Riverflex

Privacy Policy

1 - Riverflex AI Hiring Manifesto

At Riverflex, we use automation and artificial intelligence responsibly to support a fair, inclusive, efficient, and human-centered hiring experience.

AI and automation are used to support, not replace, human decision-making. Every hiring decision is ultimately made by our recruiters and hiring managers, who remain fully accountable throughout the process.

We apply AI tools to help streamline workflows (e.g. interview note-taking, transcription, generating structured summaries, and supporting recruitment workflow documentation), improve consistency, and reduce administrative burden, while ensuring that human judgment, context, and empathy remain central to how we assess candidates.

Our use of AI in hiring:

  • Complies fully with GDPR and applicable data protection regulations, including transparency, data minimization, and security principles.
  • Is guided by a strong commitment to fairness, inclusion and bias reduction. Our recruiters are continuously guided to recognise and mitigate bias, and AI outputs are used as decision support, never as sole decision makers.
  • It is transparent to candidates. We inform candidates when AI or automation is used at any stage of the hiring journey and clearly explain its purpose.
  • Respects candidate rights and choice. Candidates can ask questions about AI use and are never disadvantaged for opting out where alternatives are available.

We believe responsible AI can improve hiring when applied thoughtfully, ethically, and with strong human oversight. At Riverflex, technology serves people, not the other way around.

Learn more in our Privacy Notice

2 – Sub-processors in Riverflex Group Privacy Policy (Notice)

Riverflex Group Privacy Notice

(Job Candidates, Clients, Suppliers, Employees, Consultants & Website Users)

1. Summary

This Privacy Notice explains how Riverflex Trading International Limited, Riverflex Trading NL B.V., and Riverflex Trading UK Limited (together, “Riverflex”, “we”, “us”, or “our”) collect, use, store, and protect personal data.

As part of our consulting, recruitment, and community activities, we may use responsible automation and AI-enabled tools to support our hiring and talent processes. These tools are used solely to optimise efficiency, improve consistency, and support human decision-making.

All recruitment, hiring, and engagement decisions are made or validated by human recruiters and hiring managers.
No individual is subject to decisions based solely on automated processing.

This Privacy Notice explains:

  • What personal data we collect
  • How and why we use it
  • Our legal bases for processing
  • Who we share it with
  • How long we keep it
  • Your rights under UK GDPR and EU GDPR

This Notice applies to:

  • Job candidates (permanent, interim, freelance, consulting, and network/community members)
  • Clients and prospective clients
  • Suppliers and partners
  • Employees, consultants, and temporary workers
  • Users of our websites, ATS, and platforms (including the Riverflex Platform)

If you accept an offer of employment or engagement with Riverflex, you will receive an Employee / Contractor Privacy Notice with more detailed information about how we process your data during your engagement.

2. Purpose of this Notice

The purpose of this Privacy Notice is to:

  • Inform you how we collect and use your personal data in the context of our consulting, recruiting, and community activities
  • Explain your rights under applicable data protection laws (UK GDPR, EU GDPR and related legislation)
  • Describe the measures we take to keep your information secure and to respect your privacy

We strongly encourage you to read this Notice carefully.
If you have any questions, you can contact us at privacy@riverflex.com.

3. Applicability & Who We Are

This Privacy Notice applies to the following companies within the Riverflex group:

  • Riverflex Trading International Limited
  • Riverflex Trading NL B.V.
  • Riverflex Trading UK Limited

Riverflex is an international consulting group providing:

  • Managed consultancy and advisory services
  • Talent & recruitment services (permanent, interim, embedded recruitment, freelance and executive search)
  • Community and open-talent services, including the Riverflex Platform and professional network

We collect personal data about:

  • Candidates and network members
  • Client contacts (prospective and existing)
  • Supplier and partner contacts
  • Employees, consultants, and temporary workers
  • Website and platform users

4. Data Controller & Contact Details

Each Riverflex group company listed above is a Data Controller in respect of the personal data it processes for its own purposes.

You can contact us regarding any privacy or data protection matter at:

📧 privacy@riverflex.com

5. Personal Data We Collect

Depending on your relationship with us, we may collect and process the following categories of personal data.

5.1 Job Candidates, Freelancers & Network Members

Identification and contact details

  • Name, title, address, email address(es), phone number(s)
  • Links to professional profiles (e.g. LinkedIn, corporate website)

Professional and application information

  • CV/resume, cover letters, portfolios
  • Skills, experience, qualifications, language skills
  • Employment and engagement history
  • Expected salary / day rates, notice period, location preferences

Verification and compliance data

  • Right-to-work documentation (passport, ID card, visa, work permit)
  • Nationality/citizenship or place of birth (where required by law or client requirements)
  • References and referee contact details
  • Background check results (where lawful and required)

Financial and contractual data (network members only)

  • Bank or payment details
  • Tax identifiers (e.g. BSN, NI number)
  • Contract terms, assignment details, timesheets, invoices

Communication, assessment & process data

  • Email correspondence, call notes, interview feedback
  • Interview notes, structured summaries or transcripts generated with the assistance of AI-enabled tools
  • Recruitment process metadata (e.g. application stage, status changes, timestamps)
  • Participation in talent pools, Riverflex Platform, or community events
  • Consent preferences and records

5.2 Clients and Prospective Clients

  • Names, roles, business contact details
  • Organisation information
  • Meeting notes, correspondence
  • Contracts, proposals, SoWs, pricing and engagement details
  • Feedback on services, candidates, and consultants

5.3 Suppliers and Partners

  • Contact details of supplier representatives
  • Contract, compliance, and invoicing information
  • Communications related to service delivery

5.4 Employees, Consultants & Temporary Workers

Additional HR-related personal data is processed under a separate Employee / Contractor Privacy Notice, provided during onboarding.

5.5 Website & Platform Users

When you visit our websites or platforms:

Information you provide

  • Contact forms, newsletter subscriptions
  • Event registrations, account sign-ups

Technical and usage data

  • IP address, browser type, device information
  • Pages visited, time spent, referring URLs

Cookies

  • As described in our Cookie Policy (see Section 15)

6. How We Collect Your Data

6.1 Directly from You

You provide data when you:

  • Apply for roles or register as a candidate or consultant
  • Upload CVs or profiles
  • Communicate with us
  • Register for events, platforms, or marketing
  • Enter into contracts or negotiations

6.2 From Our Websites & Recruitment Platforms

When you use our websites, ATS, or recruitment platforms, we may collect data through:

  • Application forms and profiles
  • Interview scheduling and communications
  • Recruitment workflow tools using automation or AI to structure information, capture notes, or trigger administrative actions

These tools support recruiters and do not replace human assessment or decision-making.

6.3 From Other Sources

We may collect data from:

  • Professional networking sites (e.g. LinkedIn)
  • Job boards and CV databases
  • Referrals and introductions
  • Events and business cards
  • Group companies and recruitment partners
  • Background screening and verification providers

Sourcing from Public Professional Profiles & ATS

We may import publicly available professional data into our ATS for recruitment purposes. When we do so, we:

  • Use only career-related public information
  • Target relevant roles
  • Rely on legitimate interests
  • Inform you within 30 days
  • Provide opt-out and deletion rights

7. Special Categories of Data & Criminal Records

7.1 Diversity & Equal Opportunities Data

Where voluntarily provided, diversity data is:

  • Optional
  • Only used for monitoring and inclusion purposes
  • Processed with safeguards and consent where required

7.2 Criminal Records

Criminal record checks are:

  • Conducted only where lawful and required
  • Explained in advance
  • Based on explicit consent where applicable

8. Why We Use Your Personal Data & Legal Bases

We process personal data only where a lawful basis exists.

8.1 Candidates, Freelancers & Network Members

Purposes include:

  • Assessing suitability
  • Managing recruitment workflows
  • Supporting recruiters with AI-assisted summaries, structuring, and documentation
  • Introducing candidates to clients
  • Managing contracts, payments, and compliance
  • Improving fairness, consistency, and quality of hiring

Safeguards

  • Human review in all cases
  • No solely automated decision-making
  • AI tools support, not replace, recruiter judgment

Legal bases

  • Legitimate interests
  • Contract / pre-contractual steps
  • Legal obligations
  • Consent (where applicable)

8.2 Use of AI, Automation & Transcription Tools

We may use AI-enabled tools to:

  • Transcribe or summarise interviews
  • Structure CVs or profiles
  • Support note-taking and consistency
  • Trigger workflow actions

Our commitments

  • Human-in-the-loop at all times
  • No binding decisions made by AI
  • Designed to reduce bias, not increase it
  • Transparency and candidate rights respected

8.3 Clients & Prospective Clients

Purposes include service delivery, account management, billing, and communications.

Legal bases

  • Legitimate interests
  • Contractual necessity
  • Legal obligations

8.4 Suppliers & Partners

Purposes include recruitment, onboarding, management, billing, and compliance.

8.5 Marketing

We send communications only where permitted by consent or legitimate interests.
Opt-out is always available.

