Privacy Policy

1.1 This Privacy Policy explains how Ritson Portfolio Ltd, trading as Sampler (the "Company", "we", "us", "our"), collects, uses, stores, and processes personal data when you use our platform (Platform).

1.2 We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.3 This policy applies to:

• Candidates using the Platform;
• Employers and Clients using the Platform; and
• visitors to our website.

2.1 Identity and Contact Data — Name, email address, phone number, and location.

2.2 Professional Information — Employment history, skills and experience, CVs and uploaded documents, and LinkedIn or other professional profiles.

2.3 Assessment and Performance Data — Responses to assessments and microtests; time taken to complete tasks and behavioural signals; AI-generated scores and insights across six dimensions: Problem Solving, Execution and Delivery, Learning Speed, Ownership and Initiative, Collaboration, and Communication; Talent Card data and summaries; post-trial employer feedback, including any exceptional performance signals recorded by Clients.

2.4 Platform Usage Data — Interactions with the Platform; trial participation and outcomes; employer feedback following trials; and engagement metrics.

2.5 Payment and Transaction Data — Payment records relating to trial shifts, Conversion Fee triggers, and payment status (via Stripe). We do not store full payment card details.

2.6 Technical Data — IP address, browser type, device information, cookies, and usage analytics.

3.1 Platform Functionality — Create and manage user accounts; enable candidate-employer matching; facilitate trial shift bookings.

3.2 Talent Evaluation and AI Processing — Generate Talent Cards; produce AI-driven scores and summaries; analyse performance across key dimensions; improve matching accuracy.

3.3 Employer Matching and Hiring — Display candidate profiles to relevant employers; enable employers to compare candidates; facilitate offer communication and hiring.

3.4 Payment Processing — Facilitate trial payments and refunds; process Conversion Fees; manage financial transactions via Stripe.

3.5 Communication — Send transactional emails (e.g. trial booking confirmations, reminders, offers) via Resend; provide platform updates and notifications; respond to support enquiries.

3.6 Platform Improvement — Analyse usage trends; improve AI models and matching systems; enhance user experience.

4.1 We rely on the following legal bases:

• Contractual necessity — to provide the Platform services you have signed up for;
• Legitimate interests — to improve and operate the Platform, prevent fraud, and maintain security;
• Consent — where required, such as for marketing communications and certain data sharing;
• Legal obligation — where we are required to process data by law.

5.1 The Platform uses automated systems to generate scores and performance insights, assist in candidate ranking and matching, and produce AI-driven summaries for Talent Cards.

5.2 These systems are designed to support, not replace, human decision-making. No decision with a legal or similarly significant effect is made solely by automated means without human involvement.

5.3 Employers make all final hiring decisions. The Company does not make hiring decisions on behalf of any party.

5.4 Candidates have the right to:

• request meaningful information about how their automated score or Talent Card was generated;
• request human review of any automated result that has a significant effect on their profile;
• object to processing based solely on automated means where it produces significant effects.

5.5 AI-generated scores are retained for the duration of the Candidate's active account and for up to 12 months following account deletion, after which they will be anonymised or deleted. The legal basis for retaining scores post-deletion is legitimate interest in maintaining the integrity of the Platform's matching data.

5.6 Requests relating to automated processing may be submitted to privacy@sampler.org.uk. We will respond within 30 days.

6.1 With Employers (Core Marketplace Function) — Candidate Talent Card information, assessment results, AI summaries, and profile and professional information may be shared with Clients as part of the core marketplace function.

6.2 Post-Offer Data Sharing — Once a Candidate accepts an offer, their personal contact details are shared with the Employer to enable contract issuance and onboarding. This occurs only after explicit Candidate consent via offer acceptance on the Platform.

6.3 Service Providers — We share data with trusted third-party service providers, including:

• Stripe — payment processing;
• Resend — transactional email delivery;
• Hosting and infrastructure providers.

All service providers are required to process data only in accordance with our instructions and in compliance with UK GDPR.

6.4 Legal Requirements — We may disclose data where required to comply with a legal obligation, court order, or to protect the rights, property, or safety of the Company, its users, or others.

7.1 We retain personal data:

• for as long as your account is active;
• as necessary to provide Platform services;
• to comply with legal and financial obligations (including HMRC requirements);
• for up to 12 months following account deletion, after which data will be anonymised or securely deleted.

7.2 Anonymised data may be retained indefinitely for analytics and system improvement purposes.

8.1 We implement appropriate technical and organisational measures to protect personal data, including:

• secure servers and encryption;
• access controls and authentication; and
• secure payment processing via Stripe.

8.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and will notify affected individuals where required.

9.1 You have the right to:

• Access your personal data (Subject Access Request);
• Correct inaccurate or incomplete data;
• Request deletion of your data (right to erasure), subject to legal obligations;
• Restrict or object to processing;
• Request data portability;
• Withdraw consent at any time where processing is based on consent;
• Request human review of automated decisions (see Section 5).

9.2 Requests can be submitted to [Insert Contact Email]. We will respond within 30 days. We may request proof of identity before processing requests.

9.3 You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your personal data.

10.1 We use cookies and similar technologies on our Platform. Cookies are small text files stored on your device.

Categories of Cookies We Use

• Essential cookies: necessary for core Platform functionality. These cannot be disabled.
• Analytics cookies: used to analyse usage and improve the Platform (e.g. page visits, session duration). These are only placed with your consent.
• Preference cookies: used to remember your settings and preferences.
• Third-party cookies: Stripe and other service providers may set cookies for payment processing and fraud prevention purposes.

10.2 In accordance with the Privacy and Electronic Communications Regulations (PECR), we will request your consent before placing non-essential cookies. You may withdraw consent or manage cookie preferences at any time via [Insert Cookie Preference Link] or through your browser settings.

10.3 A full Cookie Policy is available at sampler.org.uk/legal/cookie-policy.

11.1 Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as UK-approved Standard Contractual Clauses, to protect your data to an equivalent standard.

12.1 We may update this Privacy Policy from time to time. Where changes are material, we will notify users via the Platform or by email prior to the change taking effect.

12.2 Continued use of the Platform following notification of changes constitutes acceptance of the updated policy.

13.1 Ritson Portfolio Ltd, trading as Sampler, is the data controller for personal data processed via the Platform.

13.2 For any questions, data requests, or to exercise your rights: