Privacy Policy

1. Data Controller

The data controller is:

HRB maintains a sovereign data governance model: we collect only what is necessary, retain only what is required, and never process personal data beyond its intended purpose.

2. Data We Collect

We collect personal data only when you voluntarily provide it through the contact or enquiry forms on this website. This may include:

• name
• organisation and role
• email address
• the content of your message or enquiry

We do not:

• use tracking cookies
• use analytics, advertising pixels, or behavioural profiling
• conduct automated decision-making or automated assessments
• collect personal data automatically beyond essential server logs

3. Lawful Basis for Processing

We process personal data only where lawful and necessary:

• Legitimate interests (Article 6(1)(f) UK GDPR) — where you initiate contact and we must respond or evaluate your enquiry.
• Contract (Article 6(1)(b)) — where processing is required to take steps at your request prior to entering into an engagement.

We do not rely on consent except where explicitly required by law.

4. How We Use Your Data

Personal data submitted through this website is used solely to:

• respond to your correspondence
• evaluate your enquiry
• take steps toward a potential engagement

We do not:

• use personal data for marketing
• sell, rent, or trade personal data
• enrich data using third-party sources
• share data with third parties except where legally required or operationally necessary to fulfil your request

Purpose limitation is strictly applied: data is never repurposed.

5. Data Retention

We retain correspondence data only for as long as necessary to manage the communication or engagement, and for up to six years thereafter in line with UK limitation periods.

Enquiries that do not lead to an engagement are deleted within 12 months.

Retention schedules are reviewed annually, and data is securely erased when no longer required.

6. Your Rights

Under UK GDPR, you have the right to:

Requests may be submitted to contact@hrbgroup.co.uk. We respond within one month, and no fee is charged unless a request is manifestly unfounded or excessive.

You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. International Transfers

HRB operates primarily within the United Kingdom. Where form submissions are processed by Formspree, Inc. (USA), transfers are governed by:

• Standard Contractual Clauses (SCCs)
• the UK Addendum
• Formspree's published privacy documentation

HRB does not transfer personal data to jurisdictions without adequate protection and does not offshore data except where technically necessary.

8. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be reflected in the "Last updated" date above. Continued use of the website following any update constitutes acceptance of the revised policy.

9. Contact

For any data protection enquiry, contact: