Data Handling Privacy Policy
DATA PRIVACY POLICY
The HR Detectives Ltd (“we,” “us,” or “our”) is committed to protecting the privacy and security of your personal data . This privacy policy outlines how we collect, use, store, and protect the personal information of our clients, prospective clients, and other relevant parties in compliance with General Data Protection Legislation.
1. Who are we?
1.1. The HR Detectives Ltd is registered within England and Wales, Company Number 9331119. We provide consultancy services in the field of HR, specialising in workplace investigations, alongside provision of workplace mediation and conflict resolution coaching.
1.2. For the purposes of data protection legislation, we act as the data controller for the personal data we directly process in connection with the provision of our Services. There are also instances where we receive information from others, for example from employers, where we are likely to be either a joint controller or processor of that data.
1.3. The HR Detectives Ltd is registered as a Data Controller with the Office of the Information Commissioner, registration number ZA156914.
1.4. If you have any questions about this policy, or how we handle your data, please contact us:
Business name: The HR Detectives Ltd
Email: debbie@thehrdetective.co.uk
2. What information do we collect?
2.1. We aim to collect only personal data that is legitimately necessary for us to deliver our Services to you and respond to your queries. In this respect, we may collect and hold the following types of personal data (this list is not exhaustive as each matter, due to its nature, is different and has different requirements).
a) Your name and business contact details, and where relevant, your personal contact details
b) Matter information (where it includes personal data e.g. the name or personal contact details for others)
c) In the course of investigations we may hold additional personal information where relevant including but not limited to employment history, payroll data or performance reviews. Investigations may also include the need to hold special category data e.g. relevant information about health, disability, race.
2.2. We collect most of this information from authorised Client personnel or individuals in person, by telephone, email, or via agreed secure portals used to transfer data, or via a Microsoft Teams channel that may be set up to enable the delivery of our Services to you.
2.3. We are also likely to request organisation’s existing employee handbook, information relating to benefits and terms and conditions or HR policies and other documentation relevant to the investigation being conducted, albeit if these are in templated or anonymised formats, these will not amount to personal data.
3. How do we use your information?
3.1. Primarily we use information to enable us to prepare terms of reference and/or fee proposals, to fulfil our contractual obligations or to provide our Services that have been requested.
3.2. Managing client relationships, including communication, billing and feedback collection.
3.3. Complying with any legal obligations.
3.4. Improving our Services and understanding client needs.
3.5. Processing any complaints.
3.6. Administering, supporting, improving and developing our business generally and enforcing our legal rights.
4. How do we store and protect your information?
4.1. We take appropriate measures to safeguard personal data against unauthorised access, alteration, disclosure or destruction. These measures include:
a) Secure data storage, including password protection and encryption where necessary. and locked manual filing cabinets.
b) Limiting access to information to authorised personnel only.
c) Limiting requests to essential information only
5. Sharing your information
5.1. We may share your information with a third party, as required, to complete the Services. This could be third-party providers who assist us in delivering our services, for example investigation interview transcription services, an employment lawyer or IT support provider. We only allow third party providers to handle your personal data where necessary. In such circumstances there are formal agreements in place and we ensure those third parties take appropriate measures to protect your personal data.
5.2. In the context of an employment investigation, appropriate personal information may be shared in order for that investigation to be legitimately performed, which extends to any internal or external hearing following the investigation.
5.3. Legal or regulatory authorities, where required by law.
5.4. We may share your personal data with our insurers or any brokers – if there are grounds for a claim against us, or you make a claim against us.
5.5. The Information Commissioner Office or our insurers – if you make a data protection claim against us.
5.6. We would not share your personal data with any other third party without your prior consent.
6. Retention of information
6.1. After we have completed our Services, we will not retain your personal data for longer than necessary for the purposes outlined in this policy or to comply with legal obligations. This typically means information is retained for the duration of the client relationship and for up to seven years thereafter for legal or financial record-keeping purposes.
6.2. In the scenario where we are performing an investigation on behalf of an employer, all information gained or produced in the course of that investigation will be provided to the employer at the end of the investigation and a shorter retention period of two years may be applied by us to that specific information. We reserve the right to retain that information for longer, in individual cases, should it be appropriate in the circumstances due to ongoing legal, regulatory or employment proceedings.
7. Your rights
7.1. The General Data Protection Legislation gives you a number of rights, including rights to:
a) Request corrections to any mistakes in your personal data that we hold.
b) Access your personal data.
c) Restrict the processing of your personal data in certain circumstances.
d) Request that we erase your personal data in certain circumstances.
e) Withdraw consent for data processing, where applicable.
To exercise any of these rights, please contact us in writing using the details set out above in section one.
7.2. In the context of employment investigations, we are usually acting as a joint data controller or processor with the employer who has appointed us to perform the investigation. If making a subject access request regarding personal information within an investigation, that request should be directed to the relevant employer in the first instance. We will co-operate with that employer, if necessary, to provide any additional information needed to enable an appropriate and lawful response to the request.
8. What happens in the event of a data breach?
8.1. In the event of a data breach, we shall ensure that our obligations under applicable data protection laws are complied with where necessary. The following steps will typically be taken:
a) We will contain the breach.
b) Assess the breach and any adverse consequences for individuals, based on how serious or substantial these are and how likely they are to happen, and
c) To limit the scope of the breach taking steps to mitigate the effects of the breach.
8.2. Within 72 hours, we will determine the seriousness of the breach and whether the Information Commissioner and/or data subjects need to be notified of the breach.
8.3. We will maintain a detailed record of all data breaches, regardless of whether they are reportable to the Information Commissioner. This record will include:
a) The nature of the personal data breach.
b) The categories and approximate number of data subjects concerned.
c) The categories and approximate number of personal data records concerned.
d) A description of the likely consequences of the personal data breach.
e) A description of the measures taken or proposed to be taken to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
9. Complaints
9.1. Should you wish to complain about our use of your personal data, please contact us via email at debbie@thehrdetective.co.uk We will investigate all complaints received and will endeavour to respond to complaints promptly. You may also take your complaint directly to the Information Commissioners Office (ICO).
10. Updates to this policy
10.1. We may update this policy from time to time. You can contact us at any time for the latest version of this policy. We recommend reviewing this policy periodically to stay informed about how we process your data.
END
Version 2.0
Last reviewed September 2026