Privacy Policy

1. Scope

This Privacy Policy explains how Rephaus Group Limited (“Rephaus”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you visit rephaus.co, create or use a Rephaus account, appear on or interact with the Rephaus platform, use Foundry or Agency services, communicate with us, or otherwise use our websites, applications and related services (together, the “Services”).

It should be read with our Terms of Use, Cookie Policy and any service-specific notice shown when personal data is collected. If another notice conflicts with this policy for a particular activity, the more specific notice will apply to that activity.

2. Who is responsible for your data

Rephaus Group Limited is the controller of personal data used for our own purposes, including account administration, public profiles, Foundry delivery, platform operation, security, billing, service improvement and our communications.

Agencies, managers, employers, clients or other organisations using Rephaus may also be independent controllers of personal data they add to, obtain from or manage through the Services. Their privacy notices apply to their own use of that data. Where we process personal data only on an organisation’s documented instructions, that organisation is the controller and our data processing terms govern our role as processor.

3. Personal data we collect

Depending on how you use the Services, we may collect:

• Account and identity data, such as your name, username, email address, telephone number, password credentials or authentication identifiers, location, account type and preferences.
• Professional profile and public content, such as biographies, roles, skills, experience, projects, campaigns, appearances, press, images, videos, links, availability, ‘Open to’ preferences, updates and other content selected for publication.
• Agency and team data, such as Agency affiliation, roster membership, assigned managers, team roles, permissions, invitations, client status and account-management activity.
• Foundry data, such as brief responses, background information, opportunity preferences, contact-routing choices, uploaded files, photographs, documents, links, notes, drafts, review feedback, approval and publication status, and the record of temporary profile access.
• Professional activity and transaction data, such as opportunities, proposals, project records, agreements, deliverables, milestones, files, invoices and payment status.
• Communications, such as messages sent through Rephaus, support requests, feedback, survey responses and records of our correspondence.
• Payment and verification data, such as billing details, transaction references, payment status, verification status and limited information returned by our payment or identity-verification providers.
• Technical and usage data, such as IP address, device and browser information, identifiers, log-in activity, pages and features used, dates and times, diagnostic data, cookie choices and analytics data.
• Compliance and safety data, such as reports, moderation decisions, suspected fraud or misuse, and information needed to establish, exercise or defend legal claims.

4. Where personal data comes from

We collect personal data:

• directly from you when you register, complete a profile or Foundry brief, upload material, communicate or transact;
• from an Agency, manager, team member, client, collaborator or other person who invites you, manages a relationship with you, supplies authorised material or interacts with you through Rephaus;
• from payment, identity-verification, authentication, analytics and security providers;
• from public or professional sources that you or an authorised Agency identifies, such as a website, portfolio, LinkedIn page, publication or press link; and
• automatically from your device and use of the Services through logs, cookies and similar technologies.

If an Agency or another user supplies personal data about you, they must have authority to do so and must provide any privacy information required by law. We will provide or make this policy available to you when you are invited, claim an account, review a profile or otherwise interact directly with Rephaus.

5. Public profiles and private areas

Rephaus is designed to support professional visibility and collaboration. Information you choose or approve for a public profile may be visible to anyone, including people without a Rephaus account, and may be indexed by search engines. Public profile information may include your name, professional identity, biography, images, general location, selected work, press, links, updates and opportunity preferences.

Messages, drafts, agreements, payment details, verification information, private project material, team notes and permissions are not public by default. They may, however, be visible to people you share them with, authorised members of your Agency or team, relevant project participants, or service providers who need access to deliver the Services.

Please remember that information made public may be copied, re-shared or cached by third parties. Removing it from Rephaus does not guarantee its removal from search-engine caches or third-party copies outside our control.

6. How we use personal data and our lawful bases

UK data protection law requires us to have a lawful basis for each use of personal data. The basis depends on the context. We rely on the bases below where applicable.

Where we rely on legitimate interests, we consider the benefit to Rephaus, our users or business customers, whether the processing is necessary, and the effect on the individual. You may ask for more information about this assessment or object to processing based on legitimate interests.

Where information is needed to enter into or perform a contract, you do not have to provide it, but we may be unable to create your account, provide Foundry, process a payment or deliver the relevant feature without it.

7. Foundry and Agency services

Foundry is Rephaus’s managed profile service. A Client or authorised Agency may provide a brief, source material, files and links so that the Rephaus Foundry team can write, curate and build a professional profile. During Foundry, the account holder may authorise temporary profile-management access. That permission is limited to Foundry work and is removed when the Foundry process is completed, subject to any access needed to resolve an open support or legal issue.

A Client is given an opportunity to review the completed profile, request the included round of changes or approve it, and complete any required verification before publication. Foundry source material may be supplied by the Client or by an authorised Agency. Agencies must only submit material they are entitled to use and must ensure that Clients receive appropriate privacy information.

An Agency may use Rephaus to invite Clients, administer a roster, assign managers and manage permissions. We record these actions to deliver the service, maintain accountability and protect account security. The end of an Agency relationship does not automatically require us to erase records that we must retain for legal, accounting, security or dispute-resolution purposes.

8. Special category and criminal offence data

We do not ask you to provide special category data—such as health, ethnicity, religion, political opinions, trade-union membership, genetic or biometric data used for identification, or information about sex life or sexual orientation—unless it is genuinely needed for a specific purpose. Please do not upload it unnecessarily.

If special category data is included in profile or Foundry material, we will process it only where a lawful Article 9 condition applies, for example your explicit consent, information you have manifestly made public, or the establishment, exercise or defence of legal claims. We do not intentionally collect criminal offence data unless there is a clear lawful basis and appropriate safeguards.

9. Who we share personal data with

We may share personal data with:

• the public and other Rephaus users, where information is published or shared through the Services;
• your Agency, manager, authorised team members, Clients, collaborators, project participants or invited guests, according to the relationship and permissions in the Services;
• service providers that support hosting, storage, authentication, communications, customer support, document services, payments, verification, analytics, security and fraud prevention, including Stripe for payment or verification services and Google Analytics where enabled;
• professional advisers, auditors, insurers and financing partners where reasonably necessary;
• courts, regulators, law-enforcement bodies or other authorities where required by law or necessary to protect rights, safety and security; and
• a prospective buyer, investor or successor in connection with a financing, merger, acquisition, reorganisation or sale of all or part of our business, subject to appropriate confidentiality safeguards.

We require service providers to protect personal data and use it only for the agreed services. Some providers act as independent controllers for parts of their service, in which case their privacy notices also apply. We do not sell personal data.

10. Payments and verification

Payments are processed by Stripe or another provider identified at checkout. Card details are entered directly into the provider’s secure service; Rephaus does not normally receive or store your full card number or card security code. We receive information such as the payer’s name, billing details, transaction reference, amount, currency and payment status where needed to administer the purchase and keep financial records.

Where account verification is required, the process may be provided by Stripe or another verification provider. The provider may collect identity documents, images or other verification information directly from you under its own privacy notice. Rephaus generally receives the verification result and limited supporting information needed to manage the account, prevent fraud or meet legal requirements.

11. Cookies and analytics

We use essential cookies and similar technologies to operate the website and platform, maintain sessions, remember privacy choices and protect security. With your consent where required, we may also use analytics or preference technologies, including Google Analytics, to understand use and improve the Services.

You can manage non-essential cookies through our cookie controls and browser settings. Withdrawing consent does not affect processing carried out before withdrawal. For more detail, including current cookie categories and durations, see our Cookie Policy at rephaus.co/cookie-policy.

12. International transfers

Some recipients or systems may be located outside the United Kingdom. Where personal data is transferred to a country not recognised as providing adequate protection, we use an approved safeguard where required, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. We also assess the transfer and apply supplementary protections where appropriate. Contact us if you would like information about the safeguard used for a particular transfer.

13. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose collected, including to provide the Services, meet legal and accounting duties, maintain security, resolve disputes and enforce agreements. We consider the amount, nature and sensitivity of the data, the risk of harm, whether the purpose can be achieved another way and applicable legal requirements.

In general:

• account and profile data is kept while the account is active and for a limited period after closure where needed for recovery, support, safety or legal claims;
• public content is removed or de-published when the relevant profile or content is deleted, subject to backups, legal retention and third-party caches outside our control;
• Foundry source material is kept during delivery and for a limited quality-assurance and support period, then deleted or de-identified unless it has been incorporated into the live profile or must be retained for a dispute or legal requirement;
• project, agreement, invoice and payment records are generally retained for up to six years where required for tax, accounting or legal claims;
• verification data is minimised and retained only as long as needed for security, legal or account-integrity purposes, while the verification provider applies its own retention policy to data it controls;
• security and technical logs are retained for a limited period based on operational and fraud-prevention needs; and
• marketing preferences are kept until you opt out; we may then keep a suppression record so we do not contact you again.

Deleted data may remain in encrypted backups until those backups are securely overwritten in the ordinary cycle. We may anonymise data so that it can no longer identify you and use that anonymised information without further notice.

14. Security

We use appropriate technical and organisational measures designed to protect personal data, including access controls, authentication, encryption where appropriate, monitoring, staff and supplier controls, and procedures for responding to incidents. Access to personal data is limited to people who need it for their role. No online service can be guaranteed completely secure, so you should use a strong, unique password and contact us promptly if you believe your account has been compromised.

15. Your data protection rights

Depending on the circumstances and the law that applies, you may have the right to:

• ask for access to your personal data and information about how it is used;
• ask us to correct inaccurate or incomplete data;
• ask us to delete personal data;
• ask us to restrict how personal data is used;
• object to processing based on legitimate interests, and object at any time to direct marketing;
• receive certain data in a structured, commonly used and machine-readable format, or ask us to send it to another provider;
• withdraw consent at any time where consent is the lawful basis; and
• complain to a data protection regulator.

These rights are not absolute and exemptions may apply. To exercise a right, email privacy@rephaus.co. We may need to verify your identity and clarify your request. We normally respond within one month, although the law permits more time for complex or multiple requests. There is usually no fee unless a request is manifestly unfounded or excessive.

If we process data for an Agency or other organisation solely as its processor, we may refer your request to that controller and assist it in responding.

16. Automated decision-making

We do not currently use personal data to make solely automated decisions that produce legal or similarly significant effects. Search, discovery or recommendation features may use automated ranking, but they do not by themselves make a legally significant decision about you. If this changes, we will provide the information and safeguards required by law.

17. Children

The Services are intended for users aged 16 and over. We do not knowingly collect personal data from a child under 16. If you believe a child has provided personal data to us, please contact privacy@rephaus.co so that we can investigate and take appropriate action.

18. Third-party links and services

The Services may link to third-party websites, portfolios, social platforms or services. We are not responsible for their privacy practices. You should review the relevant privacy notice before providing personal data to a third party.

19. Changes to this policy

We may update this Privacy Policy to reflect changes to the Services, our practices or the law. We will post the updated version and change the ‘Last updated’ date. If a change is material, we will take reasonable steps to bring it to your attention, for example through the Services or by email where appropriate.

20. Contact and complaints

Questions, requests or concerns about privacy can be sent to:

We would appreciate the opportunity to address your concern first. You also have the right to complain to the UK Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone 0303 123 1113; or visit ico.org.uk/make-a-complaint.