Privacy Policy

VOCASO Privacy Policy


1. Introduction

1.1. We take your privacy very seriously and are committed to protecting your personal information. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint. This policy should be read together with any other privacy policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them. Our website is not intended for children (persons under 18), and we do not knowingly collect data or process data relating to children.

1.2. We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR).

1.3. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

1.4. Our website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

1.5. Please click here to download a PDF of this policy.

2. Key terms

2.1. The following key terms are used in this policy:

We, us, our: VOCASO Limited, a company registered in England and Wales with company number 13074637 having its registered office at Second Floor, 201 Haverstock Hill, Belsize Park, London, NW3 4QG

Our websites:

www.vocaso.com

www.talent.vocaso.com

Personal data:

Any information relating to an identified or identifiable individual

Data subject:

The individual who the personal data relates to

Member or Registered user:

A person who has a contract with us and/or is registered/has an account with us

3. Personal data we collect about you

3.1. The personal data we collect about you depends on the particular services we provide to you or request from us. We may collect and use the following personal data about you (as applicable):

  • Your name and contact information, including email address and telephone number.
  • Information to check and verify your identity, e.g., your date of birth.
  • Your gender if you choose to give it to us.
  • Your nationality.
  • Details of your work permit or visa.
  • Location data.
  • Your billing information, transaction, and payment card information.
  • Your personal or professional interests.
  • Your academic history and qualifications.
  • Your career history, including references and details for your referees (if any).
  • Your current employment details, including the details of your current employer/business, job title(s), salary, and benefit entitlement.
  • Your professional online presence, e.g., LinkedIn profile.
  • Your contact history, purchase history and saved items.
  • Information from accounts you link to us e.g., Facebook.
  • Information about how you use our website, IT, communication, and other systems.
  • Your responses to surveys.

3.2. We collect and use this personal data for the purposes described in the section 'How and why we use your personal data' below. If you do not provide personal data we ask for, it may delay or prevent us from providing services to you.

4. How your personal data is collected

We collect most of this personal data directly from you—in person, by telephone, text, or email and/or via our website. However, we may also collect information:

4.1. From publicly accessible sources, e.g., Companies House, LinkedIn, and websites.

4.2. directly from a third party, e.g.:

  • sanctions screening providers.
  • credit reference agencies.
  • customer due diligence providers.
  • device data and technical data from the following parties:
  • analytics providers such as Google and Apple based outside the UK.
  • search information providers such as Google based inside and outside the UK.
  • identity and contact data from social media services as part of our customer verification and anti-fraud measures.
  • information from other users of the website or our services or third parties if we receive any complaints about you (for example of harassment or sending inappropriate messages).
  • Log in authentication for assisting in authenticating you, such as Google login.
  • LinkedIn and profile links: If you choose to include your LinkedIn URL in your profile, other members may click through to LinkedIn. Use of LinkedIn is governed by LinkedIn's own terms and privacy policy.
  • Community posts and comments: Content you post in the members-only area may be visible to other authenticated members. We may moderate or remove content that breaches our House Rules.

4.3. From cookies on our website—for more information on our use of cookies, please see our cookie policy which is available on our website.

4.4. Via our IT systems, e.g., through automated monitoring of our websites and other technical systems, such as our computer networks and connections, communications systems, email, and instant messaging systems.

5. How and why we use your personal data

5.1. Under data protection law, we can only use your personal data if we have a proper reason, e.g.:

  • Where you have given consent.
  • To comply with our legal and regulatory obligations.
  • For the performance of a contract with you or to take steps at your request before entering a contract; or
  • For our legitimate interests or those of a third party.

5.2. A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests.

5.3. We use your personal data for the purposes of providing our website to you, providing membership services to you and related activities.

5.4. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

5.5. The table below explains in more detail what we use your personal data for and why:

What we use your personal data for:

Our reasons

Considering a Membership application or Registration to access our job or opportunity listings:

To decide if an application for membership or registration should be approved or not.

Providing services to you:

To perform our contract with you or to take steps at your request before entering into a contract.

