We are The HR & OD Consultancy Ltd, trading as You HR Consultancy and we are committed to protecting your personal data and respecting your privacy.

Ian Mundy (Consultancy Director) will ensure compliance with GDPR Data Security and the safe and secure governance of our systems and processes as responsible controllers and processors of You Consultancy client data; and as Senior Information Risk Owner (SIRO) in managing all Consultancy risks and general day to day data concern s /matters that arise and be accountable for data management overall and determining the means of processing for You Consultancy and for clients.

This notice explains how we collect, use, share, and protect personal data in connection with our services, website, and communications.

What Data We Collect
We may collect and process the following types of personal data:
• Contact details (name, address, email, phone)
• Employment information (job title, employer, work history)
• HR and organisational data (performance, attendance, feedback)
• Special category data (e.g., health, diversity) only where necessary and with appropriate safeguards
• Technical data (IP address, browser type, cookies)

How We Collect Data:
• Directly from you (e.g., onboarding forms, emails, meetings)
• From your employer or organisation
• Through our website and online platforms (including cookies)
• From third parties (e.g., payroll, benefits providers)

Lawful Basis for Processing
We process personal data under the following lawful bases:
• Performance of a contract
• Compliance with legal obligations
• Legitimate interests (e.g., service improvement, business operations)
• Consent (where required, e.g., for marketing)

How We Use Your Data
We use personal data to:
• Deliver HR and OD consultancy services
• Communicate with you and your organisation
• Manage contracts, payroll, and benefits
• Comply with legal and regulatory requirements
• Improve our services and client experience

Data Sharing
We may share personal data with:
• Your employer or organisation
• Our service providers (e.g., IT, payroll, legal, audit)
• Regulatory authorities, where required by law
• Other third parties with your consent or as permitted by law

International Transfers
If we transfer personal data outside the UK/EEA, we ensure appropriate safeguards are in place (e.g., adequacy decisions, standard contractual clauses).

Data Retention
We retain personal data only as long as necessary for the purposes for which it was collected, to comply with legal obligations, or as set out in our retention policy.

Security
We implement technical and organisational measures to protect personal data against unauthorised access, loss, or misuse.
Your Rights

You have the right to:
• Access your personal data
• Request correction or deletion
• Object to or restrict processing
• Request data portability
• Withdraw consent (where processing is based on consent)

How to Exercise Your Rights
To exercise your rights, please contact us at:
Email: alice@hr-od.co.uk
Address: Howbery Business Park, Wallingford, Oxfordshire, OX10 8BA
Phone: 01491 524 100

Complaints
If you have concerns about how we handle your data, please contact us. You also have the right to complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/

Updates to This Policy
We may update this policy from time to time. We will notify you of significant changes via our website or direct communication.

Last updated: 1st September 2025