Privacy Policy

Last updated 4 August 2026

Who we are

This website is operated by RFA Next-Gen Inc (“RFA”, “we”, “us”), 330 Madison Avenue, 29th Floor, New York, NY 10017. RFA is the data controller for personal data collected through this site. For anything in this policy, or to exercise any of the rights described below, contact help@rfa.com, or write to the Legal Department – Privacy at the address above.

This policy covers this website only. RFA's handling of client data under a Statement of Work is governed by that agreement, not by this page.

Personal data we collect

We collect only what you give us and what the site needs to operate. There is no account system and no profile building.

• Contact enquiries. When you submit the contact form we collect your first and last name, work email address, telephone number, firm name, your role, the services you indicated an interest in, and anything you write in the message field.
• Newsletter sign-ups. Your email address, and nothing else.
• Usage data. Aggregate analytics about how the site is used — pages viewed, referring site, country, device type. See the Cookie Policy for exactly what is collected and when.
• Technical data. Our hosting provider processes IP addresses and request metadata to serve the site and protect it from abuse.

We do not knowingly collect personal data from children under 13, and this site is not directed at them. We do not collect special category data, and we ask that you not include any in a message to us.

Why we use it, and our legal basis

• To respond to your enquiry and to provide information you asked for — on the basis of our legitimate interest in responding to people who contact us about our services, and to take steps at your request before entering into a contract.
• To send you the newsletter — on the basis of your consent, which you can withdraw at any time using the unsubscribe link in any email.
• To measure how the site is used — analytics cookies are set only on the basis of your consent. Cookieless measurement, which sets no identifier, runs on the basis of our legitimate interest in knowing whether the site works.
• To keep the site secure and available — on the basis of our legitimate interest in preventing abuse and diagnosing faults.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we run no advertising trackers on this site.

Who we share it with

We use a small number of service providers, each processing personal data on our instructions:

• HubSpot — our CRM and marketing platform, which receives contact-form and newsletter submissions. RFA's HubSpot instance is hosted in the European Union.
• Vercel — hosting and cookieless performance measurement.
• Google Analytics — website analytics, loaded only if you accept analytics cookies.
• Titan — RFA's parent company, which administers the Google Analytics property this site reports into. Its personnel can access the analytics data that property holds. No other data described on this page is shared with Titan by this website.
• Lever — our recruitment platform. Job listings are displayed here, but applications are made on Lever's own site under their privacy notice; we do not receive applications through this website.

We may also disclose personal data to professional advisers, to a purchaser in connection with a business transfer, or where we are required to by law or to establish or defend legal claims.

International transfers

RFA operates in the United States, the United Kingdom, Luxembourg and France, and some of the providers above process data in the United States. Where personal data is transferred out of the UK or the European Economic Area, that transfer is covered by an appropriate safeguard — in practice, the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), or the recipient's certification under the EU–U.S. Data Privacy Framework and its UK Extension. You can request details of the safeguard applying to a particular transfer at the contact address above.

How long we keep it

We keep enquiry records for as long as needed to deal with your enquiry and to maintain a record of our dealings with you, and newsletter subscriptions until you unsubscribe. Analytics data is retained on Google's standard retention setting for the property. We delete or anonymise personal data when it is no longer needed for the purpose it was collected for.

Your rights

Depending on where you live, you have some or all of the following rights over your personal data: to access it, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time without affecting processing carried out before you withdrew it.

If you are in California, you have the right to know what personal information we collect and how we use it, the right to request its deletion or correction, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA. We honour Global Privacy Control signals sent by your browser.

To exercise any of these, email help@rfa.com. You also have the right to complain to a data protection authority: in the UK the Information Commissioner's Office, in Luxembourg the Commission Nationale pour la Protection des Données, and in France the CNIL.

Cookies

Analytics cookies are set only after you accept them, and you can change your mind at any time from the “Cookie settings” link in the footer. The Cookie Policy lists every cookie and storage key this site uses.

Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit. No method of transmission is completely secure, and email in particular is not — please do not send confidential information to us by email. Where a personal data breach is likely to result in a risk to your rights, we will notify you and the relevant authority as required by law.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed, and material changes will be brought to your attention on the site.