9. Sharing Your Personal Data

We may share data with:

9.1 Riverflex Group Companies

9.2 Clients (with candidate consent)

9.3 Processors and Third-Party Service Providers

Riverflex may engage carefully selected third-party service providers acting as data processors to support our recruitment, hiring, and operational activities. These providers process personal data solely on Riverflex’s documented instructions and do not use such data for their own independent purposes.

These processors include, but are not limited to:

  • Applicant Tracking Systems (ATS) and recruitment platforms (Tellent Recruitee, LinkedIn)
  • Interview scheduling, transcription, and workflow automation tools (e.g. Metaview, used for interview transcription and summaries)
  • Cloud hosting, security, and IT infrastructure providers

All processors are contractually bound by GDPR-compliant Data Processing Agreements (DPAs), which require them to:

  • process personal data only on Riverflex’s behalf,
  • implement appropriate technical and organisational security measures, and
  • assist Riverflex in meeting its data protection obligations.

Riverflex remains the data controller for all personal data processed in these contexts.

9.4 Legal & Regulatory Authorities

9.5 Business Transactions

Appropriate safeguards always apply.

10. International Data Transfers

Where data is transferred outside the UK/EEA, we apply:

  • Adequacy decisions or
  • Standard Contractual Clauses (SCCs)
  • Transfer Impact Assessments (TIAs)

11. How We Store & Protect Your Data

Riverflex operates an ISO 27001-certified Information Security Management System (ISMS), covering:

  • Access controls
  • Encryption and monitoring
  • Supplier security reviews
  • Incident response

These controls also apply to AI-enabled recruitment tooling.

12. How Long We Keep Your Data (Retention)

12.1 Candidates & Network Members

Candidates considered for Riverflex core team roles and permanent client opportunities:

  • Retained for 3 years (1,095 days) after last meaningful contact
  • Consent renewal issued 30 days before expiry
  • Automated deletion if no response
  • All deletion requests are handled within 1 day (unless legally restricted)

Network members considered for Riverflex engagements under contract hiring arrangements:

  • Retained indefinitely where you have signed up to the Riverflex Platform for Network Members via the provided link.
  • All deletion requests are handled within 1 day (unless legally restricted)

12.2 Contractors & Temporary Workers

  • Retained for 7 years after assignment end

12.3 Clients & Suppliers

  • Retained for 7 years after relationship end

12.4 Archiving & Pseudonymisation

Used where appropriate to meet legal and compliance needs.

13. Your Rights

You have rights including:

  • Access
  • Rectification
  • Erasure
  • Restriction
  • Objection
  • Data portability
  • Human intervention in automated processes
  • Withdrawal of consent

Requests can be made via privacy@riverflex.com.

14. Complaints & Supervisory Authorities

UK: ICO
NL: Autoriteit Persoonsgegevens
EU: Local supervisory authority

15. Cookies that we use

15.1 We use cookies for the following purposes:

(a)authentication – we use cookies to identify you when you visit our website and as you navigate our website (cookies used for this purpose are: identify cookies);

(b)status – we use cookies to help us to determine if you are logged into our website (cookies used for this purpose are: identify cookies);

(c)analysis – we use cookies to help us to analyse the use and performance of our website and services (cookies used for this purpose are: identify cookies); and

(g)cookie consent – we use cookies to store your preferences in relation to the use of cookies more generally (cookies used for this purpose are: identify cookies).

16. Cookies used by our service providers

16.1 Our service providers use cookies and those cookies may be stored on your computer when you visit our website.

16.2 We use Google Analytics to analyse the use of our website. Google Analytics gathers information about website use by means of cookies. The information gathered relating to our website is used to create reports about the use of our website. Google’s privacy policy is available at: https://policies.google.com/privacy. The relevant cookies are: identify cookies.

16.3 We use Hotjar to analyse the use of our website. Hotjar gathers information about website use by means of cookies. The information gathered relating to our website is used to create reports about the use of our website. Hotjar’s privacy policy is available at:

17. How to manage your cookies

17.1 Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links:

(a)https://support.google.com/chrome/answer/95647 (Chrome);

(b)https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences (Firefox);

(c)https://www.opera.com/help/tutorials/security/cookies/ (Opera);

(d)https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies (Internet Explorer);

(e)https://support.apple.com/kb/PH21411 (Safari); and

(f)https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy (Edge).

17.2 Blocking all cookies will have a negative impact upon the usability of many websites. If you block cookies, you will not be able to use all the features on our website.

18. Changes to our Privacy & Cookies Policy

We may update this Notice to reflect:

  • Changes in services
  • Regulatory updates
  • Introduction or evolution of responsible AI and automation tools

19. Contact

📧 privacy@riverflex.com

Updated: 1/28/2026

Riverflex Network Platform