Privacy Policy

This Privacy Policy explains how VectisFlow Limited ("VectisFlow", "we", "us") collects, uses, stores, and shares personal data when you use Templio. Templio is a software service for UK recruitment agencies to manage contractor timesheets, approvals, invoicing, and compliance records.

1. Who we are

We are the controller of the personal data described in this Policy in relation to our website, customer accounts, and operational communications. Where we process Customer Data on behalf of an agency Customer, that Customer is the controller and we act as processor — see our Data Processing Addendum.

2. What personal data we collect

We collect different categories of data depending on your role:

• Agency staff (Authorised Users). Identity data (name, email), authentication metadata (via Clerk), IP address, session cookies, and billing data (via Stripe).
• Contractors. Name, email, phone number, date of birth and National Insurance number (where your agency records them); gender and home address, where your agency engages you outside PAYE and must report your details to HMRC under the Employment Intermediaries Regulations (see section 3); your Unique Taxpayer Reference, where you are engaged as a self-employed sole trader or partner and HMRC's reporting rules require it; company name and number, VAT registration number and business address (where you invoice through a company or are VAT-registered); timesheet content; IR35 and AWR records your agency keeps about your engagement; and any documents you upload to the document vault.
• Clients / approvers. Name, email, and records of approval actions taken on timesheets shared with you.
• Website visitors. Strictly necessary cookies and, only with your consent, cookieless visit statistics — see section 9.
• People who book a demo. The name, email address and any notes you enter when booking. Bookings are handled by Cal.com, Inc. on its US-hosted service at cal.com, so this data is transferred to the United States (see §6).
• In-app support messages. If you use the "Contact support" form in your dashboard, we collect the subject and message you write, your agency and user id, the page you were on, and your browser's user agent string.
• Business contacts at recruitment agencies. If you work at a UK recruitment agency we may work with, we may collect your name, job title, work email address, work phone number and LinkedIn profile address, and keep a record of our emails, calls and LinkedIn messages with you. We take these details from your agency's own website, the public Companies House register and LinkedIn, or from you directly. We do not buy contact lists.
• In-app support assistant. If you use the AI support assistant in your dashboard (where enabled), we collect the question you type, your agency and user id, the page you were on, and which model answered. The assistant answers only from our own published help content; questions are also sent to our AI Gateway sub-processor under a zero-data-retention agreement — see section 5.

3. Lawful basis for processing

• Contract performance (UK GDPR Art. 6(1)(b)) — to provide timesheet submission, approval, invoicing, and self-billing services, and to arrange a demo you ask for.
• Legal obligation (Art. 6(1)(c)) — to retain audit logs (six years, HMRC), to maintain Agency Workers Regulations 2010 (AWR) and IR35 records, to report non-PAYE workers' details to HMRC under the Income Tax (PAYE) Regulations 2003 (Employment Intermediaries Regulations), and to respond to lawful requests.
• Legitimate interests (Art. 6(1)(f)) — to prevent fraud, secure our platform, investigate misuse, and respond to messages sent through the in-app support form or the in-app support assistant.
• Consent (Art. 6(1)(a)) — where you accept analytics in our cookie banner, to count visits to the marketing website with Vercel Web Analytics. See section 9 and our Cookie Policy for detail.
• Legitimate interests (Art. 6(1)(f)): to contact people at recruitment agencies about Templio by work email, phone and LinkedIn, and to keep a record of those conversations. We contact you only in your business role, every email tells you how to opt out, and we screen phone numbers against the Corporate Telephone Preference Service before calling.
• Consent (Art. 6(1)(a)) — for any marketing to personal (non-work) email addresses. We do not send this today; contact with people at businesses is covered by legitimate interests above.

Some data is needed to provide the Service. Agency staff need an email address to hold an account. A contractor's agency needs the details required to pay the contractor and to meet its own legal duties, such as HMRC reporting; if they are not provided, the agency may be unable to engage the contractor through Templio.

4. How we use your data

We use personal data to:

• Provide the Templio service under our Customer Terms of Service;
• Authenticate Authorised Users and enforce tenant isolation;
• Calculate pay and generate invoices and self-billing documents;
• Transmit invoice data to your Xero account where you have connected Xero;
• Maintain an append-only audit log of state-changing actions for compliance;
• Detect and investigate abuse, fraud, and security incidents;
• Respond to your queries and support requests, including with an AI assistant grounded only in our own help content (where enabled).

5. Who we share your data with

We share personal data with the sub-processors listed in Annex A of our DPA, and demo bookings with Cal.com. We do not sell personal data and we do not disclose it to third parties for marketing purposes.

We may disclose personal data where required by law, court order, or regulatory request, or where necessary to protect the rights, property, or safety of VectisFlow, our Customers, or the public.

6. International transfers

Some of our sub-processors operate outside the United Kingdom. Where this is the case, we rely on the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum, together with supplementary measures where appropriate. See Annex A of the DPA for the current list and the specific transfer mechanism for each vendor.

Where a sub-processor's own data processing terms set the transfer mechanism, that mechanism applies instead. For Xero, the transfer relies on the safeguards in Xero's data processing terms, and we do not rely on the IDTA or the UK Addendum for Xero.

Demo bookings are not processed by a sub-processor: if you book a demo, Cal.com, Inc. stores your booking details in the United States.

7. Retention

• Customer Data (timesheets, invoices, approvals) — kept while the agency Customer's account is open. The agency, as controller, decides how long its records are kept after that, including any period HMRC requires; on termination we return or delete Customer Data as set out in section 11 of the DPA.
• Our own billing records — kept for six years after the end of the financial year they relate to, as HMRC requires.
• Audit log — retained for six years from the date each entry is written, then deleted. The audit log is append-only at the database level.
• Personal data subject to an erasure request — where we are able to honour an erasure request under Art. 17 UK GDPR, we do not delete audit records, which are kept as evidence of legal obligations and for the defence of legal claims. Entries recorded against that person's own account are pseudonymised 90 days after the erasure. All other entries that name the person, whether written by agency staff, client approvers or scheduled jobs, are kept as written until the six years end.
• In-app support assistant questions — kept 90 days, then deleted.
• Business contact records (people at recruitment agencies we have contacted) — kept for up to 12 months after our last contact with you, then deleted, unless you become a customer. If you ask us not to contact you, we keep only your name, your work email address and the date of your request, so that we do not contact you again.

8. Your rights

Under UK GDPR you have the right to:

• Access your personal data;
• Rectify inaccurate data;
• Erase data (subject to legal retention obligations);
• Restrict processing;
• Data portability;
• Object to processing based on legitimate interests;
• Not be subject to solely automated decisions with legal or similarly significant effect;
• Withdraw consent at any time where processing relies on consent.

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you. Pay and overtime are calculated automatically from the rules in your contract, but a person approves each timesheet before it is invoiced.

You can ask us at any time to stop contacting you: reply to any email from us, or write to privacy@templio.co.uk, and we will stop straight away.

To exercise these rights, contact our privacy team at privacy@templio.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk/make-a-complaint).

9. Cookies

We use strictly necessary cookies at all times. Under the Privacy and Electronic Communications Regulations 2003 (PECR), they are exempt from the consent requirement. With your consent, given in our cookie banner, we also count visits to our marketing website with Vercel Web Analytics, which sets no cookies and cannot identify you. We do not use advertising or tracking cookies. You can change your choice at any time with the Cookie settings link in the footer of every page. See our Cookie Policy for the full list.

The full list of cookies currently in use:

10. Children's data

Templio is a business-to-business service and is not directed at children. We do not knowingly collect personal data from anyone under 18.

11. Changes to this policy

We may update this Policy from time to time. Where changes are material, we will notify our Customers by email at least 30 days before the changes take effect. The current version and last-updated date appear at the top of this page.

12. Contact us

Email us at privacy@templio.co.uk for any question about this Policy or how we handle personal data.