Privacy Policy

We collect information you provide directly to us, including your name, email address, phone number, employer, job title, project description, and any attachments such as RFP documents or CV/portfolio links, when you submit our Engage form or apply to our specialist roster.

We also collect information automatically through cookies, server logs, and analytics tooling: IP address (anonymized), browser type, pages visited, referring URL, and approximate location at the city level. Our analytics provider is configured to honor Do Not Track and Global Privacy Control signals where supported by your browser.

For specialists applying to our roster, we additionally collect professional credentials (years of experience, certifications, references), regional availability, language fluency, and your CV or portfolio. This data is processed under explicit consent given at submission.

We use personal data to: (a) respond to your inquiry and provide the services you requested; (b) match specialists from our roster to client engagements; (c) maintain business records and our continuous quarterly vetting metrics, held strict since 2015; (d) comply with legal, tax, and regulatory obligations; and (e) communicate relevant updates such as our annual State of Renewable Manpower report (you may opt out at any time via the unsubscribe link).

For visitors and applicants in the European Economic Area, the United Kingdom, and Switzerland, we process personal data under the following lawful bases under Article 6 GDPR:

• Consent (Art. 6(1)(a)): for direct marketing communications and for processing CV / professional credentials of applicants to our roster.
• Contract (Art. 6(1)(b)): to perform our staffing or consulting agreement with you or your employer.
• Legitimate interests (Art. 6(1)(f)): for service improvement, fraud prevention, and the operation of our roster matching platform, balanced against your data protection rights.
• Legal obligation (Art. 6(1)(c)): for tax, financial reporting, and regulatory compliance under California, EU, and applicable international law.

We do not sell personal data. We share personal data only with: (a) our infrastructure providers (AWS, Cloudflare, Vercel) under data processing agreements; (b) our CRM platform (HubSpot or Zoho, as applicable) for inquiry management; (c) clients of HM RenewAI to whom we propose anonymized or, on opt-in, identified specialist profiles for engagement; (d) professional advisors (auditors, lawyers, tax counsel); and (e) authorities where required by law or court order.

Specialists on our active roster are presented to clients with their explicit consent. By default our pre-engagement materials are anonymized to a coded ID such as EXP-0421.

We maintain administrative, technical, and physical safeguards including encryption in transit and at rest, role-based access control, quarterly third-party penetration testing (since 2019), SOC 2 Type II compliance, and annual ISO 27001 surveillance audits. CVs and applicant credentials are stored in an isolated, encrypted vault with restricted access.

We retain personal data only for as long as necessary for the purposes set out in this Policy:

• Inquiry data: 36 months from last contact, then archived for legal-defense purposes for a further 12 months.
• Roster applicant data (CV, credentials): 24 months from application, after which we re-confirm consent or delete.
• Active specialist data: for the duration of roster membership plus seven years for tax and engagement-record retention.
• Client engagement records: seven years from end of engagement, per California and EU statutes of limitation.

Depending on your jurisdiction, you have the right to: access; rectification; erasure (“right to be forgotten”); restriction of processing; portability; objection; withdraw consent at any time; and, for California residents, opt-out of the sale or sharing of personal information (we do not sell) and limit use of sensitive personal information.

To exercise these rights, contact privacy@hmrenewai.com. We will respond within 30 days. You may also lodge a complaint with your local supervisory authority.

As a US-headquartered firm with EMEA and APAC offices (London since 2018, Singapore since 2020), we transfer personal data internationally. We rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent instruments for transfers from the EEA, UK, and Switzerland. For applicants and clients in mainland China, we additionally rely on the PIPL Standard Contract.

We use cookies and similar technologies for authentication, session continuity, and aggregated, privacy-respecting analytics. We do not use third-party advertising cookies. Our cookie banner, present since 2018, before EU enforcement was widely consistent, gives you granular control over non-essential cookies.

Our services are intended for business and professional use only. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have collected such data, we will delete it.

We may update this Privacy Policy from time to time. Material changes will be announced via email to active clients and roster members and through a banner on our website at least 30 days before they take effect. Older versions are archived and available on request.

For privacy questions, requests, or complaints: privacy@hmrenewai.com. Our Data Protection Officer (EU representative) can be reached at dpo@hmrenewai.com.

Postal: HM RenewAI, Inc., 123 Innovation Drive, Suite 400, San Francisco, CA 94107, USA.

See also our Terms of Service.