Privacy notice

This notice explains what personal information Rock collects, why we use it, who we share it with, and what rights you have. It applies to visitors to this website, people who contact us, people we deal with in the ordinary course of business, and people who apply to work with us.

Who we are

Rock Enterprise Group Ltd is the data controller for the personal information described in this notice.

Company

Rock Enterprise Group Ltd

Registered in

England and Wales, number 14261908

Registered office

69 High Street, London N14 6LD, United Kingdom

ICO registration

ZB441380

Contact

privacy@rock.one

Where an enquiry is passed to another company in the Rock group so that it can respond or provide a service, that company may also decide how it uses your information. Where that happens, it is responsible for its own use of your information.

Information about the companies in the Rock group is set out on our legal and regulatory information page.

If you become a client

If you go on to become a client, we collect further information about you and, where relevant, about people connected to your business. We do this so that we can provide the service and carry out any identity, background, source of funds or other checks that apply. Depending on the circumstances, our legal basis is compliance with a legal obligation, taking steps before entering into or performing a contract, or our legitimate interests in conducting appropriate due diligence and managing risk.

The engagement letter, agreement or terms of business identifies the company providing the service and the terms that apply to it. We will explain what information we require when any onboarding or due diligence checks are carried out.

Information we collect

If you contact us

Your name, email address, company name, the nature of your enquiry, anything you choose to write in your message, and the IP address the enquiry was sent from.

If you use the chat on this website

The content of your conversation with us and any contact details you provide during it.

If you book a meeting with us

Your name, email address and the time you select.

If you apply for a role

The role applied for, your name, email address, telephone number, an optional link to your professional profile, your location, whether you hold the right to work in the relevant country, your availability and notice period, your answers to questions about your experience, and your CV and any covering message you send us.

If you visit this website

Technical information including your IP address, browser and device type, and how you move around the site. Some of this is collected using cookies.

If we deal with you in the ordinary course of business

Your name, job title, employer, business contact details, and a record of our dealings with you.

How we collect it

• Directly from you, when you complete a form, send us an email or a CV, use the chat, book a meeting, or speak to us.
• Automatically, when you use this website.
• From publicly available sources, such as professional networking sites, when we look into an enquiry or an application. We only use sources that are open to the public.

Why we use your information, and our legal basis

Responding to enquiries

To reply to you, understand what you need, and decide whether we can help. Our legal basis is our legitimate interest in responding to people who contact us, and, where you are considering becoming a client, taking steps at your request before entering into a contract.

Managing our relationship with you

To keep our records up to date, communicate with you, and manage our dealings with you and the organisation you work for. Our legal basis is our legitimate interest in running our business, and performing a contract where one exists.

Recruitment

To assess applications, communicate with candidates, and make hiring decisions. Our legal basis is taking steps at your request before entering into a contract of employment, and our legitimate interest in recruiting suitable people.

Marketing and business development

To tell people and organisations about our services where we think they may be relevant. Our legal basis is our legitimate interest in promoting our business, and your consent where the law requires it. You can ask us to stop at any time.

Running and protecting this website

To keep the site working, prevent spam and abuse, and protect against unauthorised access. Our legal basis is our legitimate interest in operating a secure website, and, for non-essential cookies, your consent.

Meeting our legal and regulatory obligations

To comply with the law and with the requirements of regulators and authorities. Our legal basis is compliance with a legal obligation, and our legitimate interest in maintaining proper records.

Where we rely on legitimate interests, we consider whether our interests are outweighed by the effect on you, and we do not use your information where they are.

Job applications

Applications are made through the form on this website. CVs are sent separately by email to careers@rock.one and are held in a mailbox on our United Kingdom systems. They are not uploaded to or stored on this website.

Applications are handled by Rock Enterprise Group Ltd in the United Kingdom, including for roles based in other countries.

Access to applications and CVs is limited to the small number of people involved in recruitment.

If your application is not successful, we keep it while a similar role may arise and for a reasonable period afterwards, and then delete it. You can ask us to delete your application at any point, and we will.

Special category information

We do not generally ask you to provide special category information — the term data protection law uses for information such as health, racial or ethnic origin, or religious belief — as part of an enquiry or an initial application.

If you provide information of this kind, or if we need to use it for a specific purpose such as making reasonable adjustments during recruitment, we will only use it where we have a lawful basis and an additional condition for doing so under data protection law.

Who we share your information with

• Other companies in the Rock group, where they are involved in providing the service you are asking about. This includes Rock Global Payments Ltd, which is based in Canada, in relation to payments enquiries.
• Service providers who help us run our business, including our website host, our email and file storage provider, the provider of the chat service on this website, and our meeting booking service. Where they process personal information on our behalf, they are required to protect it and to use it only in accordance with our instructions and applicable law.
• Our professional advisers, including lawyers, accountants, auditors and insurers, where we need advice.
• Regulators, authorities and law enforcement, where we are required or permitted by law to provide information.
• A buyer or seller, if we buy or sell a business or its assets. Any new owner would be required to handle your information in line with this notice.

Sending information outside the United Kingdom

We may transfer your personal information outside the United Kingdom, including to other companies in the Rock group. Rock Global Payments Ltd is located in Canada. Some of our service providers also process information outside the United Kingdom.

Where we transfer personal information outside the United Kingdom, we make sure the transfer is permitted under United Kingdom data protection law — for example because the destination is covered by regulations approving transfers, because we use appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or because a limited legal exception applies. You can ask us which applies to a particular transfer by contacting privacy@rock.one.

How long we keep your information

We keep personal information for as long as we need it for the purpose we collected it for, and for as long as we are required to keep it by law. In deciding how long that is, we consider how much information there is, how sensitive it is, what we are using it for, the risk of harm if it were disclosed, and any legal or regulatory requirement that applies.

Cookies

This website uses cookies. What they are, which ones we use and how you can change your choices are set out in our cookie policy. You can change your preferences at any time using the link on that page.

Automated decisions

We do not make decisions about you based solely on automated processing where those decisions produce legal effects or similarly significant effects for you.

Children

This website and our services are intended for businesses. They are not aimed at children, and we do not knowingly collect information about children.

Your rights

You have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete information where there is no good reason for us to keep it
• object to us using your information where we rely on legitimate interests, and to object at any time to marketing
• ask us to restrict how we use your information while a question about it is resolved
• ask us to transfer your information to you or to someone else, in certain circumstances
• withdraw your consent, where we are relying on it

To exercise any of these rights, contact privacy@rock.one. We will normally respond within one month. In limited circumstances the law allows us to take longer or to charge a reasonable fee, and we will explain if that applies. We may ask you for information to confirm your identity before we respond.

How we protect your information

We take appropriate measures to protect personal information against loss, misuse and unauthorised access, and we limit access to those who need it. If a security incident affecting personal information occurs, we will tell you and the Information Commissioner's Office where we are required to do so.

Complaints

If you are unhappy with how we have handled your information, please tell us at privacy@rock.one and we will look into it.

You also have the right to complain to the Information Commissioner's Office, the United Kingdom regulator for data protection, at ico.org.uk. We would prefer to hear from you first, but you do not have to contact us before contacting them.

Changes to this notice

We may update this notice. The date below shows when it was last changed. Where a change is significant, we will bring it to your attention.

Contact us

For anything relating to this notice, or to exercise your rights, contact privacy@rock.one, or write to Rock Enterprise Group Ltd, 69 High Street, London N14 6LD, United Kingdom.