Privacy
What we hold, and what we do with it.
The short version
- We are a recruitment agency. Employers pay us; candidates never do.
- We never share your assessment recording with an employer unless you have said yes to that specific employer, and you can withdraw that at any time.
- No person is rejected by a machine. AI helps mark; a human decides.
- We do not sell personal data, we do not share it for advertising, and we run no advertising cookies. Nothing is stored on your device for analytics until you say yes.
- Everything below is the long version. It is long because the alternative is a notice that says nothing.
Who we are
Rareix Ltd, a company registered in England and Wales, is the data controller for the personal data described in this notice. Controller means we decide why the data is used and how, and we carry the legal responsibility for it. Our registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.
We are not required to appoint a Data Protection Officer and we have not appointed one. Responsibility for this notice, and for anything you want to ask about it, sits with the company’s directors at hello@rareix.com. That address reaches a person, not a queue.
What this notice covers
This website and the job description generator on it, the full assessment, and everything we do to introduce a candidate to an employer. It does not cover what an employer does with your data after we introduce you: at that point they are a controller in their own right, deciding their own purposes, and their own privacy notice applies. We tell you which employer before anything is shared, so you always know whose notice to ask for.
Who this applies to
Three groups give us data and we treat them differently.
- Candidates. People who sit our assessment, or whom we approach about a role.
- Employers. Clients and prospective clients hiring through us, including individual staff at those companies.
- Visitors. Anyone reading this website.
What we collect
Candidates
- Name, email, phone, and the location and right-to-work position you tell us about.
- Work history, CV, and any professional profile you share or make public, including a LinkedIn URL if you give us one.
- What you tell us about what you are looking for: desired salary, and how ready you are to move.
- Your assessment answers and your score against the standard.
- A screen and audio recording of the assessment session, including your voice and, if you turn a camera on, your image.
- Notes from our conversations with you, and the record of what you have consented to and when.
We do not run proctoring, keystroke logging or webcam monitoring, and we do not scan your machine. The recording is of the session you are in, and nothing else.
Employers
- Name, work email, phone, job title and company.
- What you tell us about a role, a team, a budget or a candidate, including a job description you paste into an enquiry.
- Contract, billing and payment records.
Visitors
- If you accept analytics cookies: pages viewed, referrer, approximate location derived from IP, and device type. If you reject, or never answer, none of this is collected and no analytics script is downloaded.
- Standard server and network logs kept by our hosting provider, including IP address, to serve the site and to keep it up. These are short-lived and we do not mine them.
- Whatever you put in an email you send us, or in a form on this site.
The job description generator runs entirely in your browser. What you type into it is not sent to us, and does not leave your device, unless you fill in the form that asks for your details, which is optional, and which we tell you about at the point it appears.
Where candidate data comes from
Not all of it comes from you directly, and you are entitled to know that.
- From you. When you book an assessment, apply, or email us.
- From public professional sources. Professional networks, job boards and public profiles, when we are researching who might suit a role. What we take is your name, your role history and a way of contacting you.
- From an employer. Where a client asks us to assess someone who has already applied to them directly.
- From a referral. Where someone recommends you to us.
Where we get your data from somewhere other than you, we will tell you within one month of getting it, or at our first contact with you if that is sooner, and we will tell you where it came from. That is Article 14 and we treat it as a hard rule, not a courtesy.
Why we use it, and our lawful basis
| What we do | What that involves | Lawful basis |
|---|---|---|
| Assess a candidate, mark the work, produce a score | Assessment answers, score, rubric version | Legitimate interests: providing the recruitment service the candidate has asked for and the employer has engaged us for |
| Make and store the screen-and-audio recording of a session | Voice, screen, optionally image | Consent, given before the session starts and withdrawable at any time |
| Share a recording, score or interview guide with a named employer | The recording, the score, the guide | Consent, given for that specific employer and withdrawable at any time |
| Approach a candidate about a role, and match people to roles | Name, contact details, role history, preferences | Legitimate interests: connecting people with relevant work |
| Answer an enquiry from this site or by email | Whatever the form or the email contains | Legitimate interests, and steps at your request before a contract |
| Run the client relationship, invoice, and get paid | Contact, contract and billing records | Contract, and legitimate interests before a contract exists |
| Market to employers | Work email, company, role | Legitimate interests, within the business-email rules in PECR, with an unsubscribe in every message |
| Market to candidates | Name and email | Consent, with an unsubscribe in every message |
| Analytics cookies | Pages viewed, referrer, device, approximate location | Consent, under PECR regulation 6 |
| Keep the site up, and keep it secure | Server logs, IP address | Legitimate interests: running a service that works and is not abused |
| Keep accounting, tax and agency records | Invoices, contracts, placement records | Legal obligation, including the record-keeping duties that apply to employment agencies |
| Establish, exercise or defend legal claims | Whatever the claim concerns | Legitimate interests, and legal obligation where a court or regulator requires it |
Where we rely on legitimate interests we have weighed our interest against your rights and recorded the result, and you can object at any time using the contact address below. Where we rely on consent, refusing or withdrawing it costs you nothing else: a candidate who declines the recording can still be represented by us, a candidate who withdraws it does not lose a score already earned, and a visitor who rejects cookies gets exactly the same site.
The assessment recording
This is the most sensitive thing we hold, so it has its own rules.
- We tell you before the session starts that it is being recorded, and it does not start without your consent.
- It is shared with an employer only after you consent to that named employer. Consenting once is not consent for anyone else. We ask every time.
- You can withdraw consent at any point, including after a placement, and we stop sharing it. Withdrawal does not undo sharing that has already happened, and we will tell you who already has it.
- A score below the bar is never shared with an employer, and never published.
- We do not use recordings to train any model, ours or anyone else’s, and our contracts with providers say so.
- You can ask us to delete the recording and we will, subject only to anything we are legally required to keep.
Sessions are currently captured using a third-party meeting-recording provider, Fireflies.ai. We intend to replace this with our own tool. When we do, this notice will be updated before the change takes effect, and recordings already made will stay under the terms you agreed to.
AI, and how decisions actually get made
We use AI to help mark assessments against a written rubric, and to help draft interview guides. This does not mean a machine decides your future.
- No score is shared with an employer, and no candidate is set aside, without a human reviewing it first. We make no decisions producing legal or similarly significant effects about you by automated means alone, which is what Article 22 is concerned with.
- You can ask a human to review any score, tell us why you think it is wrong, and have that considered. Every score is stamped with the rubric version that produced it, so a challenge has something concrete to argue with.
- Marking runs on a commercial AI provider’s API under a contract that bars the provider from training its models on the data. We will tell you which provider we use if you ask, and we will name it here if that ever stops being a question we can answer on request.
- We do not profile you for advertising, and we do not sell or share any output of the marking process to anyone other than an employer you have named.
Special category and criminal offence data
We do not ask for data about your health, ethnicity, religion, sexual orientation, trade union membership, sex life or political views, and you should not include it in an assessment. If you volunteer it, for example a reasonable adjustment you need for the assessment, we use it only for that purpose, on the basis of your explicit consent, and we delete it when it is no longer needed. Any diversity monitoring we run is voluntary, separate from your assessment, and reported only in aggregate.
We do not run criminal record checks and we do not ask you about convictions. If a client requires a check for a particular role, they run it themselves, as controller, under their own policy, and we do not see the result.
Who we share it with
Employers, with your consent, as set out above. They act as their own controller from that point.
Our processors, who hold or handle data only on our written instructions, under contracts meeting Article 28. These are the ones that matter:
| Who | What they do for us | Where the data sits |
|---|---|---|
| Vercel | Hosts this website and serves it; keeps short-lived request logs | United States, served from a global edge network |
| HubSpot | Our CRM, and the destination for every form on this site | HubSpot’s EU data centre. Our account is configured to it, and forms post to the EU endpoint rather than the default one |
| Workspace email and documents; Google Analytics, if you accept it; the web fonts this page uses | EU and United States | |
| Fireflies.ai | Records assessment sessions | United States |
| Our AI marking provider | Runs the marking model against the rubric, contractually barred from training on the data | United States; named on request |
Candidate records, meaning CVs, notes, scores and consent records, live inside the accounts above. We do not keep a separate copy with any other provider, and if that changes this table changes with it. Loading this page also discloses your IP address to Google, because the fonts are served from Google’s domains; that happens whether or not you accept cookies, and we say so rather than leave it out.
Our professional advisers, meaning accountants, lawyers, insurers and our bank, where they need it, each under their own duty of confidence.
Anyone we are legally required to disclose to, such as a regulator, a court, HMRC, or a purchaser if the business is ever sold or reorganised, in which case we will tell you before your data moves.
We do not sell personal data, we do not share it for advertising, and we do not run advertising cookies. A current list of our processors is available on request.
Where your data goes
Several of the providers above are based in the United States. Where personal data leaves the UK we rely on the UK’s adequacy regulations where they apply, the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us which mechanism covers a particular provider and we will tell you which one, not just that there is one.
How long we keep things
| What | How long | Why that long |
|---|---|---|
| Assessment recordings | 24 months from the session, or sooner if you ask | Long enough to be useful across a search and a placement guarantee; not a permanent archive of your voice |
| Scores and assessment answers, anonymised | Indefinitely, with identifying details removed so they are no longer personal data | The published standard can only be checked against everyone who has sat it |
| Candidate records: CV, notes, contact details, consent records | 24 months from our last meaningful contact, then deleted unless you ask us to keep them | Hiring cycles are long, and a record you cannot find is a candidate we contact twice |
| Employer contact and relationship records | For the life of the relationship, then 24 months | Ordinary account management, and the tail of a finished engagement |
| Contracts, invoices and accounting records | 6 years from the end of the relevant financial year | Tax and company law require it |
| Placement and introduction records | 6 years | Agency record-keeping duties, and the limitation period for a contractual claim |
| Email correspondence | 24 months, unless it forms part of a contract or a dispute | Beyond that it is clutter with a risk attached |
| Marketing preferences and unsubscribes | Indefinitely | The only way to honour an unsubscribe is to remember it |
| Analytics data | 14 months | Enough for a year-on-year comparison, and no more |
| Server and request logs | Short-lived, as our hosting provider retains them | Operational and security use only |
At the end of a period we delete or anonymise. Anonymising means the record can no longer be connected to you by us or anyone else, not that we have removed your name and kept the rest.
Cookies and local storage
This site loads no analytics and sets no analytics cookies until you accept them. Rejecting is one click, exactly like accepting, and the Google Analytics script is not downloaded at all unless you opt in. You can change your mind at any time using the cookie control in the footer of every page. This is everything the site puts on your device:
| Name | Kind | What it is for | Lasts |
|---|---|---|---|
| rareix.consent | Local storage, essential | Remembers whether you accepted or rejected analytics, so we do not ask again | Until you clear it or change your choice |
| rareix:cur | Local storage, essential | Remembers the currency you chose on the pricing comparison | Until you clear it |
| rareix.jd.unlocked | Session storage, essential | Remembers that you have already completed the job description generator’s form in this tab | Until you close the tab |
| _ga, _ga_… | Cookie, analytics | Google Analytics: tells one visit apart from another | Set only if you accept. Google states these last up to 2 years |
We do not load HubSpot’s tracking script, so HubSpot sets no cookies here. If a HubSpot cookie is already on your device from somewhere else, a form you submit will carry it so that HubSpot can join the submission to your session, and only if you have accepted analytics. Google Analytics derives an approximate location from your IP address; Google states that it does not log or store IP addresses in Analytics 4.
Marketing
We may email employers about our service on the basis of legitimate interests and the business-to-business rules in PECR. We email candidates about roles or updates only if they have opted in. Every marketing message carries a one-click unsubscribe, unsubscribing takes effect immediately, and it never affects an application, an assessment or a placement.
Security
Access to candidate records and recordings is limited to the people who need it, protected by multi-factor authentication, and data is encrypted in transit and at rest by our providers. We review who has access when someone joins or leaves. No system is perfect; if a breach puts your rights at risk we will report it to the ICO within 72 hours of becoming aware of it, and tell you directly, without undue delay, where the risk to you is high.
Your rights
You can ask us to:
- Give you a copy of what we hold about you, and tell you what we do with it.
- Correct anything that is wrong, or complete anything that is partial.
- Delete it. This one is not absolute, because we cannot delete an invoice tax law requires us to keep. We will tell you plainly which parts we are keeping and why.
- Restrict what we do with it while a question about it is resolved.
- Send it to you or another provider in a portable, machine-readable format. This applies to data you gave us that we hold on the basis of consent or a contract.
- Stop processing it where we rely on legitimate interests. For direct marketing this is absolute: ask, and we stop. For anything else we weigh your objection against our grounds and explain the outcome.
- Withdraw a consent you have given, including consent to a recording or to a particular employer. Withdrawal is as easy as giving it, and it does not make what we did beforehand unlawful.
- Have a human look at a score, hear your side of it, and reconsider.
Email hello@rareix.com, or write to us at the address at the foot of this notice. It costs you nothing, and we respond within one month. If a request is genuinely complex we may extend that by up to two further months, and we will tell you inside the first month if that happens. We may ask you to confirm your identity before we hand anything over, and if we cannot do what you have asked we will say so and say why.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you came to us first, but you do not have to, and complaining to them does not stop you from also raising it with us.
Age
Our service is for people aged 18 and over. We do not knowingly assess anyone younger.
Changes
This notice is dated at the top. If we change how we use personal data in a way that affects you, whether that is a new processor holding recordings, a new purpose or a shorter retention period, we will update this page and tell affected candidates and clients directly before the change takes effect. We will not rely on a silent edit to a web page as notice of something that matters.
Contact
hello@rareix.com for anything on this page, including a deletion request, a question about which provider holds what, or a challenge to a score. If you would rather write, the postal address is Rareix Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, though email reaches us sooner and we answer it the same way.