Data Protection & Privacy Notice

1. Who We Are

R3NQUIST is the trading name of R3NQUIST CORPORATION, a corporation incorporated and registered in the State of Delaware, USA, and the United Kingdom.

We are an agentic technology company that brings certainty to the world's highest stakes legal and cyber matters. Certainty in costs, speed, quality, insight and governance. We unite data and intelligence in one governed platform to deliver defensible outcomes in litigation and cyber incident response.

Governance is at the heart of how we work. Our clients trust us with some of their most important and sensitive information, often at the moments that matter most to them. That is why every action on our platform is controlled, recorded and auditable; why our security controls are independently certified (see Section 8); and why we treat data protection as a design principle rather than an afterthought.

We act as a controller and a processor as set out in this Notice and take our data protection and regulatory compliance responsibilities seriously, applying all applicable data protection, privacy and AI laws and regulatory requirements in the jurisdictions in which we operate and serve our clients.

Controller activities of R3NQUIST

In processing information about our personnel, prospects, marketing contacts, enquiries, and our own clients' named representatives, we act as a controller. For all such processing, we are responsible for determining the purposes and lawful basis of the processing and for providing individuals with the relevant data protection/privacy information, where required.

Processor activities of R3NQUIST

In providing services to our clients, we may process personal data on their behalf and in accordance with their documented instructions. In these circumstances, our client will generally act as the controller and we will act as the processor.

The client, as controller, is responsible for determining the purposes and lawful basis of the processing and for providing individuals with the relevant data protection/privacy information, where required.

We process personal data only as authorised by our contractual arrangements and applicable law. All such engagement is supported by a Data Processing Agreement. We implement appropriate technical and organisational measures to protect personal data and meet our obligations under applicable data protection legislation.

Where appropriate, we assist our clients in meeting their data protection obligations, including in relation to individuals' rights, security, personal data breaches and other compliance requirements.

If you have a question about personal data that we process on behalf of a client, you may contact us using the details below. We may refer your request to the relevant client where they are responsible for responding to it.

Each role brings different responsibilities under data protection legislation; this Notice covers both.

Where processing activities relate to the  offering of goods or services to data subjects in the European Union, or the monitoring of their behaviour as far as their behaviour takes place within the Union, a representative will be appointed.

Representative contact details, where applicable, will be available on request.

2. What This Notice Covers

This Notice covers the personal data we collect, the purposes for which we use it, who we share it with, where it is sent, how long we keep it, how we secure it, and what rights you have in relation to it. It applies to: visitors to the R3NQUIST website; prospects and contacts we engage with in business development; named individuals at our clients, vendors, and partners; candidates and employees; and individuals whose personal data we process for client contracted engagements, including its anonymisation on the client's instruction.

Where R3NQUIST acts as processor on behalf of a client controller, the client's data protection/privacy notices will cover all relevant notice obligations; this Notice describes our processor responsibilities and the safeguards we apply.

3. The Personal Data We Collect

We collect only the personal data we need for the purposes described in this Notice. The categories of personal data we may collect vary by the relationship you have with us and any instruction we may be given.

3.1 If you visit our website

We will collect technical information automatically: your IP address, browser type and version, operating system, the pages you visit, the time and duration of your visit, and the referring source. We will also collect information you submit through web forms, typically your name, email address, company affiliation, and the content of your enquiry.

3.2 If you engage with us as a prospect or client representative

We will collect the information provided to us, including your name, role, organisation, business contact details (email, telephone, address), and the content of our communications and meetings. Where you are a contracted client representative, we also hold contractual information relating to the engagement and operational information necessary for delivery.

3.3 If you are a candidate or employee

We collect information necessary for the recruitment process (CV/resume, contact details, work history, references, screening data where lawful) and, on hire, personal data necessary for employment administration (payroll, benefits, performance, learning and development, and security-screening records). The HR Security Policy governs employment data processing in detail and details will be provided to individuals making an application.

3.4 If you are a named individual in a vendor or partner organisation

We collect your name, role, organisation, business contact details, and the content of our supplier-relationship communications. Where you are a named individual at a sub-processor, we hold additional information necessary for sub-processor governance under the Third-Party Management Policy.

3.5 If your personal data is in a dataset we process

Where R3NQUIST processes information as a processor and on behalf of a client, any personal data in those datasets is governed by the Data Processing Agreement with the client. The client's data protection/privacy notice will set out the relevant processing information including the categories of personal data, purpose/s of processing, and security controls. R3NQUIST's role is to process that data on the client's documented instructions, with the technical and organisational measures recorded in the engagement governance record. No personally identifiable data is processed by R3NQUIST other than as instructed by the client controller and as set out in the Data Processing Agreement.

4. How We Use Personal Data

We use personal data for the purposes described below. Each purpose is supported by a lawful basis.

• Responding to your enquiries and providing information. Lawful basis: legitimate interests (responding to people who contact us) and pre-contractual measures.
• Engagement delivery, contract performance, and relationship management. Lawful basis: contract (with the client organisation, or with you in your individual capacity) and legitimate interests (effective business operation).
• Recruitment and employment administration. Lawful basis: contract (employment), legal obligation (statutory employer duties), legitimate interests (operational administration), and consent (specific optional processing).
• Marketing and business development. Lawful basis: legitimate interests (sharing relevant content with people who have expressed interest) and consent (electronic marketing where required by ePrivacy / PECR or equivalent local rule).  Opt out is available at any time using the unsubscribe link in any communication or by contacting our Data Protection Lead at dataprotection@r3nquist.com.
• Security, fraud prevention, and protection of our systems and personnel. Lawful basis: legitimate interests (operating a secure organisation) and legal obligation (where applicable).
• Compliance with legal obligations including responding to legitimate requests from law enforcement, regulators, or courts. Lawful basis: legal obligation.
• Establishment, exercise, or defence of legal claims. Lawful basis: legitimate interests (or in some jurisdictions, a relevant condition for special category data).

We will use client personal data for training, fine-tuning, and model improvement only as instructed by the client and as set out in the Data Processing Agreement.

We will use anonymised data for training, fine-tuning, or model improvement where an agreed anonymisation process has been completed and validated using robust, recognised techniques and in accordance with applicable legislation and industry standards. All such agreements will be contained within the Data Processing Agreement. We do not attempt to re-identify any individual from anonymised data, and we require the same of anyone we share it with.

We do not process personal data for purposes incompatible with the purposes described above without a lawful basis.

5. Who We Share Personal Data With

We share personal data only where there is a lawful basis to do so, with one of the following categories of recipient:

• Authorised R3NQUIST personnel on a need-to-know basis, under strict confidentiality and access controls.
• Processors and sub-processors acting on our behalf under written Data Processing Agreements, including our cloud-infrastructure providers, communication and collaboration platforms, payroll providers, professional advisors, and (where applicable to a specific service) AI infrastructure providers. We maintain a current list of sub-processors available on request.
• Our clients, in the context of engagement delivery, where the personal data was provided to us as part of that engagement, or where we hold the personal data of the client's named representatives.
• Professional advisors (legal, accounting, audit) where required for the conduct of our business.
• Regulators, supervisory authorities, courts, and law enforcement where we are legally required or permitted to disclose.
• Acquirers of R3NQUIST's business or assets, in connection with corporate transactions, under appropriate confidentiality and data-protection controls.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. Where we use third-party analytics or tracking technologies on our website, we describe these in Section 10 (Cookies and Tracking) and in our Cookie Notice, which is linked from the website footer.

6. International Transfers

R3NQUIST operates internationally. Personal data we process may be transferred to, or accessed from, locations outside the jurisdiction of original collection.

Where personal data is transferred outside the European Economic Area, the United Kingdom, or other jurisdictions of origin that protect personal data, we use one of the following safeguards:

• an adequacy decision (where the destination jurisdiction has been recognised as providing adequate protection);
• Standard Contractual Clauses (or the UK International Data Transfer Agreement / UK Addendum); Binding Corporate Rules where applicable; or
• in limited circumstances, explicit consent or another derogation under data protection legislation.

Where Standard Contractual Clauses are used and the destination jurisdiction does not have an adequacy decision, we conduct a transfer impact assessment to evaluate whether the destination legal regime undermines the protection afforded by the Clauses, and we apply supplementary measures (such as additional encryption and contractual restrictions) where necessary. Information about the safeguards applied to a specific transfer is available on request from our Data Protection Lead at dataprotection@r3nquist.com.

7. How Long We Keep Personal Data

We retain personal data for no longer than necessary for the purposes for which it is processed. Specific retention periods are recorded in our Record of Processing Activities and follow the schedules in our Data Retention and Deletion Policy. At a high level:

• Marketing and prospect contact records: for as long as you remain engaged with us (e.g., open marketing communications, engaged content) and for a defined period after disengagement, then deleted or anonymised.
• Client engagement records: for the duration of the engagement and a defined retention period afterwards (typically aligned to statutory limitation periods for legal claims and to contractual obligations).
• Employee records: for the duration of employment and a defined retention period afterwards (typically aligned to statutory employer record-keeping duties).
• Personal data processed as processor on a client's behalf: for the duration of the engagement, with return, deletion, or anonymisation at the end as specified in the Data Processing Agreement.

Personal data subject to legal hold is preserved beyond its normal retention period until the hold is released.

8. How We Protect Personal Data

R3NQUIST’s Information Security Management System is independently certified to ISO/IEC 27001:2022, the international standard for managing information security. R3NQUIST has also completed a SOC 2 Type II examination, in which an independent auditor tested the design and operating effectiveness of our security controls over a period of time against the AICPA Security criteria.

Together these mean that the controls protecting the personal data we hold are not only described in this notice but have been verified by external assessors. We are extending this to privacy and AI governance, with ISO/IEC 27701 (Privacy Information Management, which builds on ISO/IEC 27001) and ISO/IEC 42001:2023 (AI Management System) on our certification roadmap. A copy of our ISO/IEC 27001 certificate and SOC 2 Type II report is available to customers and prospective customers on request using the contact details in this notice.

No warranty is provided or implied that personal data will be free from breach or unauthorised access. In the event of a data breach or other security incident, we will act promptly to investigate, contain and mitigate the incident and shall comply with all applicable legal, regulatory and contractual obligations, including any requirements for notification and reporting.

9. Individual Rights

Under applicable data protection legislation, individuals have certain rights in relation to personal data about them.

For personal data for which R3NQUIST is a processor, these rights must be exercised through the relevant controller.

Where personal data is processed for which R3NQUIST is a controller, the following rights apply (Specific limitations or additional rights may apply in your jurisdiction.)

• Right to be informed: through this Notice and through specific information notices for particular processing.
• Right of access: to obtain confirmation of whether we process your personal data, a copy of that data, and supplementary information about the processing.
• Right to rectification: to have inaccurate personal data corrected or completed.
• Right to erasure: to have your personal data deleted, where one of the legal grounds applies (such as the data no longer being necessary for the purpose, withdrawal of consent, successful objection, or unlawful processing).
• Right to restrict processing: to have processing limited to storage in specific circumstances.
• Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller, where the processing is based on consent or contract and is carried out by automated means.
• Right to object: to processing based on legitimate interests or public interest (including profiling) and to direct marketing at any time.
• Rights related to automated decision-making: not to be subject to a decision based solely on automated processing producing legal or similarly significant effects on you, subject to exceptions and safeguards.
• Right to withdraw consent: where processing is based on consent, at any time.
• Right to complain to a supervisory authority: see Section 13.

To exercise any of these rights, please contact us using the details in Section 12. We will respond to your request without undue delay and within the timeframes required by law (typically one month, extendable for complex requests).

10. Cookies and Tracking

Our website uses cookies and similar technologies. When you first visit, a cookie banner lets you accept all, reject all, or set your preferences. Strictly necessary cookies (needed for the site to function) are always set; analytics, functional and marketing cookies are set only with your consent. You can change your choices at any time using the cookie settings link in the website footer.

We do not use cookies to build profiles for cross-context behavioural advertising. We honour the Global Privacy Control signal where the law requires.

Details of the specific cookies we use, their purpose, their duration and the third parties involved are set out in our Cookie Notice, available from the cookie banner and the website footer.

11. Children's Personal Data

Our website and services are not directed at children, and we do not knowingly collect personal data directly from children.

Datasets we process as a processor on behalf of our clients (for example in eDiscovery, data subject access requests or cyber incident response) may contain personal data relating to children. We recognise that some categories of personal data, such as those involving children, may carry inherently greater risks to individuals than others. Rather than applying different standards according to the type or perceived sensitivity of the data, we adopt a consistent and robust, risk-conscious approach, treating all personal data with the highest levels of protection, security and governance. This reflects our commitment to safeguarding the rights, privacy and dignity of every individual whose data we process and ensuring we deliver an exceptional and trusted service to our clients.

12. How to Contact Us

To exercise any of your rights, ask a question about this Notice or about our processing of your personal data, or raise a data protection/privacy complaint, please contact our Data Protection Lead by email at dataprotection@r3nquist.com or by post to: Data Protection Lead, R3NQUIST, LABS House, 15-19 Bloomsbury Way, London WC1A 2TH.

We will acknowledge receipt of your request within five working days. For general enquiries we will endeavour to respond fully as soon as possible. Where you are exercising your legal rights, we will respond substantively within one calendar month (extendable by a further two months for complex requests, with notification to you). We may need to verify your identity proportionately to the sensitivity of the request before responding.

Careers at R3NQUIST

We are building a team that is small, deliberate and at the forefront of agentic AI development. If that sounds like where you should be, tell us. Email talent@r3nquist.com. Any personal data you send us as a candidate is handled as described in Section 3.3.

13. Supervisory Authority Contacts

If you have concerns about how we collect, use, store or otherwise process your personal information, we encourage you to contact us in the first instance using the contact details provided in this Notice, so that we can seek to address your concerns.

Depending on your location and the nature of your complaint, you may also have the right to raise your concerns with the relevant regulator.

Contact details for the UK and EU below.

• United Kingdom: Information Commissioner's Office (ICO), 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL. Telephone 0303 123 1113 web ico.org.uk.
• European Union: the supervisory authority of the EU Member State of your habitual residence, place of work, or place of alleged infringement. A list of EU/EEA supervisory authorities is maintained by the European Data Protection Board at edpb.europa.eu.

14. Changes to This Notice

We will review this Notice annually and update it whenever there is a material change to our processing or to the underlying Privacy Policy. The version and effective date will appear at the top of the document. Where changes are material to you, we will notify you in advance: by email if you are an active contact; by other appropriate channel (including, once the R3NQUIST website is operational, a website banner) for general changes.

Earlier versions of this Notice will be retained in our governance record for audit purposes and are available on request from our Data Protection Lead at dataprotection@r3nquist.com.