Create and manage your account with us:

To perform our contract with you or to take steps at your request before entering a contract.

Customise our website and its content to your preferences based on a record of your selected preferences or on your use of our website.:

Depending on the circumstances - your consent as gathered e.g., by the separate cookies tool on our website.

Retaining and evaluating information on your recent visits to our website and how you move around different sections of our website for analytics purposes to understand how people use our website so that we can make it more intuitive or to check our website is working as intended:

Where we are not required to obtain your consent and do not do so, for our legitimate interests, i.e., so we can deliver a good service to you. If you have provided such a consent, you may withdraw it at any time by contacting us (see 'How to contact us' below) (this will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn).

Preventing and detecting fraud against you or us: For our legitimate interest, i.e., to minimise fraud that could be damaging for you and/or us.

To enforce legal rights or defend or undertake legal proceedings:

Depending on the circumstances - to comply with our legal and regulatory obligations - in other cases, for our legitimate interests, i.e., to protect our business, interests, and rights.

Gathering and providing information required by or relating to audits, enquiries, or investigations by regulatory bodies:

To comply with our legal and regulatory obligations.

Ensuring business policies are adhered to, e.g., policies covering security and internet use:

For our legitimate interests, i.e., to make sure we are following our own internal procedures so we can deliver a good service to you.

Operational reasons, such as improving efficiency, training, and quality control:

For our legitimate interests, i.e., to be as efficient as we can so we can deliver the best service to you at the best price.Ensuring the confidentiality of commercially sensitive information.Depending on the circumstances - for our legitimate interests, i.e., to protect trade secrets and other commercially valuable information - to comply with our legal and regulatory obligations.


Purpose

Processing operation

Lawful basis relied on under the UK GDPR

Relevant categories of personal data


Communications with you not related to marketing, including about changes to our terms or policies or changes to the services or other important notices.Addressing and sending communications to you.Processing is necessary for compliance with a legal obligation to which we are subject.


Our legitimate interests so we can deliver a good service to you.


Consent.


Necessary for our legitimate interests (to keep records updated and to analyse how stakeholders use our Products / Services, to manage the Services and our website, to notify you of security concerns and issues and deal with complaints from others.


Performance of a contract with you.Your name, address and contact information, including email address and telephone number.


Your account details (username).


Profile.


To manage our relationship with you.Addressing and sending communications to you.Performance of a contract with you.


To deliver content and advertisements to you.Reviewing your data to see what might be appropriate for you.Our legitimate interests which are so we can deliver a good service to you and offer you Products and Services that may interest you.All data that we have.


To make recommendations to you about goods or services which may interest you.Addressing and sending communications to you.Consent.Name, email address, contact details, marketing preferences, and information about how you interact with our communications and services, such as email opens, clicks, website visits, and enquiries.


To measure and analyse the effectiveness of the advertising we serve you.Technical data we obtain from you.Our legitimate interests which are so we can deliver a good service to you and offer you Products and Services that may interest you.Technical data and your order and purchase activities.


Member Directory, Messaging & Community FeedSee section below for details


Purpose: Member Directory, Messaging & Community Feed

Processing:

  • Publish selected profile fields (e.g., name, headline, sectors, LinkedIn) in a members-only Directory so other authenticated members can discover and contact you.
  • Enable direct messages between members inside the platform.
  • Display member posts/comments in the community feed to other authenticated members; moderate where necessary.

Lawful basis:

  • Performance of a contract (to deliver membership/Premium features), and
  • Legitimate interests (to operate a curated exec-only community); you can manage Directory profile settings in Account → Profile & Privacy.

Data categories: Profile, contact (limited), role/sector, LinkedIn URL (optional), posts/comments, messaging metadata (not content, unless needed for moderation).

Recipients: Other authenticated VOCASO members (Directory/profile/feed visibility and DMs are not public).

  • If you upgrade to Premium, we publish selected profile information in a members-only Directory and enable member-to-member direct messaging. You can edit which profile fields appear in your profile settings. Premium includes Directory listing and messaging; to stop being listed or messaged, cancel Premium and these features will be disabled.

