Agency Worker Privacy Notice

Vortexorce Limited (“Vortexorce”, “we”, “us”) is the controller of the personal data described in this notice. We are a company registered in England and Wales with company number 13304681, and our registered office is at Suite RA01, 195-197 Wood Street, London, E17 3NU. We were formerly named Driversgo Ltd until 11 April 2026, and you may still see that name on older records.

We are an employment business within the meaning of section 13(3) of the Employment Agencies Act 1973. We engage you directly, pay you through our own PAYE payroll, and supply you to work temporarily for our clients, whom this notice calls hirers.

This notice covers the personal data we process about you as a work-seeker and as an agency worker: when you register, while we verify your identity and credentials, while you are on an assignment, when we pay you, and after your last assignment ends.

Two other notices sit alongside it. Our Website Privacy Notice covers browsing the public Vortexorce website and using the enquiry and job-search pages. Our Cookies Policy covers cookies and similar technologies on the website and in the mobile app. Where a hirer uses your data for its own purposes it does so as a separate controller and under its own privacy notice, which it must give you on request.

We collect most of this from you directly. Where we collect it from somewhere else, the table says so.

We do not rely on your consent for the processing set out in this section. Consent would not be meaningful in a working relationship, where you might feel unable to refuse, and we could not run the payroll or meet our legal duties if you withdrew it. We rely instead on the bases in the table. The one exception is any optional feature we may offer in future which is not necessary for your work, such as continuous location sharing: we would ask for your consent separately for that, you would be free to refuse, and refusing would not affect the work you are offered.

Where we rely on legitimate interests we have carried out and documented a balancing assessment, weighing our interests against your rights and freedoms. You may ask us for a summary of any of those assessments using the contact details in section 1.

Some of the data above needs extra protection. We handle it as follows.

• Health and sickness data, and any work restriction: we rely on Article 9(2)(b) of the UK GDPR, which covers employment and social security obligations, together with the condition for processing in the employment field in Part 1 of Schedule 1 to the Data Protection Act 2018. Where a night-worker health assessment or an occupational health referral is involved we may also rely on Article 9(2)(h).
• Criminal records and barred-list data from a DBS check: we rely on Article 10 of the UK GDPR together with the conditions in Schedule 1 to the Data Protection Act 2018 for the employment field, the prevention or detection of unlawful acts, and the safeguarding of children and of individuals at risk. We obtain a check only where the role is eligible for one.
• Equality monitoring data: where we hold it, we rely on the substantial public interest condition for equality of opportunity or treatment. It is used in aggregate and is not used to decide whether you are offered work.

We maintain the appropriate policy document that the Data Protection Act 2018 requires for this processing, and it is available on request.

Hirers are told only what they need in order to plan shifts and to keep you safe. What they see is limited to an availability or fitness flag, for example “unavailable”, “absent — sickness”, “returning on (date)”, or a work restriction such as “fit with restriction: no lifting above shoulder height”.

We do not tell a hirer your diagnosis, your medical history, the contents of a fit note, a test result, treatment detail or anything from which your health condition, disability or pregnancy could be worked out. Hirers are contractually forbidden from asking you or our staff for that information, from recording it, and from inferring it, and they must tell us and delete it if it reaches them by accident. If a reasonable adjustment or a risk assessment means a hirer genuinely needs to know more, we will discuss with you what needs to be shared before sharing it.

When you scan in and out we record the time of the scan, your account, the device used and the site at which the scan was made. That is all. We do not track your location continuously, we do not record where you are between scans, and we do not record where you are when you are not working.

The scan record is what we use to establish the hours you worked and therefore what you are paid. If a scan fails, you can submit other evidence and we will work out the hours from everything reliable available to us. A missing scan never stops us paying you for hours you actually worked.

We have completed a data protection impact assessment for QR and location-based attendance recording, and we review it. You may ask for a summary of it.

Groups created by hirers

The Platform lets a hirer put workers into groups of its own making, so that it can build shifts quickly. Some groups are used to book the same people again. Some are used to indicate that the hirer does not want to book a particular person again.

Where a hirer places you in a group that excludes you from its future assignments, the following apply.

• The hirer must select a reason from a fixed list, must do so accurately and in good faith, and must be able to explain it.
• The reason is visible to us. It is never visible to any other hirer.
• The exclusion applies only to that hirer. It does not reduce your visibility to, or your chances of work with, any other hirer on the Platform.
• Health, sickness, disability, pregnancy or maternity, trade union activity, making a protected disclosure, raising a health and safety concern and asserting a statutory right must never be a reason, and must never be used to filter or rank you.
• If you ask us, we will tell you whether a hirer has excluded you and give you the route to challenge it.
• We review exclusion records for patterns, so that we can identify any hirer whose exclusions suggest discrimination.

No hirer can publish a rating or a public assessment of you, and the Platform does not allow it.

Our own reliability record

We keep a record of what happens after you accept an assignment: whether you attended, whether you arrived on time, and whether you cancelled late or did not attend. It is based on published, objective criteria and on verified conduct. It never takes account of declining an assignment you have not accepted, of absence or lateness connected with disability, pregnancy, maternity or another protected characteristic, of statutory leave including sick leave and family leave, of a genuine emergency, of exercising your right to refuse unsafe or unlawful work, or of raising a complaint, making a protected disclosure or asserting a statutory right. We test the criteria for discriminatory effects. You may ask for the data behind your record, ask us to correct anything inaccurate, and object to the processing.

No decision that produces a legal or similarly significant effect for you is taken by automated means alone. That includes suspending you, removing you from the Platform, and stopping offering you work.

Before any such decision we will tell you the reason, show you the data and evidence relied on, and give you the chance to respond. A person with authority to reach a different outcome will review and make the decision, you will receive a reasoned written outcome, and you may appeal to a different reviewer. Rubber-stamping a score is not a review.

The Platform does use automated processing to match you to assignments, for example by filtering on the credentials you hold, the sectors you have registered for, your stated availability and the distance from a site. That filtering affects which assignments you are shown. You can ask us how it works and ask us to review any match you think is wrong.

We do not sell your personal data, we do not rent or lease it, and we do not share it for anyone else’s marketing. Hirers are contractually forbidden from taking your data off the Platform, from building their own database from it, and from using it for recruitment outside the Platform.

We keep your data in the United Kingdom wherever we can. Where a provider we use stores or accesses data outside the United Kingdom, we transfer it only under a mechanism the law recognises: adequacy regulations made by the Secretary of State, the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. We carry out a transfer risk assessment first. You can ask us which providers are involved and which mechanism applies.

At the end of these periods we delete your data securely or anonymise it so that it can no longer identify you. Where we are required by law to keep something for longer, we keep only that item, and only for as long as the law requires.

You have the following rights over your personal data. You do not have to pay anything to exercise them.

• Access — to be told what we hold about you and to receive a copy of it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have data deleted, where we no longer have a good reason to keep it. This does not apply to records we are required by law to keep, such as pay and right-to-work records.
• Restriction — to have us pause our use of your data while a dispute about its accuracy or our use of it is resolved.
• Objection — to object to processing we carry out on the basis of legitimate interests, and to object to direct marketing at any time, which we will always stop.
• Portability — to receive, in a machine-readable form, the data you gave us which we process by automated means on the basis of contract or consent, and to have it sent to another organisation where that is technically possible.
• Not to be subject to a solely automated decision with a legal or similarly significant effect, and to obtain human review of one — see section 9.
• To withdraw consent, where we have asked for it for an optional feature, at any time and without penalty.
• To complain to the Information Commissioner’s Office.

To exercise a right, contact us using the details in section 1. We will respond within one month. If your request is complex, or if you have made several requests, we may extend that by up to a further two months, and we will tell you within the first month if we do and explain why. We may ask you to confirm your identity before we release information about you. We charge nothing, except that we may charge a reasonable fee for further copies of the same information, or where a request is manifestly unfounded or excessive, and we will explain any fee before charging it.

Please raise anything about your data with us first, using the details in section 1, and we will investigate and reply. You can also complain to the Information Commissioner’s Office at any time:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. Website ico.org.uk.

Separately, if you believe we have breached the Employment Agencies Act 1973 or the Conduct of Employment Agencies and Employment Businesses Regulations 2003, you can complain to the enforcement officers of the Fair Work Agency, which since 7 April 2026 carries out the functions previously performed by the Employment Agency Standards Inspectorate. Their current contact details are in your Key Information Document. You will not suffer any detriment for complaining to us, to the Information Commissioner, to the Fair Work Agency or to anyone else.

We review this notice at least once a year and whenever we change what we do with your data. If we make a material change we will tell you through the app or by email before it takes effect, and we will also reissue your Key Information Document if the change affects anything recorded in it. We keep previous versions and will provide one on request.