Terms, Privacy
& Cookies.

These Terms & Conditions ("Terms") govern access to and use of the Migrato platform operated by SapX Ltd. By accessing or using Migrato, you agree to be bound by these Terms.

Users of the platform include:

• Candidates (job seekers)
• Recruiters and Employers
• Affiliates and Network Partners
• Dormant Database Providers

Migrato is a talent visibility and access platform. It does not act as an employer, recruiter, or employment agency. Nothing in these Terms creates employment, worker status, agency, partnership, joint venture, or any other relationship between SapX Ltd and any user.

Migrato does not guarantee job placements, interviews, hiring outcomes, or commercial performance of any kind.

All users must provide accurate, complete, and up-to-date information. Migrato may approve, reject, suspend, or remove access at its sole discretion. Migrato is not required to provide reasons for any such decisions.

Approval decisions may consider identity verification, right to work status, business legitimacy, compliance and legal risk, platform integrity, and reputational considerations. Applications may be delayed or declined where information is incomplete, identity cannot be verified, or quality standards are not met.

Before a public profile is created, the registration form will clearly identify that the profile is public and will require an affirmative opt-in. You must actively confirm that:

• you understand that the selected profile information will be publicly available;
• you are comfortable being discovered and contacted by employers, recruiters and other relevant organisations;
• you have reviewed the information you are submitting and are authorised to publish it;
• you accept these Terms and the Privacy Policy; and
• you understand that public information may be indexed, cached, copied or shared by third parties outside Migrato's direct control.

Consent to a public profile is optional and is separate from any consent used for marketing communications. Refusing public-profile consent will not prevent you from choosing an available private or anonymised profile route.

Recruiters and employers must provide accurate business information and may be subject to verification. Access to candidates is provided via subscription and unlock credits.

Users who wish to activate an existing candidate database through Migrato must have lawful permission to contact those individuals and must comply with UK GDPR and PECR in doing so.

Migrato enables opt-in invitations, candidate reactivation, and visibility within the platform. Migrato does not take ownership of any external database.

Affiliates operate as independent referrers and are not employees, workers, or agents of SapX Ltd. Affiliates receive a unique referral link and may promote Migrato independently. They are solely responsible for their own promotional activity.

Users must not provide false information, misuse or extract data, attempt to bypass the platform, or enter into off-platform arrangements that circumvent Migrato's commercial model. Breach of these obligations may result in suspension, termination, and forfeiture of fees or commission.

Fees include subscriptions, unlock credits, and any additional services. All fees are payable in advance and are non-refundable once access has been granted, except where a replacement credit applies (see clause 9).

Migrato may change its pricing or commercial structure at any time. Continued use of the platform following any pricing change constitutes acceptance.

Where a recruiter or employer unlocks a candidate profile and that candidate is found to have materially misrepresented their information, Migrato may, at its discretion, issue a replacement credit equivalent to one unlock credit.

A replacement credit:

• Is issued at Migrato's discretion following review of the reported misrepresentation
• Does not constitute a monetary refund
• Is valid for use within the current billing cycle
• Is non-transferable and has no cash value
• May only be claimed once per unlocked profile

Where a replacement credit is issued, the candidate in question will be removed from the platform and permanently blocked from returning.

Migrato operates on a reasonable-efforts basis. SapX Ltd is not liable for hiring outcomes, user conduct, third-party service failures, or any indirect or consequential loss arising from use of the platform.

Users agree to indemnify SapX Ltd against any claims, losses, or costs arising from their misuse of the platform or breach of these Terms.

All platform content, design, code, copy, and materials are owned by SapX Ltd. Users are granted a limited, non-exclusive, revocable licence to access and use the platform for its intended purpose. No other rights are granted.

• Suspension & Termination (12): Migrato may suspend or terminate access at any time without notice.
• Monitoring (13): Migrato may monitor platform use for compliance and quality assurance.
• Assignment (14): Migrato may transfer these Terms as part of a business sale or restructuring.
• Amendments (15): Terms may be updated at any time. Continued use constitutes acceptance of updated Terms.
• Governing Law (16): These Terms are governed by the laws of England and Wales. Any disputes are subject to the exclusive jurisdiction of the courts of England and Wales.
• Entire Agreement (18): These Terms, together with the Privacy Policy and Cookie Policy, form the entire agreement between you and SapX Ltd.
• Severability (19): If any provision is found to be invalid or unenforceable, the remainder of these Terms remains in full effect.
• No Waiver (20): Failure by Migrato to enforce any provision of these Terms does not constitute a waiver of that right.
• Acceptance (21): By using Migrato, you confirm that you have read and understood these Terms, agree to be bound by them, and accept any future updates.
• Products & Services (22): Migrato reserves the right to add, remove, or change any product, service, feature, commission rate, or pricing structure at any time, without prior notice. It is the responsibility of affiliates, database partners, and all other users to check the current pages on migrato.io for up-to-date information before relying on or promoting it.

For a public profile, Migrato relies on your explicit, informed and freely given consent to publish the profile information selected in the registration form. The form will use a clear unticked opt-in and will link to these Terms and the Privacy Policy before submission.

The categories of information made public will be shown in the form before you submit it. Depending on the profile service selected, this may include your name, photograph, professional headline, location or preferred work area, employment history, skills, qualifications, achievements, availability, professional links and contact route.

We will keep an auditable record of the wording presented, the consent given, the date and time of submission and the version of the applicable terms. Public-profile consent will not be bundled with unrelated marketing consent.

• Purpose: to allow your professional experience and availability to be discovered by employers, recruiters and other relevant organisations.
• Visibility: public profiles may be accessible globally and may be indexed by search engines.
• Withdrawal: you may withdraw consent at any time, without affecting processing that was lawful before withdrawal.
• Erasure and correction: you may request removal or correction, subject to applicable legal exceptions and identity verification.
• Third-party copies: we cannot fully control copies, caches or republication created by third parties while the profile was public.

SapX Ltd processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. SapX Ltd is the data controller for personal data collected and processed through the Migrato platform.

If you have any questions about how your data is used, please contact us at contact@migrato.io.

• Candidates: Name, contact details, CV, employment history, skills, salary expectations, right to work status, identity verification data, availability, and platform activity.
• Recruiters & Employers: Business name, contact details, subscription and billing data, unlock activity, and platform usage data.
• Affiliates & Database Partners: Name, contact details, referral tracking data, earnings data, and payment information.
• All users: Device data, IP address, browser type, and usage analytics collected through cookies and tracking technologies.

We process your personal data on the following lawful bases under UK GDPR:

• Contract (Article 6(1)(b)): Processing necessary to provide platform services to candidates, recruiters, employers, affiliates, and database partners.
• Legitimate Interests (Article 6(1)(f)): Platform security, fraud prevention, quality assurance, analytics, and improving the service.
• Legal Obligation (Article 6(1)(c)): Compliance with applicable law, including financial record-keeping and identity verification obligations.
• Consent (Article 6(1)(a)): For non-essential cookies and marketing communications, where consent is obtained.

Identity verification data constitutes special category data in some circumstances. Where applicable, it is processed under Article 9(2)(b) (employment and social security law obligations) or with explicit consent.

Data is used for:

• Providing and operating the Migrato platform
• Verifying identity and right to work
• Matching candidates with recruiters and employers
• Processing unlock transactions and subscriptions
• Tracking affiliate referrals and calculating earnings
• Communicating with users about their account and activity
• Compliance, fraud prevention, and platform integrity
• Analytics and platform improvement

Personal data may be shared in the following circumstances:

• Between users: Candidate details are shared with recruiters and employers only once a profile is unlocked. Anonymised summaries may be visible prior to unlocking.
• Service providers: We share data with third-party processors who support platform operations, including payment processing (Stripe), hosting, and analytics. All processors are bound by appropriate data processing agreements.
• Legal requirements: We may disclose data where required by law, court order, or regulatory authority.
• Business transfers: In the event of a sale, merger, or restructuring of SapX Ltd, data may be transferred as part of that transaction.

We do not sell personal data to third parties.

All payments on the Migrato platform are processed by Stripe Payments Europe Ltd. When you make a payment, your payment card data is submitted directly to Stripe and is not stored by SapX Ltd. Stripe processes your payment data as a data controller in its own right, subject to its own privacy policy.

Stripe may transfer data internationally in connection with the provision of its payment services. By making a payment through Migrato, you acknowledge Stripe's role as payment processor and its applicable terms.

Identity data submitted for verification purposes is used solely to verify a candidate's identity and right to work. It is:

• Not shared with recruiters or employers
• Not retained longer than necessary for verification
• Securely deleted once verification is complete
• Processed in accordance with applicable identity verification obligations

Some of our third-party service providers may process data outside the UK or European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs), to protect your data in accordance with UK GDPR requirements.

Stripe, as our payment processor, may transfer data internationally as part of its global operations. Details of Stripe's transfer mechanisms are available in its privacy policy at stripe.com/en-gb/privacy.

We retain personal data only for as long as necessary to provide the service and comply with legal obligations. Indicative retention periods:

• Candidate profiles: Retained while active on the platform. Deleted or anonymised upon request or following a defined period of inactivity.
• Recruiter & employer accounts: Retained for the duration of the subscription and for a reasonable period thereafter for legal and accounting purposes.
• Affiliate & partner data: Retained for the duration of the affiliate relationship and for as long as required to settle earnings and comply with financial record-keeping obligations.
• Identity verification data: Deleted securely following successful verification.
• Financial records: Retained for a minimum of 6 years in accordance with HMRC requirements.

Under UK GDPR, you have the right to:

• Access, request a copy of the personal data we hold about you
• Rectification, request correction of inaccurate or incomplete data
• Erasure, request deletion of your data, subject to legal retention obligations
• Restriction, request that we limit processing of your data in certain circumstances
• Portability, receive your data in a structured, machine-readable format
• Objection, object to processing based on legitimate interests
• Withdraw consent, where processing is based on consent, you may withdraw at any time

To exercise any of these rights, contact us at contact@migrato.io. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

SapX Ltd applies reasonable and appropriate technical and organisational safeguards to protect personal data against unauthorised access, loss, or disclosure. These include encryption of data in transit, access controls, and secure deletion practices.

Absolute security cannot be guaranteed. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

Cookies are small text files placed on your device when you visit a website. They allow the platform to remember information about your visit, such as your preferences and session state. Some cookies are essential for the platform to function; others are used for analytics, tracking, or personalisation.

Under the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, we are required to obtain your consent before placing non-essential cookies on your device. When you first visit Migrato, a cookie consent banner will be displayed. You may:

• Accept all cookies, enable essential, analytics, and tracking cookies
• Accept essential cookies only, enable only strictly necessary cookies
• Manage preferences, choose which categories of cookie to allow

Essential cookies are placed without consent as they are strictly necessary for the platform to function. Non-essential cookies are only placed once consent is given. You may withdraw or change your cookie preferences at any time via the cookie settings link in the page footer.

When a user clicks an affiliate or database partner referral link, a tracking cookie is placed on their device for up to 60 days. This cookie records which affiliate or partner referred the user, enabling accurate commission attribution.

Attribution operates on a last-click basis, the most recent affiliate link clicked before registration will be attributed the referral. Attribution is time-limited and is determined solely by Migrato's tracking systems.

Tracking may not function correctly where:

• Cookies have been disabled or cleared by the user
• The user switches to a different device
• A browser extension blocks tracking
• The 60-day attribution window has expired

Migrato cannot guarantee attribution in these circumstances and commission eligibility will not apply where attribution cannot be confirmed.

You can manage or disable cookies at any time through:

• Cookie settings, use the cookie preference centre accessible via the footer of any Migrato page
• Browser settings, most browsers allow you to block or delete cookies via settings. Instructions vary by browser
• Opt-out tools, for Google Analytics, visit tools.google.com/dlpage/gaoptout

Please note that disabling essential cookies will impair or prevent the platform from functioning correctly. Disabling tracking cookies will affect affiliate attribution as described in clause 4.