authority - within 72 hours as required by applicable data protection law.

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

8.1 Right of Access

Request a copy of your personal data we hold. You can download it yourself at any time from Settings → Data & Privacy → Export My Data.

8.2 Right to Rectification

Correct inaccurate or incomplete personal data.

8.3 Right to Erasure

Request deletion of your personal data (subject to legal retention requirements). You can delete your account yourself at any time from Settings → Data & Privacy → Delete Account (see section 6 for what this does to transaction records).

8.4 Right to Restriction

Request restriction of processing in certain circumstances.

8.5 Right to Data Portability

Receive your data in a structured, commonly used format and transmit it to another controller. The self-service export (Settings → Data & Privacy) is a JSON file.

8.6 Right to Object

Object to processing based on legitimate interests or for direct marketing.

8.7 Right to Withdraw Consent

Withdraw consent for processing based on consent (does not affect prior lawful processing).

For anything you cannot do yourself in Settings, contact us at support@vertex.boutique. We will respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local data protection supervisory authority if you are based in the EU.

9. Cookies and Tracking

We use only necessary cookies and a few items in your browser's local storage. For the full list, see our Cookie Policy. You can block or delete cookies in your browser settings, but you will not be able to sign in without them.

10. Marketing Communications

We do not send marketing emails. We email you only about your account, your payments and your engagements. If that changes, we will ask for your consent first, and every marketing email will have an unsubscribe link.

11. Children's Privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at support@vertex.boutique.

12. Automated Decision-Making

We may use automated systems to match clients with specialists. You have the right to request human review of automated decisions that significantly affect you.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you by email or prominent notice on our platform at least 30 days in advance. The "Last updated" date will be revised accordingly.