Privacy policy

Who we are and how to contact us

INVENIRE RISK LIMITED (company number 17296788), trading as Invenire Risk, is responsible for the personal information used to operate this website and handle enquiries and speculative applications. This notice covers visits to invenirerisk.com, requests about our advisory services, managed support and Sapere demonstrations, and applications sent through our careers contact address. It does not describe the processing of customer records inside the Sapere application or under a client engagement; those activities require their own applicable notices and contractual terms.

For privacy questions or to exercise your rights, email privacy@invenirerisk.com or use our privacy enquiry form. Briefly describe your question or request. We will reply using the contact details you provide.

Our Legal and company information page identifies the website operator and our general business contact routes.

Information we collect

The enquiry form requires your name, email address, enquiry type and message. Your organisation and the service you are interested in are optional. We also receive information you choose to send in subsequent correspondence. You are not required to make an enquiry, but the form needs its required fields to submit your request and allow us to respond.

Website and security services process technical information such as IP addresses, browser and device characteristics, pages requested, request times and security-check results. The form also creates a submission identifier and enquiry reference to manage delivery and avoid duplicate emails.

Please keep your message to a general description of your needs. Do not include passwords, client records, financial account details, health information or other sensitive or confidential material. If further information is needed, we can agree an appropriate way to exchange it.

Why we use your information

We use enquiry details and correspondence to understand your request, reply, arrange a demonstration and discuss relevant services. Our lawful basis is our legitimate interest in responding to business enquiries and managing business relationships, taking account of your rights and reasonable expectations. Where you personally ask us to take steps towards a contract with you, we may instead rely on those pre-contractual steps.

We also use information in privacy enquiries to answer your questions and meet applicable data protection obligations, including handling requests to exercise your rights.

We use technical information in our legitimate interests in delivering a reliable website, preventing spam and investigating misuse. We may retain or disclose information to comply with legal obligations or, where appropriate, in our legitimate interests in establishing, exercising or defending legal claims.

Submitting an enquiry or requesting a demonstration does not subscribe you to marketing emails or a newsletter. We do not treat submission of the form as consent to unrelated marketing.

How your enquiry reaches us

Your submitted form is processed by our website hosted on Vercel. After a Cloudflare Turnstile security check, the enquiry details are sent through Resend to our business mailbox. Your email address is included as the reply address so that we can respond to you.

The website form does not create a Sapere account or store your enquiry in a Sapere customer database. Copies of the message and delivery records are processed by the email services and our mailbox. Our form code does not write the message contents into application logs or save entered details in browser storage.

Emails sent directly to our published contact addresses, including speculative applications, are delivered to our Google Workspace business mailbox. Google provides email delivery and storage for this correspondence. Direct emails do not pass through the website form’s Turnstile check or Resend delivery step.

Service providers and other recipients

Vercel provides hosting, request handling and website delivery, including processing the form submission and technical request information. See Vercel’s data processing terms (opens in a new tab).

Cloudflare Turnstile processes technical signals to detect automated abuse. Cloudflare also uses these signals as a controller to improve its bot detection. Its Turnstile Privacy Addendum (opens in a new tab) explains these uses and how to contact Cloudflare about them.

Resend processes the enquiry email, its delivery information and related service records. Our mailbox provider stores received messages and our replies. Resend explains its practices in its data protection information (opens in a new tab).

Google Workspace provides email delivery and storage for our business correspondence, including direct enquiries and applications. Google’s Cloud Data Processing Addendum (opens in a new tab) describes its processing of customer data; the Google Cloud Privacy Notice (opens in a new tab) describes its handling of service data. These documents describe different processing roles.

People handling your enquiry may access the information needed to respond. We may also share relevant information with professional advisers or public authorities where necessary to meet legal obligations or establish, exercise or defend legal rights.

International processing

The website uses providers with international operations, so information may be processed outside the UK or the European Economic Area, including in the United States. Resend states that it stores message content and delivery records in the United States, including when email is sent from another region. Website enquiries therefore do not carry a promise of storage within the visitor’s country or within a Sapere customer’s selected hosting region.

Resend’s Data Processing Addendum (opens in a new tab) includes EU standard contractual clauses and UK transfer provisions. Other providers publish their own data protection and transfer terms. Contact us for details of the arrangements applicable to your information and how to obtain information about the relevant safeguards.

International processing can include email storage, service support, security records and access by authorised recipients; a provider’s country of incorporation alone does not identify every processing location. The published provider terms linked above describe their international-processing arrangements. For information about the destinations and safeguards applicable to your correspondence, or a copy of relevant safeguards, contact our privacy address. We may redact information needed to protect security or another person’s rights.

