Version 4.0
Definitions
Account Creation means the issuing to the Client of a login to the Veremark platform by Veremark or the creation of a login via the Veremark portal by the Client.
Advisor means a professional Advisor to Veremark governed by a contracted Advisor agreement.
Agreement means these Terms of Service, the incorporated Schedules and the Sales Order Form.
Candidate means the Data Subject (individual) being screened by Veremark as part of the Services.
Client means the contracted party to the Agreement who is further identified in the Sales Order Form acting as the Data Controller
Code of Conduct means the formal policy that Veremark adheres to on ethical business behaviour and quality standards that benefit our clients and our business, which is available upon request.
Data Protection Law means all legislation and regulations in force from time to time regulating the use of personal data and the privacy of electronic communications which may include, if applicable, the retained EU law version of the General Data Protection Regulation ((EU) 2016/679), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, the (UK) Data Protection Act 2018, the (UK) Privacy and Electronic Communications Regulations 2003 as amended, and any successor legislation.
Fees means the fees payable by the Client, comprising the aggregate of all the Prices in relation to each applicable Service.
Initial Term means the initial contracted period for the delivery of Services as defined in this Agreement or the Sales Order Form. The Initial Term defined in the Sales Order Form will take precedence.
Pass Through Costs means the additional fees or surcharges levied by some institutes, universities, organizations, corporate entities, or government agencies for the provision or confirmation of Veremark requests for data. Veremark will pass these fees or surcharges on to the Client at cost.
Price means the applicable price for each element of the Services, as set out either in the Sales Order Form or on Veremark’s online global product menu and price list, which is viewable on the Veremark platform within the Client’s account under the heading "Criteria Settings"
Renewal Term means the contracted period subsequent to the Initial Term as defined in this Agreement or the Sales Order Form. The Renewal Term defined in the Sales Order Form will take precedence.
Report means the final Delivery of the Services ordered by the Client in the form of a screening report, and includes the relevant information in respect of a Candidate.
Sales Order Form means the form signed by the Client which incorporates these Terms of Service.
Service(s) means the applicable employment screening and reporting services ordered by the Client via the Veremark platform "Personal data", " Data subject", " Processing", " Controller", and " Processor" shall have the respective meaning given to them in the Data Protection Law.
This Agreement ("Agreement") is between Veremark Ltd ("Veremark") and its subsidiaries; Registered Company Number: 11681510; of Registered Address: 85 Great Portland Street London, England, W1W 7LT, United Kingdom, and the Client ("Client") as defined in an executed Sales Order Form ("Sales Order Form"). This Agreement constitutes the whole agreement between Veremark and Client and supersedes all previous materials and communications shared between Veremark and Client including any marketing materials.
The Client wishes to subscribe to the Services (the Services) as detailed in Schedule 2 of this Agreement. By subscribing to these Services Client is agreeing to the terms and conditions of this Agreement to which Veremark and the Client are each a ("Party") and, collectively, (the "Parties").
1. Agreement Term
1.1. Unless otherwise expressly stated in the Sales Order Form, this Agreement shall take effect on the date of Account Creation and shall remain effective until otherwise given notice or the account is closed in line with the notice of termination as per Clause 2.
2. Termination
2.1. In the event the Client wishes to terminate the Agreement, they can do so at any time upon 30 days written notice to Veremark, after which all accounts and outstanding expenses will be settled, and any client-related data will be deleted.
2.2. If the Client wishes to terminate the Agreement and has prepaid for credits towards our Services, the Client may submit a written termination request to Veremark at least three (3) months before the end of the Initial Agreement term. Please note that any unused prepaid credits will remain available in the Client’s account until the contract expires. However, these credits are non-refundable and must be used within the contract term.
2.3. In the event Veremark wishes to terminate the Agreement, it can do so at any time on 30 days written notice to Client.
2.4. If the Client commits a material breach of this Agreement, the Client will have ten (10) working days to rectify the breach or violation from the date of notification of the agreement. If the breach or violation is not rectified to the satisfaction of Veremark within the time allotted, Veremark may terminate the relevant Service, and/or this Agreement, immediately without any liability.
3. Provision of Services
3.1. Veremark will provide the Services in a professional manner in accordance with reasonable and recognized industry standards.
3.2. Veremark will use reasonable commercial efforts to obtain information in respect of the Candidate in order to provide the Services. However, should third parties refuse to release the required information within a period of 30 business days after the first request submitted by Veremark, including adequate subsequent follow-up by Veremark within such period, Veremark will inform the Client and cooperate with the Client in relation to closing the Candidate case file for payment.
3.3. After the Client orders the Services, should Veremark require more information and /or documents from the Client in order to proceed with information gathering, a request will be made to the Client if the required additional information and/or documents have not been received by Veremark within a period of 30 business days, Veremark will inform the Client and co-operate with the Client in relation to closing the Candidate case file for payment.
