RARION PRIVACY POLICY

Effective Date: 29th May 2026

Last Updated: 29th May 2026

1. Introduction

Rarion is a trading name of Heimar Limited (“Rarion”, “Heimar”, “we”, “us” and “our”), a company registered in England and Wales under company number 17193584 whose registered office is at 3 Southcot Place, Bath, England, BA2 4PE.

This Privacy Policy explains how we collect, use, process, store, share and protect personal data when you:

• visit our website;
• use the Rarion platform;
• interact with us as a client, candidate, user or business contact;
• access associated products, services, communications and events.

We are committed to protecting personal data and complying with applicable data protection laws, including:

• UK GDPR;
• Data Protection Act 2018;
• applicable EU data protection legislation where relevant;
• other applicable privacy and employment-related laws.

ICO Registration Number: ZC141418 Contact Email: [email protected]

By accessing our website or using our services, you acknowledge the practices described in this Privacy Policy.

2. Who We Are

Rarion is a recruitment decision-support platform designed to improve hiring quality through structured assessment, occupational psychology, evidence-based evaluation and artificial intelligence-assisted workflows.

Controller and Processor Roles

Depending on how the platform is used, Rarion may act as either a Data Controller or Data Processor.

Where Rarion Acts as Data Controller

Rarion acts as Data Controller when processing personal data relating to:

• website visitors;
• marketing contacts;
• business contacts;
• prospective customers;
• event attendees;
• platform users;
• support enquiries.

Where Rarion Acts as Data Processor

For recruitment and hiring activities conducted by clients using the platform:

• the client is typically the Data Controller;
• Rarion acts as Data Processor on behalf of the client.

Client Responsibilities

Where Rarion processes personal data on behalf of a client, the client remains responsible for:

• identifying an appropriate lawful basis for processing;
• providing candidate privacy notices;
• obtaining any required consents;
• complying with employment law;
• complying with equality and anti-discrimination law;
• complying with data protection legislation.

Rarion processes such data only in accordance with customer instructions, contractual obligations and applicable law.

3. Information We Collect

3.1 Information You Provide Directly

We may collect:

• name;
• email address;
• telephone number;
• postal address;
• job title;
• company information;
• account credentials;
• support requests;
• communications and correspondence.

3.2 Candidate and Recruitment Data

When clients use the platform for recruitment purposes, Rarion may process:

• CVs and resumes;
• employment history;
• education history;
• qualifications;
• application forms;
• interview notes;
• assessment information;
• candidate evaluations;
• competency assessments;
• behavioural assessments;
• publicly available professional profile information;
• references and supporting documentation.

3.3 Technical and Usage Data

We may automatically collect:

• IP address;
• browser information;
• device information;
• operating system information;
• access logs;
• authentication information;
• platform activity;
• usage statistics;
• diagnostic information.

3.4 AI-Derived Data

The platform may generate:

• summaries;
• assessments;
• competency indicators;
• behavioural indicators;
• candidate comparisons;
• structured evaluation outputs;
• workflow recommendations;
• benchmark comparisons.

Such information is generated from data provided to the platform and should not be treated as definitive or factual without review.

4. How We Use Personal Data

We may process personal data for the following purposes.

4.1 Service Delivery

• providing platform functionality;
• enabling recruitment workflows;
• facilitating collaboration;
• managing user accounts;
• providing customer support;
• delivering reports and assessments.

4.2 Platform Operations

• authentication and access control;
• maintaining security;
• preventing fraud and abuse;
• monitoring platform performance;
• troubleshooting technical issues.

4.3 Business Administration

• managing customer relationships;
• responding to enquiries;
• invoicing and contract administration;
• providing training and onboarding.

4.4 Platform Improvement

• usage analytics;
• service development;
• product improvement;
• testing and optimisation.

4.5 Legal and Regulatory Compliance

• complying with legal obligations;
• protecting rights and interests;
• responding to regulatory requests;
• defending legal claims.

5. Use of Artificial Intelligence

5.1 Nature of AI Use

Rarion may utilise artificial intelligence technologies to assist users with:

• structuring information;
• summarising information;
• identifying evidence;
• generating draft assessments;
• supporting workflow automation;
• improving consistency across evaluation processes.

AI-generated outputs are assistive and advisory in nature.

5.2 Responsible Use of AI

Rarion is designed as a recruitment decision-support platform.

The platform is intended to improve:

• structure;
• consistency;
• evidence quality;
• collaboration;
• workflow efficiency.

Rarion is not intended to replace human judgement.

The platform does not make recruitment decisions on behalf of customers.

Customers remain solely responsible for:

• progressing candidates;
• rejecting candidates;
• hiring decisions;
• promotion decisions;
• employment decisions;
• compliance with employment legislation;
• compliance with anti-discrimination legislation;
• compliance with data protection legislation.

Human review and judgement must remain meaningful throughout the recruitment process.

5.3 Human Oversight Requirement

All platform outputs:

• require human review;
• require human interpretation;
• should be considered alongside supporting evidence;
• should not be treated as definitive conclusions.

Users are expected to exercise independent judgement when evaluating outputs.

5.4 No Solely Automated Decision-Making

Rarion is not intended to perform solely automated decision-making that produces legal or similarly significant effects on individuals within the meaning of Article 22 UK GDPR.

Customers are responsible for ensuring:

• meaningful human review;
• appropriate candidate transparency;
• lawful decision-making processes;
• appropriate mechanisms for review and reconsideration.

5.5 Explainability and Transparency

Where AI-assisted functionality is used, Rarion is designed to provide visibility into:

• assessment criteria;
• supporting evidence;
• workflow history;
• scoring rationale;
• user actions;
• decision overrides.

These controls are intended to support transparency, accountability and auditability.

5.6 Fairness and Bias Mitigation

Rarion is designed to support fair and evidence-based recruitment practices.

The platform may include controls such as:

• candidate anonymisation;
• restricted salary visibility;
• role-based permissions;
• structured assessment frameworks;
• evidence-linked scoring;
• auditable decision records.

Rarion does not guarantee the absence of bias.

Customers remain responsible for ensuring recruitment decisions comply with applicable equality and anti-discrimination legislation.

5.7 Candidate Ranking and Scoring

Where candidate scoring, ranking, benchmarking or comparison functionality is used:

• outputs are intended solely as decision-support information;
• outputs do not constitute hiring recommendations;
• outputs should not be relied upon as the sole basis for employment decisions;
• customers are expected to review underlying evidence and exercise independent judgement.

6. Lawful Basis for Processing

We rely on one or more of the following lawful bases:

• performance of a contract;
• legitimate interests;
• legal obligations;
• consent where applicable.

For recruitment data processed on behalf of clients, the client determines the lawful basis for processing.

7. Data Sharing

We may share personal data with:

Service Providers

• hosting providers;
• cloud infrastructure providers;
• analytics providers;
• customer support providers;
• authentication providers;
• communications providers;
• AI processing providers.

Client Organisations

Authorised users within a customer’s environment.

Legal and Regulatory Authorities

Where required by law, court order or regulatory obligation.

We do not sell personal data.

8. Audit Logs and Activity Records

To support security, compliance and transparency, Rarion may record:

• user access activity;
• workflow actions;
• assessment activity;
• scoring activity;
• permissions changes;
• configuration changes;
• decision overrides;
• generated outputs;
• administrative actions.

These records may be used for:

• security monitoring;
• compliance reporting;
• troubleshooting;
• service improvement;
• customer audit requirements;
• legal obligations.

9. International Transfers

Where data is transferred outside the United Kingdom, European Economic Area or equivalent jurisdictions, appropriate safeguards may be used, including:

• adequacy regulations;
• standard contractual clauses;
• recognised transfer mechanisms;
• contractual safeguards.

10. Special Category and Sensitive Data

Customers should avoid uploading unnecessary special category data.

Examples include:

• racial or ethnic origin;
• religious beliefs;
• political opinions;
• trade union membership;
• health information;
• disability information;
• biometric data;
• genetic data;
• sexual orientation;
• sexual life.

Where such information is processed, customers remain responsible for ensuring an appropriate lawful basis and any additional legal conditions required under applicable law.

11. Data Minimisation

Rarion is designed to support data minimisation principles.

Customers should only upload information that is:

• relevant;
• necessary;
• proportionate;
• connected to recruitment or employment assessment purposes.

12. Security

We implement appropriate technical and organisational measures including:

• encryption in transit;
• encryption at rest where appropriate;
• role-based access controls;
• authentication controls;
• monitoring and alerting;
• incident management procedures;
• access logging.

No system can be guaranteed completely secure.

13. Data Retention

Customer and Platform Data

Data is retained for the duration of the customer relationship unless otherwise agreed.

Candidate Data

Candidate data is retained in accordance with customer instructions and configured retention policies.

Legal Retention

Information may be retained where required:

• by law;
• for regulatory compliance;
• for dispute resolution;
• for enforcement of contractual rights.

14. Data Deletion

Upon termination of services:

• customer data may be returned upon request;
• customer data may be deleted in accordance with contractual terms;
• deletion will normally occur within 30 days unless otherwise agreed;
• information may be retained where legally required.

Aggregated or anonymised information may be retained for analytics, benchmarking, service improvement and statistical purposes.

15. Your Rights

Subject to applicable law, you may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability;
• withdrawal of consent;
• complaint to a supervisory authority.

Requests should be submitted to:

Email: [email protected]

Individuals may also lodge complaints with the Information Commissioner’s Office.

16. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• operate the platform;
• maintain security;
• support authentication;
• analyse performance;
• improve user experience.

Further information is available in our Cookie Policy.

17. Third-Party Services and AI Providers

Rarion may utilise third-party providers including:

• hosting providers;
• cloud infrastructure providers;
• authentication providers;
• communications providers;
• analytics providers;
• artificial intelligence providers.

Where AI providers are used:

• customer data is processed solely for service delivery;
• appropriate contractual safeguards are implemented;
• security controls are applied;
• customer data is not used to train third-party foundation models unless expressly disclosed and agreed.

Rarion maintains governance procedures relating to:

• model selection;
• provider assessment;
• security controls;
• responsible AI use;
• model monitoring.

18. Enterprise Compliance

Data Processing Agreements

Where required, a separate Data Processing Agreement may govern:

• processing instructions;
• sub-processor use;
• security obligations;
• international transfers;
• audit rights.

Audit and Assurance

For enterprise customers, Rarion may provide reasonable information relating to:

• security controls;
• privacy practices;
• compliance measures;
• sub-processor management.

Formal audit rights shall be governed by applicable contractual agreements.

19. Limitation of Responsibility

To the fullest extent permitted by law:

Rarion is not responsible for:

• client misuse of personal data;
• customer recruitment decisions;
• employment decisions;
• discriminatory practices undertaken by customers;
• customer non-compliance with applicable law;
• reliance on AI-generated outputs without appropriate human review.

Customers remain responsible for all decisions made using information generated by the platform.

20. Changes to this Privacy Policy

We may update this Privacy Policy periodically.

Updated versions will be published on our website together with an updated revision date.

Continued use of the website or platform following publication of updates constitutes acknowledgement of the revised Privacy Policy.

21. Contact Details

Heimar Limited trading as Rarion Company Number: 17193584 Registered Office: 3 Southcot Place, Bath, England, BA2 4PE

Email: [email protected] ICO Registration Number: ZC141418