Speculative applications and recruitment enquiries

We welcome speculative applications through careers@inveniretalent.com, whether or not a role is advertised. INVENIRE RISK LIMITED is the controller of application information for opportunities with Invenire. Applying does not create an employment offer or a promise of future work.

Information and assessment

We use the name, contact details, CV or professional profile, experience, interests and correspondence you provide to assess your approach and discuss potential opportunities. Our lawful basis is our legitimate interest in identifying people whose skills may meet our business needs, taking account of your rights and reasonable expectations. Where you ask us to take steps towards a contract with you, the relevant processing may instead be necessary for those pre-contractual steps.

You choose whether to apply and what relevant information to provide; without sufficient contact and experience information, we may be unable to assess or respond to your approach. Access is limited to people considering your application and the service providers supporting our communications. Application email is handled through Google Workspace, as described above. We do not add applicants to unrelated marketing lists or make solely automated hiring decisions.

Please do not send identity documents, financial account details, health information or confidential information about clients or employers with an initial application. If we move to interviews, work samples, references or other checks, we will explain the process, relevant sources, recipients and retention arrangements before collecting further information. Any sensitive information or checks require an appropriate legal basis and safeguards. Tell us if you need an adjustment; we will explain what information is needed and how it will be handled.

Retention and future opportunities

We keep a speculative application while assessing it and during any resulting recruitment discussion. When that assessment or discussion ends without an appointment, we review the record for deletion or anonymisation. A limited record may be kept where needed to handle a complaint, meet a legal obligation or establish, exercise or defend legal claims; that does not mean keeping the full application indefinitely.

If we would like to retain your profile for future opportunities after that assessment, we will first ask for your separate consent and specify an expiry date or retention period. This is optional and is not a condition of having your current application considered. Without that consent, we do not retain your profile as part of a talent pool. At expiry we delete it from the pool unless you have agreed to a further defined period. If you join us, necessary records transfer to the relevant employment or associate file under the information provided at that stage.

You can withdraw your application, object to legitimate-interest processing or withdraw talent-pool consent by emailing privacy@invenirerisk.com or using our privacy enquiry form. Withdrawal does not affect earlier lawful processing. The international-processing, retention-exception and privacy-rights information in this notice also applies to applications, including your right to complain directly to a competent authority.

Cookies and browser storage

These website pages do not include advertising trackers or visitor analytics scripts. Our language switcher uses page links rather than a preference cookie. Hosting and security services may process technical signals or use storage needed for their functions; this is separate from advertising.

Turnstile automatically assesses traffic and may prevent a form submission if verification fails. You can retry the security check on the contact form. External websites linked from our pages have their own privacy and cookie practices.

How long information is kept

For business enquiries, retention depends on whether the request is open, an agreed follow-up or commitment remains outstanding, or the correspondence is needed for a resulting engagement. Once an enquiry is closed without an engagement, we review the correspondence for deletion or anonymisation unless a specific legal obligation, complaint or relevant claim requires a limited record. Correspondence that becomes part of a client engagement follows that engagement’s retention arrangements.

For privacy requests, we keep the request, relevant correspondence and outcome for as long as needed to demonstrate how we handled it, comply with applicable legal requirements and address a related complaint or claim. Identity-check information is limited to what is necessary and is not kept longer than needed for that purpose. We review closed records against these criteria; an enquiry or application is not a reason to retain unrelated information indefinitely.

Provider delivery records, security logs and backups have separate retention arrangements under the relevant service terms and settings. Removing a message from our mailbox does not necessarily remove every provider copy immediately. Contact us about the retention of a particular record or to request deletion; we will explain any applicable reason for retaining it.

Your choices and rights

Depending on the circumstances and applicable law, you can request access to your personal information, correction, deletion, restriction of processing or a portable copy. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. You can object to processing based on legitimate interests.

Use the privacy email address or enquiry form linked above to make a request. We may need proportionate information to verify your identity or clarify what you are asking for. We will respond within the applicable legal time limits and explain any exception that affects your request. The website enquiry process does not make decisions about you with legal or similarly significant effects.

You can complain directly to the Information Commissioner’s Office (opens in a new tab) in the UK, or the relevant data protection authority where you live or work. You do not have to contact us first.

Changes to this notice

We will update this page when the website or our handling of personal information changes. The date at the top identifies this version. We will explain a new processing purpose before using information for that purpose where required, and draw material changes to affected people’s attention through an appropriate website notice or direct communication.