Penrose HR - Privacy Policy

Last updated: November 2026

1. About Penrose HR

Penrose HR Ltd (“Penrose HR”, “we”, “us” or “our”) provides outsourced human resources consultancy and support services to businesses.

We take the protection of personal information seriously and are committed to handling personal data fairly, lawfully, securely and transparently in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other applicable data protection legislation.

For the purposes of data protection law, Penrose HR may act either as:

• a data controller, where we determine why and how personal information is used; or

• a data processor, where we process personal information on behalf of, and in accordance with the instructions of, one of our clients.

This Privacy Notice explains how we use personal information where Penrose HR acts as a controller and also explains our role when information is provided to us by clients as part of the HR services we provide.

Penrose HR Ltd
Company number: 13800520
ICO registration number: ZC153815

2. The Information We May Collect

The personal information we process will depend upon your relationship with Penrose HR.

This may include:

• name, job title and contact details;

• business and employment information;

• correspondence and communications with us;

• contractual information;

• information relating to enquiries, quotations and services provided;

• billing, payment and accounting information;

• employment history, job role, working hours and remuneration;

• attendance, sickness and absence information;

• performance, capability and conduct information;

• disciplinary and grievance information;

• family leave and flexible working information;

• information relating to redundancy, restructuring or termination of employment;

• recruitment and selection information;

• information contained within employment contracts, policies, meeting notes, correspondence and HR documentation; and

• information relevant to employment disputes, complaints, legal proceedings or potential legal claims.

We may receive personal information directly from you or from organisations that engage Penrose HR to provide HR support.

3. Special Category and Sensitive Information

Due to the nature of HR consultancy, we may sometimes process more sensitive personal information.

This can include information concerning:

• physical or mental health;

• disability;

• racial or ethnic origin;

• religious or philosophical beliefs;

• trade union membership;

• sexual orientation or sex life; and

• other information classed as special category personal data under data protection legislation.

We may also receive information relating to criminal allegations, convictions or offences where this is relevant to an employment matter.

We only process this type of information where it is necessary and lawful to do so. Depending upon the circumstances, this may include processing necessary in connection with employment and social protection law, the establishment, exercise or defence of legal claims, or another condition permitted by data protection legislation.

Where we process this information on behalf of a client, the client will normally remain responsible for identifying the appropriate lawful basis and condition for processing and Penrose HR will process the information in accordance with the client's lawful instructions.

4. How We Obtain Personal Information

We may obtain personal information:

• directly from you;

• from a business or organisation that employs or engages you;

• from managers, directors or authorised representatives of our clients;

• through our website, email, telephone or other communications;

• from documents supplied to us as part of an HR matter;

• from professional advisers or other third parties involved in an employment matter; or

• from publicly available sources where appropriate and lawful.

Where information about an employee, worker or applicant is supplied to us by a client, the client will normally be responsible for providing appropriate privacy information to that individual.

5. Why We Use Personal Information

We may use personal information to:

• respond to enquiries and provide quotations;

• enter into and manage client relationships;

• provide HR consultancy and employment-related support;

• prepare employment contracts, policies, letters and other HR documentation;

• advise clients regarding attendance, performance, conduct, capability, grievance, disciplinary, redundancy, family leave and other employment matters;

• assist with employee relations matters;

• maintain appropriate records of advice and services provided;

• communicate with clients and their authorised representatives;

• manage invoicing, payments and accounts;

• comply with our legal, regulatory and professional obligations;

• establish, exercise or defend legal claims;

• protect our business, clients, systems and information;

• manage complaints or disputes; and

• administer and improve our services.

We will not use personal information for purposes which are incompatible with the purpose for which it was originally collected unless permitted by law.

6. Our Lawful Bases for Processing

Depending upon the circumstances, we may rely upon one or more of the following lawful bases:

Contract Where processing is necessary to enter into or perform a contract with you.

Legal obligation Where we need to process information to comply with a legal obligation.

Legitimate interests Where processing is necessary for our legitimate business interests or those of a client or third party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include providing and administering HR consultancy services, maintaining appropriate business and professional records, managing client relationships, protecting our business and establishing or defending legal claims.

Consent In limited circumstances we may rely upon your consent. Where we do so, you may withdraw that consent at any time.

Different or additional conditions apply where we process special category or criminal offence data.

7. Information We Process on Behalf of Our Clients

A significant part of the work undertaken by Penrose HR involves processing employee, worker, applicant or former employee information supplied to us by our clients.

In these circumstances, the client will generally remain the data controller and Penrose HR will act as a data processor.

We will only process that information:

• for the purpose of providing the agreed HR services;

• in accordance with the client's lawful instructions;

• in accordance with our contractual data protection obligations; and

• subject to appropriate confidentiality and security measures.

If you are an employee, worker or former employee of one of our clients and wish to exercise your data protection rights in relation to employment records held on that organisation's behalf, you should normally contact your employer or former employer in the first instance.

Where appropriate, Penrose HR will assist its client in responding to the request.

8. Who We May Share Information With

Where necessary and lawful, personal information may be shared with:

• the relevant Penrose HR client and its authorised managers or representatives;

• IT, email, cloud-storage and other technology providers used to operate our business;

• accountants, insurers and professional advisers;

• solicitors, barristers or other legal advisers where required;

• regulators, government agencies, courts or tribunals where legally required;

• law enforcement authorities where appropriate; and

• other service providers who process information on our behalf.

We require organisations processing personal data on our behalf to handle that information appropriately and securely.

We do not sell personal information.

9. International Transfers

Some of the technology or service providers used by Penrose HR may store or process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with UK data protection legislation.

This may include relying upon an applicable UK adequacy regulation or using an approved contractual or other transfer mechanism together with appropriate safeguards.

10. How Long We Keep Information

We only retain personal information for as long as it is reasonably required for the purpose for which it was collected, including to meet legal, regulatory, contractual, accounting and professional requirements.

Retention periods will depend upon the type of information and the circumstances in which it is held.

As a general principle:

• unsuccessful or preliminary business enquiries will be retained only for an appropriate period following the last meaningful contact;

• client contractual, advisory and business records may normally be retained for up to six years following the end of the relevant client relationship or matter where appropriate for contractual, regulatory or legal-claims purposes;

• financial and accounting records will be retained for the period required by applicable tax and accounting legislation; and

• employee information processed solely on behalf of a client will be retained, returned or securely deleted in accordance with the client's instructions, our contractual obligations and any applicable legal requirements.

Information may be retained for longer where this is necessary in connection with an actual or reasonably anticipated legal claim.

When personal information is no longer required, it will be securely deleted or anonymised where appropriate.

11. Data Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

Access to personal information is limited to those who require it for legitimate business purposes and information is handled subject to appropriate confidentiality requirements.

Where third-party service providers process information on our behalf, we take reasonable steps to ensure that appropriate data protection and security arrangements are in place.

12. Your Data Protection Rights

Depending upon the circumstances and the lawful basis on which your information is processed, you may have the right to:

• be informed about how your personal information is used;

• request access to personal information held about you;

• request correction of inaccurate or incomplete information;

• request deletion of your personal information in certain circumstances;

• request restriction of processing in certain circumstances;

• object to processing in certain circumstances;

• request the transfer of certain information to you or another organisation where the right to data portability applies; and

• withdraw consent where processing is based upon consent.

These rights are not absolute and exemptions may apply in certain circumstances.

To exercise your rights where Penrose HR is the controller, please contact:

Email: hradvisor@penrosehr.co.uk

If Penrose HR holds your information solely on behalf of your employer or another client, we may refer your request to that organisation as the relevant data controller.

13. Automated Decision-Making

Penrose HR does not use personal information to make solely automated decisions which produce legal effects or similarly significant effects on individuals.

If this changes, this Privacy Notice will be updated and additional information will be provided where required.

14. Marketing Communications

We may contact existing or prospective business clients regarding Penrose HR services where permitted by law.

Where consent is required, marketing communications will only be sent where the appropriate consent has been obtained.

You can ask us to stop sending marketing communications at any time by contacting us or by using any unsubscribe facility provided.

We will retain sufficient information to record an opt-out request so that we can respect your marketing preferences.

15. Website, Squarespace and Cookies

The Penrose HR website is hosted and provided using Squarespace.

When you visit our website, certain technical information may be collected automatically by Squarespace and by the website. This may include:

• your IP address;

• browser type and version;

• operating system and device information;

• language and regional settings;

• referring website or page;

• pages viewed and the way you interact with the website;

• dates and times of visits;

• browsing duration, clicks and scrolling information; and

• technical information relating to website performance, errors and security.

Squarespace may process certain information about visitors to websites hosted on its platform for its own purposes, including providing, maintaining, protecting and securing its services. Further information about how Squarespace processes personal information can be found in the Squarespace Privacy Policy at: https://www.squarespace.com/privacy.

Cookies

Our website may use cookies and similar technologies.

Some cookies are essential for the website to operate correctly and may be required for purposes such as functionality, performance and security. These cookies may operate without your consent where permitted by law.

Other cookies, including analytics, marketing or other non-essential cookies, will only be used where appropriate and in accordance with your cookie preferences and applicable data protection and electronic communications requirements.

Where available, you can use the website's cookie banner or preference settings to accept, reject or manage non-essential cookies.

We may use website analytics to help us understand how visitors use our website, identify technical issues and improve the performance and effectiveness of our website. Where analytics involves non-essential cookies or similar technologies, these will only be activated where the appropriate consent has been provided.

We do not use information collected through our website to make solely automated decisions which have legal or similarly significant effects on individuals.

For further information about the cookies and similar technologies used by Squarespace, please refer to Squarespace's Cookie Policy and privacy information.

16. Links to Other Websites

Our website may contain links to third-party websites.

Penrose HR is not responsible for the privacy practices of third-party websites and you should review the privacy information provided by those organisations when visiting their websites.

17. Complaints

If you have concerns about the way Penrose HR has handled your personal information, please contact us first so that we have an opportunity to investigate and respond.

Email: hradvisor@penrosehr.co.uk

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

18. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our services, business practices or legal requirements.

The most recent version will be published on our website and the date at the top of this Notice will be updated accordingly.