How we look after your information

Who we are

This website is run by Tall Trees HR.

For the personal data described in this policy, we are the “controller”. That means we decide how and why it is used. You can contact us about anything in this policy: Email info@talltreeshr.co.uk, call 07872 105500, or write to us at Swinton, Rotherham, South Yorkshire.

The information we collect

• When you contact us: your name, email address, phone number, job title, organisation and anything you choose to tell us in your message or on a call.
• When we work together: contact and billing details for you and your colleagues, and records of the advice and support we provide.
• When you visit this website: our hosting provider keeps short-term technical logs, such as your IP address, browser type and the pages requested, to keep the site secure and working. We do not use analytics, advertising or tracking cookies.

Information about your employees

When we support your organisation, we often handle personal data about your employees, workers and job applicants. This can include special category data, such as health information, and information about grievances, disciplinary matters or criminal offences.

For this information, your organisation is usually the controller and we act on your instructions as a processor. We agree how this data is handled in our engagement letter. We only use it to deliver the work you ask for, keep it confidential, store it securely, and return or delete it when the work ends unless the law requires us to keep it.

Why we use your information, and our lawful basis

• To reply to your enquiry and arrange a discovery call: our legitimate interests in responding to people who contact us, or taking steps at your request before entering into a contract.
• To deliver our services, send invoices and manage our relationship with you: performance of our contract with you.
• To keep accounting and tax records and meet our professional and legal duties: legal obligation.
• To keep this website secure and working: our legitimate interests in running a safe website.
• To send occasional updates about HR and employment law: your consent, or our legitimate interests where you are an existing client. You can opt out at any time.

Where we handle special category or criminal offence data for a client, we do so under the employment, social security and social protection condition and the legal claims condition in UK data protection law, as set out in our engagement terms.

Who we share it with

We never sell your data. We only share it with:

• Service providers who help us run the business, such as our email, IT, website hosting, accountancy and insurance providers. They may only use it to provide their service to us.
• Professional advisers, such as solicitors, where you have agreed or where it is needed to deliver the work.
• Regulators, courts or the police where the law requires it.

International transfers

Some of our service providers, including our website host, may process data outside the UK. When they do, we make sure there are appropriate safeguards in place, such as a UK adequacy decision, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework.

How long we keep it

• Enquiries that do not lead to work: up to 12 months after our last contact.
• Client records, advice and invoices: 6 years after the work ends, so we can deal with any questions or claims and meet our tax obligations.
• Employee data we handle for a client: for as long as our engagement letter says, then returned or securely deleted.
• Website security logs: kept by our hosting provider for a short period, usually no more than 30 days.

How we keep it safe

We use secure, password-protected systems with two-factor authentication where available, limit access to people who need it, and share sensitive documents securely. Everyone who works with us is bound by confidentiality.

Your rights

You have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct anything that is wrong or incomplete
• ask us to delete your data
• ask us to restrict or stop using your data, or object to how we use it
• ask for your data to be moved to another organisation
• withdraw your consent at any time, where we rely on it

To use any of these rights, contact us using the details above. We will reply within one month. There is usually no charge.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.

Changes to this policy

We review this policy regularly. The date at the bottom shows when it was last updated.