The Horsey HR Lady Ltd | Company No. 12196378
Version 2.2 | October 2026
Last updated: 20 October 2026
Updated to reflect the Data (Use and Access) Act 2025
1. Who We Are
The Horsey HR Lady Ltd (HHRL) is a limited company registered in England and Wales, Company Number 12196378. We provide HR consultancy services to small and medium-sized businesses.
When we refer to ‘we’, ‘us’ or ‘our’ in this policy, we mean The Horsey HR Lady Ltd.
Data Controller: Emma Smith, Director
Contact: emma@thehorseyhrlady.co.uk | thehorseyhrlady.co.uk
Emma Smith acts as Senior Responsible Individual for data protection purposes under the Data (Use and Access) Act 2025.
2. What Information We Collect
2.1 Information you give us
- Your name, job title, and employer name
- Email address and telephone number
- Details of your enquiry or the services you are interested in
- Communications and correspondence sent to us
2.2 Information we collect automatically
- IP address, browser type and version, operating system
- Pages visited, time on site, referring URL
- Cookie data: see Section 5 below
2.3 Business contacts we find in public sources
Sometimes we find business contact details for HR consultancies and other organisations we think could work with us, such as a name and business address published on their own website. We use these details to send occasional business-to-business marketing by post, on the basis of our legitimate interest in growing our business. We only use details the business has published itself.
You can object at any time by emailing emma@thehorseyhrlady.co.uk, and we will stop straight away and keep only enough to make sure we do not contact you again. If you do not respond, we delete your details within 12 months.
3. How We Use Your Information
| Purpose | Lawful Basis |
|---|---|
| Responding to your enquiries and providing our services | Contractual necessity / Legitimate interests |
| Running webinars you have registered for and sending you the recording | Legitimate interests |
| Sending marketing communications (with your consent) | Consent (PECR and UK GDPR) |
| Sending occasional business-to-business marketing by post to business contacts found in public sources (see 2.3) | Legitimate interests |
| Improving our website and services | Legitimate interests |
| Complying with legal and regulatory obligations | Legal obligation |
| Managing data protection complaints | Legal obligation (DUAA 2025) |
4. Your Rights
Under UK GDPR and the Data (Use and Access) Act 2025, you have the following rights:
- Right of access: to receive a copy of personal data we hold about you. We apply a reasonable and proportionate standard when responding to access requests.
- Right to rectification: to have inaccurate data corrected
- Right to erasure: to request deletion of your data in certain circumstances
- Right to restrict processing: to limit how we use your data
- Right to data portability: to receive your data in a structured, machine-readable format
- Right to object: to object to processing based on legitimate interests
- Right to lodge a complaint: with the ICO (ico.org.uk) at any time
To exercise any of these rights, contact us at emma@thehorseyhrlady.co.uk. We will respond within 30 days.
5. Cookies
5.1 What are cookies?
Cookies are small text files placed on your device when you visit our website. We use Cookiebot as our Cookie Management Platform (CMP) to obtain and record your consent for non-essential cookies.
5.2 Cookie categories
| Category | Description | Consent Required? |
|---|---|---|
| Strictly Necessary | Essential for the website to function | No |
| Analytics | Help us understand how visitors use our site (e.g. Google Analytics, Microsoft Clarity) | Yes |
| Marketing | Used to track visitors across websites for advertising purposes | Yes |
| Preferences | Remember your settings and preferences | Yes |
Under the Data (Use and Access) Act 2025, three additional categories of cookie are exempt from consent requirements: privacy-preserving analytics, security/fraud-detection, and technical error-detection cookies. These are still disclosed in our full Cookie Policy.
5.3 Managing cookies
You can withdraw or change your consent at any time by clicking the ‘Cookie Settings’ link in the footer of our website, or by clearing cookies in your browser settings. Please note that disabling certain cookies may affect website functionality.
6. Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected. Our full Data Retention Schedule is available on request. In summary:
- Client records: 7 years from end of engagement
- Marketing contacts: until consent is withdrawn or 3 years of inactivity
- Webinar registrations: kept while the contact is active; if you unsubscribe, we keep only a suppression record so we do not contact you again
- Business contacts found in public sources: deleted within 12 months if there is no response; if you object, we keep only a suppression record
- Website enquiries: 2 years from date of enquiry
- Data protection complaints: 6 years from date of resolution
7. Sharing Your Information
We do not sell your personal data. We may share it with trusted third-party service providers who process data on our behalf, including:
- SuiteDash (CRM, client portal, and webinar and appointment registration): Data Processing Agreement in place
- Stripe (payment processing for invoices and paid bookings, such as clinics)
- Cookiebot / Usercentrics (cookie consent management)
- Google (Google Analytics, and YouTube where webinar recordings are hosted)
- Microsoft (Microsoft Teams for webinar delivery and recording, Microsoft Clarity, OneDrive)
- Canva (design tools: see note on international transfers)
We may also disclose data where required by law or to protect legal rights.
8. International Transfers
Some of our third-party providers are based outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions). We will update this section as our supplier arrangements change.
9. Complaints
If you have a concern about how we handle your personal data, please contact us first at emma@thehorseyhrlady.co.uk. We have a documented internal complaints procedure and will respond within 30 days.
You also have the right to complain to the ICO at any time: ico.org.uk | 0303 123 1113.
10. Changes to This Policy
We may update this policy from time to time. The current version and date are shown at the top of this page. Material changes will be communicated via our website.
| Version | Date | Summary of Changes |
|---|---|---|
| v1.0 | June 2025 | Initial version |
| v2.0 | June 2026 | Updated for DUAA 2025: SRI designation, DSAR reasonable/proportionate standard, PECR penalty reference, new cookie exemptions, complaints section |
| v2.1 | October 2026 | Webinar processing added: Microsoft Teams and YouTube named as processors, SuiteDash webinar registration noted, Stripe added for invoice and booking payments, webinar lawful basis and retention added |
| v2.2 | October 2026 | New section 2.3 on business contacts found in public sources and used for business-to-business marketing by post, with lawful basis and retention added |