Who we are
Data controller: ROCWAN Limited, Suite 11311, 26/27 Upper Pembroke Street, Dublin 2, Ireland. Contact for privacy matters: info@rocwan.com.
What this notice covers
This website, its forms and its analytics. A fuller candidate-privacy notice is provided when a recruitment engagement begins.
Data we collect via forms
- Client and general form: name, work email, company, phone (optional), message.
- Candidate form: name, email, phone (optional), discipline, sector preferences (optional), LinkedIn URL (optional), CV (optional), free-text notes (optional).
We do not ask for your current salary.
No special-category data is sought; please do not include it in free text. A CV is optional: if you attach one it travels with your registration to our careers mailbox and is held under the same retention rule as the rest of your details. If you would rather send it later, against a specific requirement, that is fine.
Subscriptions
Each of the three News and Insights sections lets you ask to be emailed when something new is published there. That is separate from the forms above, and the three are separate from each other: you subscribe to one section at a time, and leaving one does not touch the others.
- What we store: your email address, which of the three lists it is for, the date you asked, and the page you asked from. No IP address, no name, nothing else.
- Basis: consent, given when you submit the form.
- Retention: until you unsubscribe. There is no automatic expiry, because the list exists only to send you the thing you asked for.
- Unsubscribing: reply to any email we send, or write to info@rocwan.com. We take you off that list and confirm it is done.
Why and on what basis
- Client enquiries: legitimate interests (responding to a business enquiry).
- Candidate registrations: consent (the register-interest pool) and pre-contractual steps once a specific role is discussed.
- You can withdraw consent at any time by emailing careers@rocwan.com.
Where data goes
- Form submissions are first stored in our own database and file store on Cloudflare (EU jurisdiction), then delivered to ROCWAN mailboxes (Microsoft 365) through Brevo, an EU email provider acting as a processor. Storing first means an enquiry cannot be lost if email delivery has a problem.
- The site is served via Cloudflare (processor).
- Analytics goes to the two tools set out under Analytics below: Plausible Analytics (EU-hosted) and PostHog Cloud EU (Frankfurt). Both are processors acting on our instructions.
- Data residency is not one-size-fits-all. For client engagements we host in the EU or in the United States depending on where the client operates, and other residency requirements can be explored and agreed before any work begins.
Analytics, two layers
- Cookie-free layer (always on): Plausible Analytics. No cookies, no persistent identifiers, aggregate statistics only, EU-hosted. No consent is required, which is why the consent card does not mention it. Basis: legitimate interests, documented here.
- Site measurement (on by default, switch it off whenever you like): PostHog Cloud EU, hosted in Frankfurt, with the data held in the EU. It runs in cookieless mode at all times, so it never sets a cookie, never writes to your browser's storage and never gives you an identifier that follows you between visits. It counts using a code made on PostHog's own servers from a secret value that changes every day and is destroyed within four days, so you look like a new person each day. Your IP address is used to build that code and is then discarded rather than stored. What it measures is which pages are read, where people click and how far they scroll, all of it about the pages rather than about you.
- There is no session recording on this site. It was removed rather than switched off, so there is no setting that could turn it back on by accident.
Because none of this reads or writes anything on your device, we do not ask you to consent to it. We rely on our legitimate interest in understanding how our own site performs, and you have an absolute right to object: press Turn measurement off on the card, or use the control below, and everything stops. Refusing costs you nothing on this site.
We never send names, email addresses, phone numbers, CVs or any form contents to either analytics tool, whatever your consent choice.
Retention
- Client enquiries: the stored copy of your form submission is deleted automatically 12 months after you send it; the mailbox copy is kept as long as needed to handle the enquiry and relationship.
- Candidate register-interest data, including any CV you attach: 24 months from last meaningful contact, then deleted or refreshed with new consent. The stored copy of your form submission and CV is deleted automatically 24 months after you send it. We aim to come back to you well before that to check the details are still current.
- Analytics: if you allowed the behaviour layer, session recordings are deleted after 30 days and the other analytics records after a year, both set on our PostHog project. If you declined, or never answered, there is nothing held that can be traced back to you.
- Subscription lists: your address stays on the list you chose until you unsubscribe, then it is deleted.
- Consent records are kept as evidence of the choice.
Your rights
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent, exercised by email. You can complain to the Data Protection Commission.
Automated decision-making
We do not make decisions about you by solely automated means that produce legal or similarly significant effects. Technology assists our team; people make the decisions.
Changes
This is the first published version of this notice. Material changes will be noted here with a new date.