3.4. It is an essential condition of the Agreement and understood by the Client that the completeness and accuracy of the information contained in the Report will depend on the completeness and accuracy of the input data provided to Veremark by the Client and/or Candidate.
4. Fees and Payment
4.1. The Client must pay the Fees in accordance with the remainder of Clause 4 and the Sales Order Form.
4.2. For Clients with a corporate billing account agreement, an invoice for Services shall be delivered to the Client within at least fifteen (15) business days from the end of the previous All invoices shall be due and payable within seven (7) days from the invoice date, unless otherwise stated in the Sales Order Form.
Where a direct debit arrangement has been set up, the Client authorises Veremark to initiate debit entries to the Client’s nominated bank account via the Automated Clearing House (ACH) and/or other electronic payment methods for amounts due under this Agreement. The Client is responsible for ensuring sufficient cleared funds are available on the applicable due date. Veremark reserves the right to recover any fees, charges, or penalties arising from failed or rejected payments.
Payments shall be made in cleared funds via electronic funds transfer or such other electronic payment methods approved by Veremark. Payments by cheque are not accepted.
4.3. Any invoice shall be deemed accurate and accepted unless the Client notifies Veremark in writing of a bona fide dispute within five (5) business days of the invoice date, specifying the nature of the dispute in reasonable detail.
4.4. Where a Client requests any deviation from Veremark’s standard invoicing process, including but not limited to split invoices, consolidated invoices, or other customised invoice formats, and such arrangement is not expressly set out in the applicable Sales Order Form, Veremark reserves the right to charge an administrative fee of US$50 per invoice issued pursuant to such request (or the local currency equivalent).
Such customised billing requests may include, without limitation, manual invoice creation or re-issuance, invoice splitting, non-standard invoice formats, retroactive billing adjustments, or other client-requested billing modifications. Any applicable administrative fee may be invoiced separately or included in the relevant invoice, at Veremark’s discretion.
4.5. When gathering information, it may, on occasion, be necessary for Veremark to undertake in-person research or documentary verification, through the use of Veremark staff or Veremark nominated partners. Travel expenses and/or verification expenses incurred for in-person services will be passed on to the Client at cost and deducted from the credits within their account or included in the invoice.
4.6. Where translation services are required to complete a search or verification, such services shall be performed by a Veremark-nominated partner. Translation costs shall be charged to the Client at cost plus a five percent (5%) administration fee.
4.7. Additionally, certain institutes, organisations, corporate entities, or government agencies may impose additional fees or surcharges in connection with the provision or verification of Services. Any such fees or surcharges incurred by Veremark shall be passed through to the client at cost.
Where a check incurs a pass-through expense, Veremark shall charge an additional administration fee of US$1 per check (or local currency equivalent at the prevailing exchange rate at the time of invoicing), with the remaining amount charged at cost.
4.8. The client agrees to pre-approve a budget of $75 to cover additional pass-through costs before requiring notification. All pass-through costs will be deducted from the credits within the account or charged back against the next month’s invoice. The pre-approved budget may be changed where clients have signed a specific sales order form.
4.9. All payments under this Agreement shall be made in cleared funds, without deduction or set-off, and free and clear of all taxes, levies, duties, charges, fees, or withholdings imposed by any governmental or regulatory authority, except as required by law. Where a Party is required by law to make any such deduction, that Party shall gross-up the payment so that the receiving Party receives the full amount it would have received absent such deduction.
4.10. Veremark reserves the right to suspend any or all Services if any undisputed invoice remains unpaid after its due date.
4.11. Any agreement signed by both Parties that expressly incorporates or references these Terms of Service shall be read together with these Terms of Service, and in the event of any inconsistency, the signed agreement shall prevail.
4.12. For Clients operating a prepaid account, purchased credits shall be valid for twelve (12) months from the date of purchase, unless otherwise agreed in writing.
5. Cancellation Policy
5.1. Veremark, through its Code of Conduct, recognizes its commitment to ethical business behaviour and quality standards that benefit our clients and our business. When a Client cancels a Service, we only charge a percentage or part thereof of the Total Fees to cover our costs of fulfilment efforts and any other potential Fees incurred from approved-order initiation to the cancel date.
5.2. The table below outlines how Fees are applied in relation to Services that are cancelled. For all cases:
*The above does not include any other potential Fees or third party costs that have been incurred by Veremark to date in relation to the gathering of information on the Candidate, which will be charged back at cost.
6. Compliance
6.1. Veremark and the Client represent and warrant that they will comply with all relevant laws and regulations regarding the Services under the Agreement, including but not limited to all relevant data privacy laws.
6.2. For Candidates residing in the United States, Client as receiver of the Report hereby certifies that all of its orders for Services from Veremark shall be made, and the resulting Reports shall be used, in compliance with the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq (“FCRA”) permissible purposes only: for employment purposes under Section 604(a)(3)(B), including contractors, volunteers or evaluating a consumer for employment, promotion, reassignment, retention as an employee, where the consumer has given prior written permission. Reports governed by the FCRA are not allowed to be viewed or transmitted outside of the United States and the Client is responsible for compliance with this statutory requirement.
6.3. The Client acknowledges that Veremark, in receiving any information from the Client so as to perform the Services, holds, processes, and uses such information solely on behalf of the Client and does not hold, process, or use such information for any of Veremark's own purposes.
6.4. By signing the Sales Order Form and again with the submission of each request for the Services, the Client certifies and warrants to Veremark that, prior to requesting Veremark to provide the Services:
a) it has notified the Candidate that Veremark will be performing the Services on behalf of the Client; and
b) it has obtained the explicit consent (which is given voluntarily and has not been withdrawn) from the Candidate for Veremark to contact such Candidate and gather such information as is necessary to provide the Services.
6.5. Veremark has a zero-tolerance approach to bribery. We do not pay bribes or offer improper inducements to any person or organization for any purpose. We do not accept bribes or improper inducements from any person or organization for any purpose. We do not engage indirectly or otherwise encourage bribery. We take proactive measures to detect, deter, and prevent acts of bribery. These measures are monitored and updated on a regular basis. A more detailed policy can be shared at request.
6.6. Veremark has a zero-tolerance approach to slavery and human trafficking. We are committed to ensuring that they do not take place in our organization , and we take proactive measures to ensure they do not take place in our supply chains either. These measures are monitored and updated on a regular basis.
7. Confidentiality
7.1. Except insofar as may be necessary for Veremark to complete the Services properly, each party shall not at any time use any confidential or proprietary information relating to or belonging to the other party. Nor will either party disclose or divulge any such confidential or proprietary information to anyone outside of this agreement without the other party’s consent.
7.2. The Client certifies that it shall hold all Reports, and any information contained in such Reports, in strict confidence and not disclose the Report or any information in the Report to any third party, and only to staff at the Client who is involved in the current employment decision or investigation, on a “need to know” basis. Furthermore, the Client shall not use the information contained in the Report to create, compile, or maintain a database.
7.3. This clause 7 shall not prohibit disclosure of any information if and to the extent:
a) the disclosure is required by the law, any competent court, any competent governmental or regulatory authority;
b) the disclosure is required for the purpose of any judicial proceedings arising out of this Agreement or any other Agreement entered into under or pursuant to this Agreement or the disclosure is reasonably required to be made to a tax authority in connection with the tax affairs or the disclosing party;
c) the disclosure is made to professional Advisors of Veremark or the Client on terms that such professional advisers undertake to comply with the provisions of this clause (8) in respect of such information as if they were a party to this Agreement;
d) the information is or becomes publicly available (other than by a breach of confidentiality under this Agreement); or the other party has given prior written approval to the disclosure; or
e) The candidate requests access to the information in the form of their own career passport.
7.4. The above confidentiality obligations shall survive for a period of two (2) years or for as long as the confidential or proprietary information retains commercial value or has not been publicly disclosed.
8. Limitations on Liability
8.1. No warranty whatsoever is given by Veremark to the Client. For the avoidance of doubt, Veremark gives no warranty in respect of any of the following:
a) the provision of the Services;
b) the accuracy or sufficiency of any information contained in any Report, which may contain typographical errors or inaccurate data in the source material;
c) that any Reports or Services will be fit for their intended purpose, useful to the Client or of satisfactory quality;
8.2. Veremark assumes no responsibility or liability regarding the use or misuse of the Services or any Reports for any purpose.
8.3. In the course of providing the Services and producing Reports Veremark passes on to the Client information that Veremark has obtained from third parties about the Candidate. Veremark is neither the author nor the creator of that information. No responsibility will be taken by Veremark for the consequences if the Client should rely on such information from the source. However, Veremark will undertake reasonable procedures to protect against any false information being provided to the Client.
8.4. All personal data supplied by Veremark to the Client is intended to be for the sole purpose of the Client’s evaluation and is not intended for public dissemination, and the Client indemnifies Veremark from and against any claims from Candidates or other third parties in respect of the misuse of any such personal data by the Client. The Client’s indemnification obligations shall be limited to claims, damages, losses, liability, costs, and expenses directly attributable to the Client’s misuse of personal data, and shall not extend to any consequential, indirect, or punitive damages.
8.5. Neither Party shall be liable to the other Party for any loss (whether direct or indirect) of profits, business, or anticipated savings or for any indirect or consequential loss whatsoever even if Veremark or Client shall have been advised of the possibility of such loss.
8.6. Except for wilful misconduct, gross negligence, fraud, and breach of Data Protection Law, Veremark and Client’s total aggregate liability arising by reason of or in connection with the performance of this Agreement shall be limited to 100% of the amount of Fees paid by the Client to Veremark within the preceding 12 months.
9. Express Disclaimer
Veremark disclaims all representations, warranties, conditions or guarantees with respect to the Services and any Reports provided. This disclaimer includes without limitation any implied warranties of merchantability, quality, accuracy or completeness of the Services and/or the Reports, except to the extent that any warranties implied by law cannot be validly waived.
10. Force Majeure
Neither party shall be liable for any delay in performing any of its obligations under the Agreement if such delay is caused by circumstances beyond the reasonable control of the party so delaying and such party shall be entitled (subject to giving the other party full particulars of the circumstances in question and to using all reasonable endeavours to resume full performance without avoidable delay) to a reasonable extension of time for the performance of such obligations.
11. Data Protection
11.1. Each party will comply with all applicable Data Protection Laws and, to the extent applicable, any other laws that relate to the privacy, protection, use, or disclosure of personal data.
11.2. This Agreement applies to Veremark Ltd as the data processor and Client as the data controller.
11.3. The Client shall ensure that it has in place all necessary consents and notices required to enable the lawful transfer of personal data obtained under consent from the Data Subject to Veremark for the purposes described in this Agreement.
11.4. The only personal data types that Veremark needs the Client to provide are the Candidate’s name, email address, and mobile telephone number.
11.5. Subject to clause 11, Veremark is hereby given general authorization to engage sub-processors without obtaining any further written, specific authorization from the Client. The Client agrees that Veremark may choose which sub-processors can be used to run the checks. Veremark may choose to update its sub-processors from time to time with information on the sub-processor(s) and changes made available on request from the Client, if deemed appropriate by Veremark.
11.6. If the Client (acting reasonably) objects to a new Sub-processor, the Client may request that Veremark move the Client’s personal data to another sub-processor, within seven days from the notification to the Client. If the Client does not provide such a request within this time frame, the new sub-processor shall be deemed to have been approved. If such request is received from Client within the time frame, Veremark shall, within a reasonable period of time following receipt of such request, use all reasonable endeavours to ensure that the relevant sub-processor does not process any further Client’s personal data, and help identify an alternative. The provision of an alternative sub-processor is not guaranteed and is subject to them meeting the requirements and compliance standards set by Veremark and the ICO.
11.7. Veremark shall not permit, allow, or otherwise facilitate the sub-processors to process Client’s personal data unless Veremark enters into a written agreement with the sub-processor imposing substantially similar obligations on the sub-processor with regard to their processing of Client’s personal data as are imposed on Veremark under this Agreement.
11.8. Veremark shall at all times remain responsible for compliance with the data protection obligations under this Agreement and will be liable to the Client for the acts and omissions of any sub-processor as if they were Veremark’s acts and omissions (subject to the terms of the Agreement).
11.9. Veremark shall provide reasonable assistance in meeting the Client’s compliance obligations under the Data Protection Law, taking into account the nature of processing and the information available to Veremark, including in relation to data subject rights, data protection impact assessments and reporting to and consulting with relevant data protection authorities.
11.10. Except where required or prohibited (as applicable) under applicable law, Veremark will notify the Client of any request received by us or any sub-processor from a data subject in respect of personal data included in the Client’s data, and will not respond to the data subject. The Client shall be solely responsible for responding substantively to any such data subject request or communications involving personal data.
11.11. Veremark shall enable the Client to correct, delete, block, access, or copy the Client’s personal data in accordance with the functionality of the Services.
11.12. On termination of the Agreement for any reason or expiry of its term, Veremark will immediately cease processing Client’s personal data and will within 30 days of being instructed in writing by the Client either securely delete or destroy or return (and not retain, except as required for record-keeping purposes), all of the personal data related to this Agreement in Veremark’s possession.
11.13. Under its responsibilities under UK GDPR as a data processor for its customers, Veremark will consider an account to be dormant if no orders have been made within the last 18 months. In this circumstance, the account will be deactivated. However, it can be reactivated at any time during the subsequent 6 months, with all data present, by making a request to Veremark customer support. If the account has not been reactivated in that 6-month period, bringing the total dormancy length to 2 years, the account will be permanently deleted. The data for the account cannot be restored after this action. For active accounts, Veremark will retain the Client’s data for the duration of the Agreement and for a period of 6 years after termination or expiry of the Agreement, unless otherwise required by law.
11.14. Veremark will permit the Client and its third-party representatives, at Client’s expense (not more than once annually, in normal business hours, and in a manner which does not unreasonably interfere with Veremark’s business and operations) to audit Veremark’s compliance with its data protection obligations, on giving at least 30 days’ notice, during the term of the Agreement. Veremark will give the Client and its third-party representatives only such assistance as is reasonably necessary to conduct such audits. The Parties shall mutually agree upon the scope, timing and duration of the audit. The Client and/or any third-party representatives shall be subject to the confidentiality provisions of the Agreement except to the extent required to be disclosed to a data protection authority.
12. General Terms
12.1. If any provision of the Terms shall be held to be invalid, illegal, or unenforceable, the validity, legality, and enforceability of the remaining provisions shall not be in any way affected or impaired. This Agreement constitutes the entire agreement between the Parties upon this subject and supersedes all previous representations, offers, undertakings, or Agreements. No modifications, amendments, or additions to this Agreement shall be made except in writing signed by all Parties.
12.2. No delay, act, or omission by either Party in exercising any right or remedy shall be deemed to be a waiver of that or any other right or remedy.
12.3. If any provision of this Agreement is found to be invalid, illegal, or unenforceable, the validity, legality, and enforceability of the remaining provisions shall not in any way be affected or impaired, and such provision shall be deemed modified to the extent necessary to render it enforceable.
13. Territory
13.1. This Agreement shall be governed and construed in all respects by the laws of England and Wales and the Parties agree to submit to the exclusive jurisdiction of the English Courts, except for in relation to Client’s residence in Singapore which shall be governed under the rules of the Republic of Singapore.
13.2. Any notice or other correspondence to be served or delivered in accordance with this Agreement may be served or delivered personally or by posting it to the last known address or the registered office address of the relevant party. It shall be deemed to have been received after Three (3) days if sent via email or facsimile transmission and after Seven (7) days if served or delivered by post.
13.3. Notices to Veremark should be sent to Agreements@veremark.com as well as served at 85 Great Portland Street, London, W11 7LT, UK.
Schedules
Schedule 1: Price
Schedule 2: Service Level Agreement
Schedule 1 – Price
a. Price
The applicable Prices will be:
- As set out in the Sales Order Form;
- Where any Services and/or applicable Prices are not included in the Sales Order Form, the Prices will be as listed under the Criteria Settings on the Veremark Platform.
b. Minimum Volumes
- Prices stated in the Sales Order Form are subject to the minimum ordering volume to be maintained. Ordering volumes need to remain at least above 75% of forecast spending on a pro-rata basis over the preceding 3 months. In the case that ordering volumes are not above this threshold, then Veremark has the right to revert to its original platform Prices at the current published rate unless stated otherwise on the SOF.
c. Pricing Considerations
For countries where criminal checks are not allowed, Global Sanction will be recommended as it has a range of coverage within the government database
Certain universities and trade schools may have an additional charge which will be added at cost plus a US$1 admin fee (or local market currency equivalent at time of invoice) per check for covering payment. The client agrees to pre-approve a budget of US$75 to cover additional pass-through costs before requiring notification or $150 for all USD checks.
All pass-through costs will be deducted from the credits within the account or charged back against the next month’s invoice. The pre-approved budget may be changed where clients have signed a specific sales order form.
There may also be occasions where a translation is necessary, which would be conducted by a Veremark-nominated partner. Costs incurred for translation services would also be passed onto the client at cost +5% and deducted from the credits within their account.
The cost of Criminal checks may vary per country depending on its market availability
Pricing for criminal checks in the US excludes court fees. When a data access/court fees are incurred they will be deducted from the credits within the account or charged back against the next month’s invoice.
If the subject/candidate has more than one (1) name, additional charges may apply, Veremark will, at Client’s request, conduct verifications on the data subject’s additional name(s) and pass any additional costs onto Client.
There will be an annual Price review with Prices to increase at least by an amount in line with the inflation of the markets.
c. Billing
Unless otherwise agreed with Veremark, the Client will purchase credits in advance either by bank transfer or credit card and agree for any additional surcharges to be deducted directly from the credits within their account. Credits purchased are valid for 12 months from the date of purchase, unless otherwise specified.
d. General
If Veremark is required to amend the fees of the services it provides under this agreement, Veremark will, where possible, give not less than thirty calendar (30) days prior notice in writing to Client specifying the nature of the proposed amendment.
If such amendment is likely to result in any adverse change to the services, Client shall be entitled to reject the proposed amendment by notifying Veremark in writing no later than the expiry of the thirty (30) calendar day notice period. The rejection of the amendment will not result in the reinstatement of the original scope
e. Late Payment
Any undisputed invoice that remains unpaid more than seven (7) days after its due date will incur a late payment charge of five percent (5%) of the outstanding amount for each additional seven (7)-day period it remains overdue. Veremark may deduct any late payment charges from the Client’s next credit purchase or invoice them separately.
Schedule 2: Service Level Agreement
Turnaround Time and Expedited Service
The expected turnaround time for the business-as-usual service, from the date of receipt of the required data from the Candidate until completion of the delivery of the Service, is up to 15 business days, depending on the type and the country/jurisdiction of the search. Turnaround times are quoted as business days and are subject to the following:
• The complete subject/candidate information for screening being supplied by the Client
• Education verifications being conducted during educational institutes’ term times
• Employment verifications being conducted during employers’ business hours
Veremark will use its best efforts to provide the requested information. However, circumstances beyond Veremark’s control may arise that prevent a search from being completed. (For instance, if a company has ceased operations or declines to release the information) In these cases, Veremark shall only be obliged to make reasonable efforts to complete employment verifications.
However, if expedited service is requested, a surcharge of an additional 50% of the Price shall be applied. Expedited service is when a report is prioritised ahead of other cases or the follow-up process is accelerated to every business day rather than every alternate business day. Where the Client has credits on the system, this surcharge will be deducted from their account.
a. Screening commencement
Veremark will commence verifications on receipt of the requested information within one (1) business day.
Where a data subject has not provided supporting documentation or complete information, the data subject will be emailed/telephoned with three (3) reminder requests.
On day seven (7) after receipt of the screening request, the check will be closed if there is no response from the data subject. The Turnaround time calculation however will not commence until all correct information has been received from the candidate.
The cancellation timeframe applies as below on checks where the candidate has not provided the information.
b. Database I Public record searches
Veremark will conduct database / public record searches, subject to local market availability when an individual has lived in any jurisdiction or upto and within the last 7 years where an Extra Jurisdiction check re has also been approved. Veremark will commence the database / public record search automatically and pass any charges involved onto the Client in line with the expense agreement determined in Clause 5.
If the subject/candidate has more than one (1) name Veremark will, at Client’s request, conduct searches on the data subject’s additional name(s) and pass any additional costs onto Client, as per Schedule 1.
c. Qualification & Professional Memberships Verifications
Veremark will verify the subject’s / candidate’s highest qualification obtained unless otherwise directed by the Client. Charges and availability are as per Schedule 1.
Copies of the subject’s / candidate’s academic transcripts and/or diploma and/or degree certificates may be required to initiate a verification.
Standard Verifications – Definition:
Veremark will make a maximum of three(3) valid attempts within five(5) business days. to verify the employment history details based on the information provided by the Candidates. Candidates are requested to provide artefacts supporting their education history (viz. Grade transcripts, graduation certificates etc).
Mitigation Process (Cost - US$3): If Veremark has difficulty in obtaining the verification or the client needs additional re-verification, the subject/candidate can be contacted for further information and Veremark will seek for alternative method to complete the verification. Additional (2) valid attempts within 5 business days will be made at an additional cost of US$3/-.
d. Employment History & Reference Verifications
Veremark will not contact the current employer of a subject/candidate unless we have specific permission from the subject/candidate to do so.
If a subject/candidate has previously been employed by any Client office, Veremark will verify the employment history.
Standard Verifications – Definition:
Veremark will make a maximum of four(4) valid attempts within eight(8) business days to verify the employment history details based on the information provided by the Candidates. Candidates are requested to provide artifacts supporting their employment history (viz. Employment Certificate, Pay Slips or tax records etc).
Mitigation Process (Cost - US$3): If Veremark has difficulty in obtaining the verification or the client needs additional re-verification, the subject/candidate can be contacted for further information and Veremark will seek for alternative method to complete the verification. Additional (2) valid attempts within 5 business days will be made at an additional cost of US$3/ for each process undertaken (2 contact attempts)-.
e. Professional references
Professional references will be requested from the direct manager(s) and co-worker(s) whose contact information has been provide by the candidate. In the event that direct manager(s) and/or co-worker(s) are unresponsive to our requests for references, the service will be closed as “unverified, no response from reference”.
f. Personnel
Veremark will have a support team available for the Client’s day-to-day enquiries.
The client will maintain an accurate list of authorised personnel who are permitted to receive or access information on subjects/candidates/employees from the Veremark platform. Authorized user credentials and user permissions are required to access and use the Veremark platform.
The client will be provided with usernames and passwords for each Authorized user. Users will be provided training and supporting documentation for using the Veremark platform. Authorized users with appropriate permissions have the option to manage account user settings within the platform. Veremark will only take instructions and respond to queries from authorised personnel with valid Veremark user credentials. Instruction and queries can be submitted to Veremark by Fax, Post or Electronic mail.
g. Reporting and account management
At the conclusion of the background screening process, Veremark will provide the Client with a report that can be accessed within the platform.
For accounts, where an assigned account manager or client success manager has been allocated, for each period where the usage does not meet the agreed threshold to warrant the agreed price per check then a US$250 services fee for each month will be applied and reconciled at the end of each quarter.
h. General
If Veremark is required to amend the scope and or fees for services it provides under this Service Level Agreement, (with the exception of fees from courts, government agencies, educational institutions, third-party verification services and other data sources), Veremark will, where possible, give not less than thirty (30) days prior notice in writing to Client specifying the nature of the proposed amendment.
If such amendment is likely to result in any adverse change to the services, Client shall be entitled to reject the proposed amendment by notifying Veremark in writing no later than the expiry of the thirty (30) day notice period. The rejection of the amendment may not result in the reinstatement of the original scope.
All extra charges will have approval sought in line with the agreed amount included in Clause 4 – Fees and Payment.
i. Escalation Policy
Should any issues arise that require escalation, we maintain a comprehensive internal escalation process to ensure timely and effective resolution. Cases will be directed to the appropriate level for review and arbitration to reach a satisfactory outcome.'
Terms of Service Addendum: Personal Data
Last updated: January 13, 2025
Veremark Ltd (“us”,“our”, “we”, “Veremark”) acts as the processor of your personal data collected on behalf of third party organisations (Veremark's clients), using the Veremark service. Veremark's clients (your prospective or current employer) act as the data controllers.
Our Data Protection Policy (the “Policy”), which sets out the types of personal data we collect when you use the Service, or when organisations use it to verify details which you have provided to them, can be found here. At all times Veremark will operate as required by the applicableData Protection Laws relevant to your situation.
For Background Check Subjects ("Candidates")
How and why do we use/share your personal data?
Veremark will only use your Personal Data with your express consent that we collect from you prior to starting the Service. This consent is for the purpose of conducting verification and authenticity checks in respect of it. We carry out that activity on the premise that we have a lawful basis for making initial contact with you to communicate the commencement of a request for verification, and thereafter on the basis that you have consented to the relevant verification and authentication processes being carried out
Where could that information be transferred?
We do not share your personal data with third parties other than:
Veremark's Client: The organisation which originally requested verification and authenticity checks about you, i.e., your prospective or current employer. They will have obtained your consent as the DataController and given Veremark the written instruction to process this as per the Service ordered.
The organisation can view your data directly from their secure account on the Veremark Client Portal.
In some instances, the organisation may choose to download your data and retain it on their own systems.
We recommend you contact the organisation for further information about their data privacy policy.
Third Party Processors: Our carefully selected partners and service providers ("sub-processors") may process personal information about you on our behalf.
Some of our service providers may be based outside of the European Economic Area (the “EEA”).
These service providers may work for us or for one of our suppliers and may be engaged in, among other things, the fulfilment of your request for information and the provision of services or support services.
For additional information about data transfers see our Data Protection Policy.
To request a list of Veremark's data sub-processors please contact us at privacy@veremark.com.
Are we compliant with UK and EU GDPR?
Veremark is compliant with all Applicable Laws regarding the processing of your personal information on behalf of a data controller.
As a UK headquartered business our primary regulatory body is the ICO https://ico.org.uk/. We operate under the aegis of the UK GDPR and the UK has a GDPR adequacy decision from theEU so that data transfer between the UK and EU is expressly permitted and the regime is compliant with EU GDPR.
Whistleblowing Platform Security & Architecture
1. The supplied documents mention ‘The Veremark system’ — is this all services on one platform, or do different services run on separate platforms/environments within AWS?
The Whistleblowing SaaS system is an independent, standalone service separate from the core background screening application. Whilst both services reside within a unified global AWS infrastructure and share core Virtual Private Cloud network boundaries and baseline configurations, the Whistleblowing platform runs on its own isolated application tiers and distinct database instances.
2. If all services run on one platform/environment, does that still allow for separation of data deletion for background checks and whistleblowing services?
Yes. This strict logical and physical separation of databases allows independent configuration and enforcement of data retention, archival, and deletion policies specifically tailored to whistleblowing records without impacting background checking data.
3. How is data encrypted (AES-256 or greater)? Who has access to the keys used for encryption?
All data at rest—including database volumes, whistleblower submissions, attachments, and rolling backups—is encrypted using AES-256 cryptographic standards. Data in transit is secured using modern TLS (TLS 1.2 and TLS 1.3) protocols. Technical access to KMS keys is strictly restricted to a small group of vetted infrastructure engineers and DevOps personnel via granular AWS Identity and Access Management (IAM) role permissions adhering to least privilege.
4. What happens if an in-use encryption key is known to be compromised? Is existing data re-encrypted or is only new data encrypted using the new key?
If a key is identified as compromised, Veremark’s Key Management and Incident Response procedures are activated immediately. The compromised key is disabled, a newly provisioned master key is established, and all historical, persistent database records and stored attachments are systematically decrypted and re-encrypted under the replacement key to safeguard legacy data. Only ephemeral operational logs are excluded.
5. If using AWS, would this service be using the AWS key vault service to minimise manual keying?
Yes. The platform uses AWS KMS alongside AWS Systems Manager (SSM) Parameter Store and AWS Secrets Manager. Cryptographic keys and application credentials are systematically injected at deployment runtime, completely avoiding manual key generation or key handling.
6. What accounts are used to access the service for OASIS Team members (OASIS email addresses or personal accounts)?
All OASIS administrative and user accounts are provisioned exclusively using corporate OASIS email addresses. Each user must have an individual, named account issued via formal user-provisioning workflows. Personal email addresses, unverified domains, and generic shared logins are strictly banned.
7. Should OASIS wish to cancel the contract, when is OASIS data deleted from the system (including backups)?
Upon contract cancellation or formal written termination, live client production data is decommissioned and deleted as per the terms of the contract.
8. How is data deleted from the system?
Active database records are permanently deleted using transactional SQL drop and purge routines that overwrite database blocks. Cloud-hosted object storage files and detached volumes are deleted via secure AWS cryptographic deletion methods. Any retired hardware decommissioned by the underlying hosting provider undergoes certified physical destruction or degaussing.
9. What logging is there within the system? Does it record connection time/date, IP, etc.?
The Whistleblowing platform records comprehensive, tamper-evident audit logs. Captured event details include connection timestamp, calendar date, source IP address, browser type and version, operating platform, authenticated user identity (where non-anonymous), and the specific transactional action performed. Audit logs are preserved securely for a minimum of 90 days.
10. Does the system allow for anonymous whistleblowing?
Yes. The system is intentionally designed to support full whistleblower anonymity. Disclosing parties can lodge reports without providing any identifying personal attributes. Furthermore, the platform incorporates a secure, pseudonymous two-way communications channel allowing authorised investigators to correspond with the informant for evidence gathering without uncovering their identity.
11. How is OASIS data segregated from other clients?
Data segregation is enforced logically at both the application and database tiers. The application implements tenant-scoped database schemas, isolated tables, and mandatory row-level access controls governed by strict query filtering. Authorisation tokens prevent any cross-tenant data requests or unauthorised lateral movement between client records.
12. Do OASIS Team Members with elevated access to the system require MFA as part of their access to the system?
Yes. Multi-Factor Authentication (MFA) is strictly mandatory for all users who possess elevated, managerial, or administrative access to the client portal and case management console. Unauthenticated single-factor access to administrative features is technically prohibited.
13. Who in Veremark has access to OASIS-owned data within the whistleblowing service?
Access is governed by the Principle of Least Privilege and Role-Based Access Control (RBAC). Only a vetted subset of technical DevOps and support engineers with background-check clearance can access production systems, and exclusively on an exceptional, ticketed basis for diagnostic or troubleshooting requirements. Regular operational staff cannot view confidential client whistleblowing files.
14. Are these Veremark employees required to use MFA as part of their access to the platforms supporting the services and client portals?
Yes. Mandatory MFA is systematically enforced across all Veremark corporate identity providers, workstations, VPNs, cloud management interfaces, and underlying hosting infrastructure.
15. Is any OASIS production data used in test or development environments?
No. Veremark’s Information Security Management System strictly prohibits using live production data in non-production environments. Development, testing, and staging environments operate exclusively with synthetic, sanitised, or anonymised test fixtures.
16. What continuity controls are in place, should there be issues with AWS in Ireland? Does Veremark have the ability to use other cloud providers should there be a need for further resiliency?
All infrastructure is orchestrated via Terraform (Infrastructure as Code) across multiple AWS Availability Zones. In the event of catastrophic regional failure, snapshots can be deployed rapidly into an alternate European AWS region. In addition, because the core services run within portable Docker/Fargate microservice containers, the platform can be rebuilt on alternate cloud providers (such as Azure or GCP) if required.
17. Has Veremark suffered any data breaches of this service in the last 5 years?
No. Veremark has experienced zero (0) reportable security breaches or confirmed unauthorised data disclosure incidents affecting the Whistleblowing platform over the last five years.
18. How regularly do Veremark conduct audits/assessments against their vendors and suppliers of this service?
Veremark conducts third-party supplier risk reviews and security audits annually. Critical hosting and technical suppliers are assessed for SOC 2, ISO 27001, and GDPR compliance, alongside automated continuous vulnerability tracking.
19. Do Veremark require contractually that their vendors and suppliers maintain the same level of security as Veremark?
Yes. Veremark’s Supplier Code of Conduct and standard Data Processing Agreements require all third-party vendors and subcontractors to implement technical and organisational security controls equal to or exceeding Veremark’s own standards, including encryption, access controls, patching cadences, and prompt breach notification.
For Veremark Clients
To request a list of Veremark's data sub-processors please contact your Account Manager or email us at privacy@veremark.com.