Privacy Notice

1. Who we are

RISE2.WORK LTD ("Rise2.Work", "we", "us" or "our") operates the Rise2.Work platform. For the personal information described in this notice, RISE2.WORK LTD is generally the data controller. This means we decide why and how that information is used.

Registered office: 10 Tape Lane, Hurst, RG10 0DP

Website: www.rise2.work

Privacy contact: privacy@rise2.work

We have not appointed a Data Protection Officer. Privacy enquiries and requests should be sent to privacy@rise2.work.

2. Who can use Rise2.Work

You must be at least 16 years old to create a Rise2.Work account. During registration, users are required to confirm that they are aged 16 or over. We do not currently require a full date of birth simply to create an account.

We apply privacy-protective settings and data-minimisation principles across the service. Every Workforce Member profile is hidden by default, including profiles belonging to users aged 16 and 17.

3. The users of Rise2.Work

Workforce Members are individuals who create profiles about their strengths, qualities, experience, aspirations and availability. Workforce Partners are organisations or employers that register with Rise2.Work. Workforce Partner accounts must be approved by Rise2.Work before they can access Workforce Member discovery and profiles.

4. Personal information we collect

4.1 Workforce Members

• name and email address;
• account, authentication and security information;
• city or general location and a partial/outward postcode (for example, RG10), not a full postcode;
• profile photograph, where provided;
• transferable strengths, qualities and personal attributes selected or provided by the Member;
• education, work, volunteering, achievements, caring, sporting or other life experience, but only where the Member chooses to describe it in their profile text;
• profile biography, story and other profile information;
• career goals and what the Member is working towards;
• answers about what gives the Member satisfaction;
• availability, work preferences and types of opportunities sought;
• records of acceptance of our Terms and acknowledgement of privacy information, including version and date/time where recorded;
• marketing preferences and changes to those preferences; and
• technical, security and service information generated as necessary to operate, secure and support the platform.

4.2 Workforce Partners

• email address;
• organisation or company name;
• contact email and account details;
• registration date;
• approval or rejection status and related administrative records;
• account, authentication and security information;
• a simple record that the Partner carried out a search or viewed a Member profile in Discover (we do not record what was searched for or which Member profile was viewed); and
• communications with Rise2.Work.

4.3 Information we ask you not to provide

Rise2.Work is not designed to collect special category or other highly sensitive information through ordinary Member profiles. Please do not include unnecessary information about health, ethnicity, religion or beliefs, political opinions, trade union membership, genetic or biometric data used for identification, sex life or sexual orientation, or other highly sensitive matters in free-text profile fields. Please also avoid unnecessary criminal-offence information.

If sensitive information is submitted unexpectedly, we may remove it where appropriate and will assess the lawful basis and safeguards required before any further use.

5. Where we obtain information

Most personal information is provided directly by you when you register, build or edit a profile, change account settings, contact us, or otherwise use Rise2.Work. We also generate or receive limited technical, authentication, security and service information through the operation of the platform and our service providers.

If we later obtain personal information about you from another source, we will provide any additional privacy information required by law, including information about the source, unless an applicable exemption applies.

6. How and why we use personal information

7. Legitimate interests and younger users

Where we rely on legitimate interests, our interests may include operating and improving a safe and useful workforce platform, verifying Partners, preventing unauthorised access or misuse, securing the service, supporting users, maintaining appropriate records and protecting our legal rights.

We consider whether the processing is necessary and balance our interests against the rights, interests and reasonable expectations of the person concerned. We give particular weight to the rights and interests of users aged 16 and 17. We do not rely on legitimate interests where those interests are overridden by the individual’s rights and freedoms.

8. What information approved Workforce Partners can see

Every Workforce Member profile is hidden by default. A Member must actively choose to make their profile visible before an approved Workforce Partner can discover or view it. Member profiles are not intended to be publicly available on the open internet or indexed for public discovery.

If a Member chooses to make their profile visible, approved Workforce Partners may see information the Member has chosen to include, such as their name, profile photograph, city or general area, transferable strengths, qualities, anything they have written about their education, experience, achievements or life experience, profile story, career goals, work preferences and availability.

Approved Workforce Partners do not receive a Member’s email address or full postcode through the Member discovery profile. Rise2.Work currently collects only a partial/outward postcode for Member location. The platform currently supports discovery using criteria such as general location and strengths. Unapproved Partner accounts cannot access Member discovery or Member profiles.

You can change your profile visibility setting at any time. If you hide your profile again, approved Workforce Partners will no longer be able to discover or view it. Hiding your profile does not delete your account or the information saved in your profile. If we are told about, or find, content on a visible profile that should not be shown to Workforce Partners, we may set that profile to private and prevent it from being made visible while we look into it.

If you want your account and associated profile information permanently removed from the live service, you can use the Delete Account function described in section 15.

9. Marketing and communications

Marketing is separate from joining Rise2.Work. The marketing option is intended to be optional and unticked by default. You do not need to agree to marketing to create an account or use the core service.

If you choose to receive marketing, we may record when consent was given or changed. You can withdraw marketing consent at any time through available account settings or by contacting privacy@rise2.work. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Account verification, password resets, security alerts and other essential service communications are not marketing and may still be sent where necessary to operate or protect your account.

10. Children and young people aged 16 and 17

Rise2.Work is intentionally available from age 16. We recognise that users aged 16 and 17 are children for UK data protection purposes and require particular protection. We therefore minimise the information we collect, do not collect a full postcode for Member location, restrict profile access to approved Workforce Partners, keep marketing optional, avoid behavioural advertising or tracking, and provide accessible ways to exercise privacy rights. Every Workforce Member profile is hidden by default, regardless of age, and a Member must actively choose to make it visible to approved Workforce Partners.

We assess the privacy risks to younger users as part of our data protection impact assessment and review those safeguards as the service develops. If you are 16 or 17, please read the information shown when changing privacy settings so you understand what will become visible. If anything is unclear, you can contact us at privacy@rise2.work or discuss it with a parent, carer or other trusted adult before changing the setting.

11. Profile photographs and user-provided content

A Workforce Member may choose to upload a profile photograph and provide profile content. A profile remains hidden unless the Member actively makes it visible. Information deliberately included in a visible profile may then be seen by approved Workforce Partners as described above. Profile photographs are kept in private storage and are shown only through short-lived links, to you and, while your profile is visible, to approved Workforce Partners. Members should only upload content they are entitled to use and should not include sensitive personal information, a full address, or anything they would not want an approved Workforce Partner to see.

12. Who we share personal information with

We do not sell Workforce Member personal information.

• Approved Workforce Partners, for the limited purpose of discovering and viewing Member profiles that the Member has actively chosen to make visible, as described in this notice.
• Supabase, which provides database, authentication and file-storage infrastructure used by Rise2.Work.
• Vercel, which provides hosting and application delivery infrastructure for Rise2.Work.
• Resend, which provides email-delivery services. Information processed for an email may include the recipient email address, message content and delivery-related metadata.
• Professional advisers and service providers where reasonably necessary and subject to appropriate confidentiality and data protection arrangements.
• Courts, regulators, law-enforcement bodies or other authorities where disclosure is required or permitted by law.
• A purchaser, investor or successor organisation in connection with a genuine merger, acquisition, restructuring, financing or sale, subject to appropriate safeguards and applicable law.

We require processors acting on our behalf to process personal information under appropriate contractual and data protection terms. We review relevant supplier arrangements as the platform develops.

13. International transfers

Rise2.Work uses suppliers whose processing may take place outside the United Kingdom.

The primary database for the Rise2.Work production project in Supabase is configured in West EU (Ireland). Supabase may also use authorised subprocessors and processing facilities in other locations in accordance with its contractual terms.

Vercel states in its Data Processing Addendum that its primary processing facilities are in the United States and that it and its subprocessors may process data in other locations. Resend’s contractual documentation also provides for processing in the United States and the use of authorised subprocessors.

Where a transfer of UK personal information is a restricted transfer, we use or rely on an appropriate transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Addendum or other UK-approved contractual safeguards. Our current supplier documentation includes contractual transfer protections for relevant international transfers.

You may contact privacy@rise2.work for further information about relevant transfer safeguards and how to obtain a copy of them, subject to any lawful confidentiality restrictions.

14. How long we keep personal information

We generally retain account and profile information while your Rise2.Work account remains open and for as long as it is reasonably necessary to provide the service. This reflects the fact that Members may return to their profile at different stages of their working life.

We may periodically review inactive accounts and our retention arrangements. When information is no longer required, we will delete or anonymise it, subject to any information we need to retain for legal or regulatory requirements, security, fraud prevention, resolving disputes, establishing or defending legal claims, or maintaining necessary business records.

Our service providers may retain limited copies in secure backups or logs for their normal backup, security and legal-retention periods. Those copies remain subject to applicable contractual and legal protections and are deleted or overwritten in accordance with the relevant provider’s processes.

15. Deleting your account

You can use the Delete Account function to delete your Rise2.Work account. The current deletion process is designed to remove the account and associated personal information, including login/authentication information, profile information, profile photograph, partial postcode/location information, strengths, career information, availability and consent/preference records.

If a Workforce Partner has previously been reviewed, a limited internal record that a Partner was approved or rejected on a particular date may remain. The current system is designed so that this residual record does not retain the person’s name or email address and instead contains an orphaned internal reference.

Deletion from the live service may not result in immediate removal from every secure backup. Limited information may also be retained where required by law or reasonably necessary for security, fraud prevention, disputes or legal claims.

16. Security

We use appropriate technical and organisational measures intended to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. Measures include secure authentication, access controls, restricted administrative access, encryption provided through our infrastructure, secure communications, monitoring, backups and resilience measures.

No internet service can guarantee absolute security. You are responsible for keeping your password and account credentials confidential and should contact us promptly if you believe your account has been compromised.

17. Cookies and similar technologies

Rise2.Work currently uses technology necessary to authenticate users, maintain signed-in sessions and operate the service. Strictly necessary technologies may be used without consent where permitted by law, but information about their use will still be provided where required.

Rise2.Work does not currently use advertising or behavioural-tracking cookies. The /join route currently records a simple visit count designed not to use cookies or identify the individual visitor.

If we introduce non-essential analytics, advertising, tracking or similar technologies in future, we will assess the applicable privacy and electronic communications requirements and, where required, obtain consent before using them.

18. Automated decision-making and profiling

Rise2.Work does not currently make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects. Workforce Partner approval is a manual process.

Search and discovery may use profile information such as strengths and general location to help approved Workforce Partners find Members. This does not amount to a guarantee of employment, interview, selection or any other outcome. If we introduce significant automated decision-making or profiling in future, we will assess the legal and privacy implications and provide the information required by law before using it.

19. Is providing information mandatory?

Some information is required to create and operate a Rise2.Work account, such as an email address, account credentials, confirmation that you are at least 16 and acceptance of the applicable Terms. Other profile information may be optional or necessary only if you want to use a particular feature. Where information is required, the registration or profile process will indicate this where appropriate.

You are not required to consent to marketing in order to join Rise2.Work. If you do not provide information necessary for a core feature, we may be unable to provide that feature or create the relevant account.

20. Your data protection rights

Depending on the circumstances and the lawful basis we rely on, you may have the right to:

• be informed about how we use your personal information;
• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase personal information in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to certain processing;
• receive certain personal information in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller;
• withdraw consent at any time where we rely on consent; and
• raise a concern or complaint about our use of your information.

These rights are not absolute and may depend on the circumstances and lawful basis. We may need to verify your identity before acting on a request. To exercise a right, email privacy@rise2.work. We will respond within the time required by applicable law.

21. Your right to object

YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE USE OF YOUR PERSONAL INFORMATION FOR DIRECT MARKETING. If you object, we will stop using your personal information for that purpose.

You may also have the right to object where we rely on legitimate interests. In that case, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

22. Complaints

If you are concerned about how we use your personal information, please contact us first at privacy@rise2.work so that we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. Information about making a complaint is available at ico.org.uk. You do not have to contact us before making a complaint to the ICO.

23. Third-party links and independent organisations

Rise2.Work may contain links to websites or services operated by other organisations. Where another organisation determines how and why it uses personal information, it acts independently and its own privacy information applies. We are not responsible for the privacy practices of independent third-party websites or services.

24. Changes to the service

Rise2.Work is developing. Before introducing features that materially change how personal information is used, such as messaging, job applications, saved profiles, advanced analytics, automated matching or other significant functionality, we will assess the data protection implications and update our privacy information, safeguards, assessments and consent mechanisms where required.

25. Changes to this Privacy Notice

We will review this Privacy Notice and update it when our processing, suppliers, features or legal obligations materially change. The latest version will be published on www.rise2.work and will show its last-updated date. Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to affected users’ attention before the new processing begins where required.

26. Contact us

RISE2.WORK LTD

10 Tape Lane

Hurst

RG10 0DP

United Kingdom

Website: www.rise2.work

Privacy enquiries and rights requests: privacy@rise2.work