Use of WhatsApp

We may use WhatsApp to send updates, news, and information related to your membership. Participation in our WhatsApp broadcast service is optional and may only be available as part of certain premium plans or services. If you choose to join, we will collect and use your phone number solely to deliver these communications. Your number will not be shared publicly or with other members. WhatsApp may process your data according to its own privacy policy, which you can review at https://www.whatsapp.com/legal/privacy-policy. You may opt out or request removal from the broadcast list at any time, and we will promptly delete your number from our WhatsApp contact list.

6. How and why we use your personal data—sharing

See 'Who we share your personal data with' for further information on the steps we will take to protect your personal data where we need to share it with others.

Marketing

6.1. We will use your personal data to send you updates (by email, text message, telephone, or post) about our services, including exclusive offers, promotions or new services.

6.2. We have a legitimate interest in using your personal data for marketing purposes (see above 'How and why we use your personal data'). This means we do not usually need your consent to send you marketing information. If we change our marketing approach in the future so that consent is needed, we will ask for this separately and clearly.

6.3. You have the right to opt out of receiving marketing communications at any time by:

  • contacting us at hello@vocaso.com with the following message in the subject line 'Please remove me from all future marketing communications'.

6.4. We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

6.5. We will always treat your personal data with the utmost respect and never share it with other organisations for marketing purposes.

6.6. See 'Who we share your personal data with' for further information on the steps we will take to protect your personal data where we need to share it with others.

7. Who we share your personal data with

7.1. We routinely share personal data with:

  • Companies within the VOCASO group.
  • Third parties we use to help deliver our services to you, e.g., payment service providers.
  • Third parties we use to help us run our business, e.g., marketing agencies or website hosts.
  • A third party whose platform and website we use to securely store your personal data, i.e., Executives Place Ltd, a company registered in England and Wales with company number 7100165 having its registered office at Churchill House, 137-139 Brent Street, London, England, NW4 4DJ and trading as 'Not Actively Looking'; HubSpot, 2 Canal Park, Cambridge, MA 02141, USA, 888-482-7768; Wix.com Ltd / Wix.com Inc. / Wix.com, 500 Terry A Francois Blvd San Francisco, CA 94158, and JBoard Inc, 651 N Broad St, Suite 201, Middletown, Delaware, 19709, USA.
  • Our bank(s).
  • Other authenticated VOCASO members: If you opt in to Premium Directory & Messaging (or enable Directory visibility on your profile), selected profile fields will be visible to other members, and members may contact you via in-product messaging. Directory/profile/feed content is not public and remains inside the members-only area. You can change your visibility settings in your account at any time.

7.2. We only allow third parties to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you.

7.3. We will only share a member's personal data with a company who may be interested in engaging your services where you have given consent to such a disclosure.

7.4. We may share your name and contact details with third party providers of services where you have chosen to obtain more information about third party services from us such as for challenges, coaching and training. We will provide more information when you choose such a service.

7.5. We or the third parties mentioned above occasionally also share personal data with:

  • Our and their external auditors, e.g., in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations.
  • Our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations.
  • Law enforcement agencies, courts, tribunals, and regulatory bodies to comply with our legal and regulatory obligations.
  • Other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised, but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.

8. Who we share your personal data with—in more detail

8.1. The personal data will be securely stored by Executives Place Ltd., a company registered in England under company number 7100165 with its registered office at 137-139 Brent Street, London NW4 1DG, United Kingdom and trading as Not Actively Looking ('Not Actively Looking'). Not Actively Looking's services include the provision of a platform and a website that allows search firms to store contact details and professional information for the search firms' own candidates and clients. The storage is carried out under a written contract that includes safeguards for the rights and freedoms of data subjects.

9. Who we share your personal data with—further information

9.1. We may disclose your personal data to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request, if you have consented to this, to protect our rights and property and the rights, safety and property of others (provided we comply with data protection law).

9.2. If you would like more information about who we share our data with and why, please contact us (see 'How to contact us' below).

