HR Support Group – Data Privacy Policy

 Last Updated: October 2025

HR Support Group (“we”, “our”, or “us”) is committed to protecting the privacy and confidentiality of personal information entrusted to us. This Privacy Policy explains how we collect, use, store, and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable data privacy laws of the United Kingdom.

This policy applies to all individuals whose data we process, including clients, client employees, job applicants, suppliers, website visitors, and our own staff and consultants.

HR Support Group is a Human Resources consultancy providing outsourced HR services, audits, compliance reviews, and employment law support to businesses across the UK.

Data Controller: HR Support Group
Business Location: 71-79 Shelton Street, Covent Garden, London. WC2H 9JQ
Email: info@hrsupportgroup.co.uk

We are registered with the Information Commissioner’s Office (ICO) as a data controller.

We may collect and process the following categories of personal data:

• Names, addresses, email addresses, phone numbers
   
• Job titles, employment details, disciplinary or grievance records (where HR casework is supported)
   
• Payroll or HR system data shared by clients for HR management purposes
   

• Contact details, bank information (for payment and invoicing)
   

• IP addresses, browser type, and usage statistics (via cookies or analytics tools)
   
• Contact form submissions and email correspondence
   

In some HR cases, we may process sensitive information such as health data, diversity information, or trade union membership. This will only occur where necessary for legal or contractual purposes and with explicit consent or another lawful basis.

We use personal information to:

• Deliver HR consultancy and compliance services to clients
   
• Communicate with clients and suppliers
   
• Maintain accurate HR records and case documentation
   
• Fulfil legal, regulatory, or contractual obligations
   
• Improve our website and service offering
   
• Manage marketing communications (with opt-in consent)
   

We will not sell, rent, or trade personal information to third parties.

Under UK GDPR, our lawful bases for processing personal data are:

• Contractual necessity: To deliver HR services under client agreements
   
• Legal obligation: To comply with employment, tax, or regulatory requirements
   
• Legitimate interests: To manage operations, maintain relationships, and improve services
   
• Consent: For marketing communications and special category data where required
   

We may share data with:

• Professional partners and subcontractors providing HR, payroll, legal, or IT support
   
• Legal or regulatory bodies (e.g. HMRC, ACAS, Employment Tribunals) where required by law
   
• Cloud storage and software providers hosting HR documentation securely within the UK or approved jurisdictions
   

All third parties are required to handle your data in accordance with UK GDPR and our written data processing agreements.

Where personal data is transferred outside the UK, we ensure it is protected by appropriate safeguards, such as UK Government-approved adequacy decisions or standard contractual clauses (SCCs).

We retain personal data only as long as necessary for the purposes it was collected, including for legal, regulatory, or professional record-keeping requirements.

Typically:

• Client case records: 6 years after engagement ends
   
• Employee records (internal): 6 years after employment ends
   
• Financial and invoicing data: 7 years (per HMRC requirements)
   

After this period, data will be securely deleted or anonymised.

We implement robust security measures, including:

• Encrypted digital storage and password-protected systems
   
• Restricted access to authorised personnel only
   
• Secure transmission and backup protocols
   
• Regular audits and staff data-protection training
   

In the event of a data breach, we will follow ICO reporting procedures and notify affected individuals where legally required.

Under UK GDPR, individuals have the following rights:

1. Right to be informed – about how your data is used
    
2. Right of access – to request copies of your personal data
    
3. Right to rectification – to correct inaccurate data
    
4. Right to erasure – to request deletion where data is no longer needed
    
5. Right to restrict processing – in certain circumstances
    
6. Right to data portability – to receive your data in a usable format
    
7. Right to object – to processing based on legitimate interests or direct marketing
    
8. Rights related to automated decision-making and profiling
    

Requests can be made in writing to:
Data Protection Officer, HR Support Group
Email: info@hrsupportgroup.co.uk

We will respond within one calendar month.

Our website may use cookies to enhance user experience and track website usage.
Users can manage cookie preferences via their browser settings. Further details are available in our Cookie Policy.

We will only send marketing updates (e.g., HR law changes, newsletters, service updates) where you have opted in. You can unsubscribe at any time via the link in our emails or by contacting us directly.

If you have any concerns about how your data is handled, please contact us first.
If you remain unsatisfied, you may contact:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: www.ico.org.uk

We may update this Privacy Policy periodically to reflect changes in law or our operational practices. The latest version will always be available on our website or upon request.

For any data protection enquiries or to exercise your rights:
HR Support Group
Email: info@hrsupportgroup.co.uk
Registered in England, East Sussex