The Horsey HR Lady Ltd | Company No. 12196378
Version 2.3 | November 2026
Last updated: 2 November 2026
Updated to reflect the Data (Use and Access) Act 2025
1. Who We Are
The Horsey HR Lady Ltd (HHRL) is a limited company registered in England and Wales, Company Number 12196378. We provide HR consultancy services to small and medium-sized businesses.
When we refer to ‘we’, ‘us’ or ‘our’ in this policy, we mean The Horsey HR Lady Ltd.
Data Controller: Emma Smith, Director
Contact: emma@thehorseyhrlady.co.uk | thehorseyhrlady.co.uk
Emma Smith acts as Senior Responsible Individual for data protection purposes under the Data (Use and Access) Act 2025.
2. What Information We Collect
2.1 Information you give us
- Your name, job title, and employer name
- Email address and telephone number
- Details of your enquiry or the services you are interested in
- Communications and correspondence sent to us
2.2 Information we collect automatically
- IP address, browser type and version, operating system
- Pages visited, time on site, referring URL
- Cookie data: see Section 5 below
2.3 Business contacts we find in public sources
Sometimes we find business contact details for HR consultancies and other organisations we think could work with us, such as a name and business address published on their own website. We use these details to send occasional business-to-business marketing by post, on the basis of our legitimate interest in growing our business. We only use details the business has published itself.
You can object at any time by emailing emma@thehorseyhrlady.co.uk, and we will stop straight away and keep only enough to make sure we do not contact you again. If you do not respond, we delete your details within 12 months.
3. How We Use Your Information
| Purpose | Lawful Basis |
|---|---|
| Responding to your enquiries and providing our services | Contractual necessity / Legitimate interests |
| Running webinars you have registered for and sending you the recording | Legitimate interests |
| Sending marketing communications (with your consent) | Consent (PECR and UK GDPR) |
| Sending occasional business-to-business marketing by post to business contacts found in public sources (see 2.3) | Legitimate interests |
| Improving our website and services | Legitimate interests |
| Complying with legal and regulatory obligations | Legal obligation |
| Managing data protection complaints | Legal obligation (DUAA 2025) |
4. Your Rights
Under UK GDPR and the Data (Use and Access) Act 2025, you have the following rights:
- Right of access: to receive a copy of personal data we hold about you. We apply a reasonable and proportionate standard when responding to access requests.
- Right to rectification: to have inaccurate data corrected
- Right to erasure: to request deletion of your data in certain circumstances
- Right to restrict processing: to limit how we use your data
- Right to data portability: to receive your data in a structured, machine-readable format
- Right to object: to object to processing based on legitimate interests
- Right to lodge a complaint: with the ICO (ico.org.uk) at any time
To exercise any of these rights, contact us at emma@thehorseyhrlady.co.uk. We will respond within 30 days.
5. Cookies
5.1 What are cookies?
Cookies are small text files placed on your device when you visit our website. We use Cookiebot as our Cookie Management Platform (CMP) to obtain and record your consent for non-essential cookies.
5.2 Cookie categories
| Category | Description | Consent Required? |
|---|---|---|
| Strictly Necessary | Essential for the website to function | No |
| Analytics | Help us understand how visitors use our site (e.g. Google Analytics, Microsoft Clarity) | Yes |
| Marketing | Used to track visitors across websites for advertising purposes | Yes |
| Preferences | Remember your settings and preferences | Yes |
Under the Data (Use and Access) Act 2025, three additional categories of cookie are exempt from consent requirements: privacy-preserving analytics, security/fraud-detection, and technical error-detection cookies. These are still disclosed in our full Cookie Policy.
5.3 Managing cookies
You can withdraw or change your consent at any time by clicking the round cookie icon in the bottom left corner of any page on our website, or by clearing cookies in your browser settings. Please note that disabling certain cookies may affect website functionality.
6. Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected. Our full Data Retention Schedule is available on request. In summary:
- Client records: 7 years from end of engagement
- Marketing contacts: until consent is withdrawn or 3 years of inactivity
- Webinar registrations: kept while the contact is active; if you unsubscribe, we keep only a suppression record so we do not contact you again
- Business contacts found in public sources: deleted within 12 months if there is no response; if you object, we keep only a suppression record
- Website enquiries: 2 years from date of enquiry
- Data protection complaints: 6 years from date of resolution
7. Sharing Your Information
We do not sell your personal data. We may share it with trusted third-party service providers who process data on our behalf, including:
- SuiteDash (CRM, client portal, and webinar and appointment registration): Data Processing Agreement in place
- Stripe (payment processing for invoices and paid bookings, such as clinics)
- Cookiebot / Usercentrics (cookie consent management)
- Google (Google Analytics, and YouTube where webinar recordings are hosted)
- Microsoft (Microsoft Teams for webinar delivery and recording, Microsoft Clarity, OneDrive)
- Canva (design tools: see note on international transfers)
We may also disclose data where required by law or to protect legal rights.
8. International Transfers
Some of our third-party providers are based outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions). We will update this section as our supplier arrangements change.
9. Complaints
If you are unhappy with how we have handled your personal data, please tell us. You can:
- complete our short complaint form at portal.thehorseyhrlady.co.uk/datacomplaint
- email Emma Smith at emma@thehorseyhrlady.co.uk
Tell us what happened, when, and what you would like us to do about it. You do not need an account or a login to complain.
We will acknowledge your complaint within 30 days of receiving it, and usually within five working days. We will then look into it, keep you updated if it is taking longer than we expected, and write to you with the outcome and the reasons for it.
If your complaint is about how an organisation we work for handles your personal data, rather than how we handle it, we will tell you and point you to them, because they decide how that information is used. If you would like us to, we will pass your complaint on to them.
If you are not happy with our response, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. The ICO usually expects you to raise a complaint with the organisation first, but you can contact them for advice at any time. Complaining to the ICO is free.
10. Changes to This Policy
We may update this policy from time to time. The current version and date are shown at the top of this page. Material changes will be communicated via our website.
| Version | Date | Summary of Changes |
|---|---|---|
| v1.0 | June 2025 | Initial version |
| v2.0 | June 2026 | Updated for DUAA 2025: SRI designation, DSAR reasonable/proportionate standard, PECR penalty reference, new cookie exemptions, complaints section |
| v2.1 | October 2026 | Webinar processing added: Microsoft Teams and YouTube named as processors, SuiteDash webinar registration noted, Stripe added for invoice and booking payments, webinar lawful basis and retention added |
| v2.2 | October 2026 | New section 2.3 on business contacts found in public sources and used for business-to-business marketing by post, with lawful basis and retention added |
| v2.3 | November 2026 | Complaints section rewritten: electronic complaint form added; acknowledgement and outcome separated in line with section 164A of the Data Protection Act 2018; redirect added for complaints about a client’s handling of personal data |