10. Where your personal data is held

10.1 Personal data may be held in electronic format and also in paper format at our offices and those of our third-party agencies, service providers, representatives and agents as described above (see above: 'Who we share your personal data with').

10.2 Some of these third parties may be based outside the UK. For more information, including on how we safeguard your personal data when this happens, see below: 'Transferring your personal data out of the UK.

10.3 Transferring your personal data out of the UK

10.3.1 Some of our external third-party service providers are based outside the UK, specifically in the United States. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented;

10.3.2 We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government;

10.3.3 Where we use certain service providers based in the United States or other non-adequate jurisdictions, we use specific contract clauses approved for use in the UK (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) which give personal data the same protection it has in the UK.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

11. How long your personal data will be kept

11.1 We shall not retain your personal data for longer than is strictly necessary for the purposes for which it was collected. We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

11.1 The specific retention periods for your data are determined by the following criteria:

11.1.1 Member Account Data: If you have an active contract or account with us, we retain your data for the duration of your membership and for a period of 7 years thereafter. This period is based on the statutory limitation period for bringing breach of contract claims under the Limitation Act 1980 and to comply with our tax and accounting obligations under UK law.

11.1.2 Unsuccessful Applicants: Where an application for membership is not accepted, we shall retain your data for a maximum of 6 months to address any queries or complaints regarding the application process.

11.1.3 Marketing Data: We will retain your contact details for marketing purposes until such time as you opt out or withdraw your consent. We will conduct a review of our marketing lists every 24 months to ensure data remains accurate and relevant.

11.1.4 Transactional Data: Financial records and details of payments made by you will be retained for 6 years from the end of the financial year in which the transaction occurred, in accordance with HM Revenue & Customs (HMRC) requirements.

11.2 Where personal data is no longer required, we shall either securely delete it or anonymise it so that it can no longer be associated with you. We will not keep your personal information longer than is reasonably necessary to fulfil the relevant purposes set out in this Privacy Policy and in order to comply or demonstrate compliance with our legal and regulatory obligations. Where we can, and it is appropriate, we will minimise personal data or de-personalise data to use for statistical or analytical purposes.

11.3 In some cases, such as if there is a dispute or a legal action affecting the information, we may need or be required to keep personal information for longer.

11.4 By law we have to keep basic information about our customers (including contact, identity, financial and transaction data) for at least 6 years.

11.5 In some circumstances you can ask us to delete your data: see below for further information.

11.6 If you apply to be a member and you are not accepted, we will only keep that data for 6 months.

11.7 If you no longer have an account with us or are no longer a member and we are no longer providing services to you, we will delete or anonymise your account data after seven years.

12. Your rights

12.1 You have the following rights, which you can normally exercise free of charge:


Right:

The right to be provided with a copy of your personal data.

Rectification:

The right to require us to correct any mistakes in your personal data.

Erasure (also known as the right to be forgotten):

The right to require us to delete your personal data—in certain situations.

Restriction of processing:

The right to require us to restrict processing of your personal data in certain circumstances, e.g., if you contest the accuracy of the data.

Data portability:

The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations.

To object:

The right to object: at any time to your personal data being processed for direct marketing; in certain other situations to our continued processing of your personal data, e.g., processing carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise, or defense of legal claims.

Not to be subject to automated individual decision making:

The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly, significantly affects you. We do not carry out this activity at present.

The right to withdraw consent:

If you have provided us with a consent to use your personal data, you have a right to withdraw that consent easily at any time. You may withdraw consents by emailing, calling, or writing to us; please use the words 'Data Protection Request' in the subject line of your email or at the top of your letter (see 'How to contact us' below). Withdrawing a consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn.

Manage visibility settings:

You can manage your Directory visibility preferences at any time in Account → Profile & Privacy, or contact us at hello@vocaso.com for help.

Automated individual decision making:

Not to be subject to automated individual decision making. You have the right to object to decisions based solely on automated processing, including profiling, which produce legal effects or significantly affect you. While VOCASO uses internal selection criteria to vet membership applications (as stated in Section 5 of our Consumer Terms), these decisions involve human intervention and are not purely automated. Should we implement fully automated decision-making processes in the future, we will update this policy and provide you with information about the logic involved and the potential consequences for you.


12.2 You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

12.3 For more information on each of those rights, including the circumstances in which they apply, please contact us (see 'How to contact us' below) or see the Guidance from the UK Information Commissioner's Office (ICO) on individuals' rights.

12.4 If you would like to exercise any of those rights, please:

12.4.1 Email, call or write to us—see below: 'How to contact us'

12.4.2 Provide enough information to identify yourself, e.g., your full name, address, any additional identity information we may reasonably request from you; this is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response; and

12.4.3 let us know what right you want to exercise and the information to which your request relates.

How to contact us: To exercise any of your rights, please submit a request to hello@vocaso.com using the subject line "Data Subject Rights Request". To help us process your request efficiently, please include:

12.4.4 Your full name and the email address associated with your VOCASO account;

12.4.5 A description of the specific right you wish to exercise (e.g., "Right of Access" or "Right to Erasure");

12.4.6 Any specific timeframes or categories of data your request relates to.

12.5 We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

13. Keeping your personal data secure

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These measures include:

13.1.1 Encryption: All personal data stored electronically is encrypted at rest using industry-standard AES-256 encryption. Data transmitted between your browser and our website is encrypted using Secure Sockets Layer (SSL) or Transport Layer Security (TLS) technology.

13.1.2 Access Controls: We limit access to your personal data to those employees, agents, contractors and other third parties who have a genuine business need to know. They will only process your personal data on our instructions, and they are subject to a strict duty of confidentiality.

13.1.3 Multi-Factor Authentication (MFA): We require MFA for administrative access to our internal systems and third-party platforms (such as HubSpot and Wix) where your personal data is stored.

13.1.4 Network Security: We employ firewalls, intrusion detection systems, and regular vulnerability scanning to protect our IT infrastructure and our computer networks and connections.

13.1.5 Physical Security: Any physical records or hardware containing personal data are kept in secure, locked facilities with restricted access.

13.1.6 Staff Training: All VOCASO personnel receive regular data protection and cybersecurity training to ensure they understand their responsibilities regarding the handling of member data.

13.2 We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

13.3 While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure. We encourage you to use strong, unique passwords for your VOCASO account and to keep your login credentials confidential.

14. Data Controller contact details and complaints

14.1 Full name of legal entity: VOCASO Limited, a company registered in England and Wales with company number 13074637. Contact Name: David Goldstone. Email address: hello@vocaso.com. Postal address: VOCASO Limited, Second Floor, 201 Haverstock Hill, Belsize Park, London, NW3 4QG.

14.2 You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (http://www.ico.org.uk).

14.3 VOCASO Limited is registered as a Data Controller with the Information Commissioner's Office. Certificate Number ZB244631.

14.4 Please contact us if you have any queries or concerns about our use of your personal data (see below 'How to contact us'). We hope we will be able to resolve any issues you may have.

14.5 You also have the right to lodge a complaint with the Information Commissioner in the UK. The UK's Information Commissioner may be contacted using the details at https://ico.org.uk/make-a-complaint or by telephone: 0303 123 1113. We would, however, appreciate the chance to address your concerns before you approach the ICO, so please contact us in the first instance.

15. Changes to this privacy policy

15.1 This privacy notice was published on 26th February 2023 and last updated on 20th July 2026.

15.2 We may change this privacy notice from time to time—when we do, we will inform you via our website or other means of contact, such as email.

16. How to contact us

16.1 You can contact us by post, email, or telephone if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law or to make a complaint.

16.2 Our contact details are shown below:

Postal address: VOCASO Limited, Second Floor, 201 Haverstock Hill, Belsize Park, London, NW3 4QG. hello@vocaso.com

17. Do you need extra help

17.1 If you would like this notice in another format (for example audio, large print, braille) please contact us (see 'How to contact us' above).