AI Policy

1. Introduction & Scope

TRM Flex Ltd ("TRM Flex", "we", "us") uses artificial intelligence ("AI") capabilities within our event operations platform to assist clients, workers, and administrators with operational tasks. This policy explains how AI is used, the legal basis for that use, the safeguards we apply, and the rights available to individuals whose data is processed by AI features.

This policy applies to all users of the TRM Flex platform, including:

• Clients booking workforce or event services
• Self-employed workers registered on the platform
• Administrators managing events, shifts, and operations
• Attendees at events coordinated via TRM Flex
• Suppliers engaged through the TRM Flex marketplace

For the purposes of this policy, "AI" refers to machine-learning models provided by third-party providers (including large language models and classification models) that are invoked by TRM Flex backend services to process structured and unstructured data on behalf of users.

2. Legal Framework

This policy is grounded in the following UK legislation and regulatory guidance:

3. What AI Is Used For

AI capabilities within TRM Flex are used for the following operational purposes:

• Event brief parsing: Converting natural-language event briefs into structured operational data
• Document triage: Classifying uploaded identification, compliance, and right-to-work documents
• CV and profile parsing: Extracting skills, experience, and availability from worker profiles
• Governance scanning: Reviewing event documentation for compliance gaps and risk indicators
• AI Copilot: An interactive assistant that helps clients navigate platform features, generate drafts, and answer operational questions
• CRM intelligence: Suggesting follow-up actions based on client interaction history
• Attendee qualification scoring: Assessing ticket buyer profiles against event relevance criteria
• Gap analysis: Identifying staffing or resource shortfalls across events
• Catering draft generation: Producing initial catering plans from event requirements
• Networking matching: Suggesting attendee introductions based on stated interests and professional profiles

All AI outputs are advisory. No AI feature on TRM Flex makes autonomous decisions that produce legal or similarly significant effects on individuals.

4. Lawful Basis for Processing

Personal data processed by AI features is done so under the following lawful bases as defined in UK GDPR Article 6:

• Article 6(1)(b) — Contract performance: AI processing is necessary to deliver the services contracted by clients (e.g., brief parsing, shift coordination, document classification).
• Article 6(1)(f) — Legitimate interest: For features such as CRM intelligence, qualification scoring, and gap analysis, where processing serves the legitimate operational interests of the data controller, balanced against the rights of the data subject.

TRM Flex does not process special category data (Article 9) through AI features. AI payloads are designed to exclude sensitive personal data including health information, trade union membership, biometric data, and data concerning sex life or sexual orientation.

5. Automated Decision-Making (UK GDPR Article 22)

In accordance with UK GDPR Article 22(1), data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects. TRM Flex confirms that:

• AI features generate suggestions, drafts, and scores — not final decisions
• All AI outputs are presented to a human operator (client, administrator, or worker) who retains full authority to accept, modify, or reject the output
• No shift assignment, financial calculation, compliance determination, or contractual commitment is made by AI alone
• Where AI scoring is used (e.g., attendee qualification), the score is one input among several and does not automatically trigger actions

In accordance with Article 22(3), any individual who believes they have been subject to a solely automated decision may request human intervention, express their point of view, and contest the decision by contacting us at the address in Section 12.

6. Data Handling & Security

TRM Flex implements the following technical measures to protect data processed by AI features:

• Secure backend gateway: All AI requests are routed through backend edge functions. No direct browser-to-AI-provider connections are made. API keys are never exposed to the client side.
• Transient processing: AI requests are stateless. Data sent to AI providers is processed in real time and is not retained by the provider after the response is returned.
• Encryption in transit: All data transmitted to AI providers is encrypted using TLS 1.2 or higher.
• Access controls: AI features are gated by role-based access control (RBAC) and row-level security (RLS). Users can only invoke AI on data they are authorised to access.
• Audit logging: All AI invocations are logged with timestamps, user identity, feature type, and usage metrics for accountability purposes.

