Privacy Notice

Guiding North HR is the trading name of Derek Carter, a sole trader. Derek is the data controller for the personal information described in this notice.

Trading address: 58 St James's Gardens, Penicuik, Midlothian, EH26 9DU

Email: derek@gnhr.co.uk

This notice explains how Guiding North HR handles personal information relating to website visitors, prospective clients, business contacts and people who contact Derek about services.

It does not replace the data protection terms used for client work involving employee or worker information. For those engagements, the client and Guiding North HR will agree their respective controller and processor responsibilities in writing.

• Contact information, such as your name, email address, telephone number, business name and role.
• The contents of enquiries, emails and other correspondence, including any information you choose to provide.
• Information needed to discuss, prepare and deliver agreed services, manage the relationship and keep appropriate business records.
• Limited technical information generated when you visit the website, such as IP address, browser or device information, timestamps, security events and server logs processed by the website host.
• Cookie choices and information generated by optional website services, but only as explained in the Cookie Policy and, where required, after consent.

Please do not send sensitive case details: An initial website enquiry should not include confidential employee information, health information, allegations, criminal offence information or other special category data. Derek will arrange a more appropriate and secure way to receive necessary case information after the scope and data protection arrangements are agreed.

The website form uses a mailto link. The website validates and prepares the information in your browser, then opens your own email application with a draft message addressed to derek@gnhr.co.uk.

The website does not send the message, submit it to a Guiding North HR database or store the form contents. Nothing is sent until you choose to send the email through your own email provider. Once sent, the message is processed by your email provider and received in Derek's Microsoft 365 inbox.

The website host may still process routine technical and security information when pages are visited, independently of the enquiry form contents.

Where processing is based on legitimate interests, Derek considers the business need, the information involved and the reasonable expectations and rights of the people affected.

Information is shared only where necessary and proportionate. Recipients may include:

• Microsoft 365, for business email, document storage and related business systems.
• Lovable and its relevant subprocessors, for website hosting, security and technical operation.
• Professional advisers, accountants, insurers and legal advisers where needed.
• Trusted associates or specialist contributors working with Derek, but only where needed for agreed services and subject to appropriate confidentiality and data protection terms.
• Website integration providers, such as Google, YouTube, Calendly, Meta or a selected chat provider, only when the relevant service is active and in line with the Cookie Policy and consent choices.
• Public authorities, regulators, courts or law enforcement where disclosure is required or permitted by law.

Guiding North HR does not sell personal information.

Some technology suppliers may process information outside the UK. Where a restricted international transfer takes place, Guiding North HR will take reasonable steps to use a lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and complete any required transfer assessment or data protection test.

Derek may use approved AI tools, including Microsoft Copilot, ChatGPT and Claude, for limited activities such as calculations, analysing anonymised or aggregated data, identifying trends and supporting business insight.

Guiding North HR does not put identifiable or confidential client, employee or enquiry information into general-purpose AI tools. Information is anonymised before any permitted analysis. Removing names alone may not be enough if a person can still be identified from the remaining details.

AI is not used to make solely automated decisions about people, to determine employment outcomes, or as a substitute for Derek's professional judgement. Further detail appears in the Responsible AI Policy.

• Enquiries that do not become client work are normally deleted 12 months after the last meaningful contact.
• Spam and irrelevant correspondence are deleted immediately or within 30 days.
• If an enquiry becomes client work, relevant correspondence forms part of the client record and is retained under the client and legal retention schedule.
• Financial and tax records are retained for the periods required by HMRC.
• Information relating to a complaint, dispute, investigation or legal hold may be retained until the matter and any relevant retention need have ended.
• Truly anonymised statistics may be retained because they no longer identify an individual.

Further detail is recorded in Guiding North HR's internal Data Retention and Deletion Policy.

Guiding North HR uses proportionate technical and organisational safeguards, including controlled access, secure business accounts, Microsoft 365 security features, confidentiality arrangements and data minimisation. No internet service can be guaranteed completely secure, so sensitive case information should not be included in an initial website enquiry.

Depending on the circumstances, you may have rights to:

• ask for access to your personal information;
• ask for inaccurate or incomplete information to be corrected;
• ask for information to be erased;
• ask for processing to be restricted;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable format; and
• withdraw consent at any time where consent is the lawful basis.

These rights are not absolute and exemptions may apply. To make a request, email derek@gnhr.co.uk. Derek may need to verify your identity before responding.

Please contact Derek first so he has the opportunity to resolve your concern. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

This notice will be reviewed regularly and updated before any significant new use of personal information begins. The effective date at the top shows when it was last updated.