7. No Data Sharing & No Model Training

TRM Flex makes the following commitments regarding data processed by AI features:

• No data sharing: Data submitted to AI features is not shared with any third party other than the contracted AI model provider for the sole purpose of generating the requested output.
• No model training: Data submitted to AI features is not used to train, fine-tune, or improve any third-party AI model. Our contracts with AI providers (including Google and OpenAI) explicitly prohibit the use of customer data for model training.
• No cross-client data use: Data from one client's account is never used in AI processing for another client. Multi-tenant isolation is enforced at the database level.
• Data Processing Agreements: TRM Flex maintains Data Processing Agreements (DPAs) with all AI model providers, ensuring compliance with UK GDPR requirements for data processor obligations (Article 28).

8. Data Minimisation & Bias Prevention

Data Minimisation (UK GDPR Article 5(1)(c))

In accordance with the principle of data minimisation, TRM Flex ensures that only data strictly necessary for the AI task is included in the processing payload. Specifically:

• Personally identifiable information (PII) is excluded from AI payloads where not essential to the task
• Bank account details, sort codes, and payment information are never sent to AI providers
• National Insurance numbers are never included in AI payloads
• Only the minimum contextual data required for the specific AI feature is transmitted

Bias Prevention (Equality Act 2010)

TRM Flex is committed to ensuring AI outputs do not discriminate on the basis of any protected characteristic as defined by the Equality Act 2010, including age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation.

• AI is not used to screen, rank, or filter workers based on personal characteristics
• Qualification scoring is based on professional criteria (role, industry, seniority) and not personal attributes
• AI outputs are subject to human review, providing an additional safeguard against discriminatory outcomes

9. Employment Status

All workers on TRM Flex are self-employed contractors. AI features within TRM Flex:

• Do not assess, determine, or imply employment status
• Do not generate outputs that could be interpreted as establishing an employer–employee relationship
• Do not calculate PAYE, National Insurance contributions, or any employer obligations
• Do not allocate work in a manner that could suggest mutuality of obligation or control inconsistent with self-employment

This position is consistent with the Employment Rights Act 1996 and HMRC's intermediaries legislation (IR35). Workers retain full responsibility for their own tax affairs, insurance, and regulatory compliance.

10. Your Rights

Under UK GDPR, you have the following rights in relation to personal data processed by AI features:

• Right to be informed (Articles 13–14): You have the right to know when AI is processing your data and for what purpose. This policy fulfils that obligation.
• Right of access (Article 15): You may request a copy of the personal data that has been processed by AI features.
• Right to rectification (Article 16): You may request correction of inaccurate data used in AI processing.
• Right to erasure (Article 17): You may request deletion of personal data, subject to legal retention obligations.
• Right to restrict processing (Article 18): You may request that AI processing of your data be restricted in certain circumstances.
• Right to object (Article 21): You may object to AI processing carried out under legitimate interest (Article 6(1)(f)).
• Right to human review (Article 22(3)): You may request human intervention in any decision that has been informed by AI output, express your point of view, and contest the outcome.
• Right to lodge a complaint: You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

To exercise any of these rights in relation to AI processing, please contact us using the details in Section 12.

11. Metering, Audit & Accountability

In accordance with the UK AI Regulation White Paper's accountability principle, TRM Flex maintains the following governance measures:

• Usage metering: AI usage is metered per client plan. Each AI invocation is recorded against the client's monthly allocation, providing full visibility of AI consumption.
• Audit trail: All AI invocations are logged with timestamps, user identity, feature type, and the AI model used. Logs are retained for 12 months.
• Confidence indicators: Where applicable, AI outputs include confidence scores or qualitative indicators to support informed human decision-making.
• Model versioning: The AI model version used for each invocation is recorded, enabling traceability and investigation of any concerns.
• Internal review: AI features are subject to periodic internal review to assess accuracy, fairness, and alignment with this policy.

12. Contact & Review

This policy is reviewed annually or following any material change to AI capabilities, AI providers, or applicable UK legislation. The most current version is always available on this page.

For questions about this policy, to exercise your data subject rights in relation to AI processing, or to raise a concern about an AI output, please contact: