Last updated: 4 May 2026
1. About this privacy notice
Shrewd HR Ltd respects your privacy and is committed to protecting your personal information.
This privacy notice explains how we collect, use, store and share personal information when you:
- visit our website
- contact us about our services
- become a client or work with us through a client organisation
- attend one of our training sessions or events
- subscribe to our newsletter or other marketing
- apply for a role with us
- supply services to us
- otherwise communicate or interact with Shrewd HR
It also explains your rights and how to contact us if you have a question or concern about how we use your information.
2. Who we are
Shrewd HR Ltd is a private limited company registered in England and Wales.
Company name: Shrewd HR Ltd
Company number: 12761498
Registered office: Durham Cricket, Banks Homes Riverside, Chester-le-Street, County Durham, DH3 3QR
Telephone: 0191 375 5770
Email: [email protected]
Website: shrewd-hr.co.uk
For most of the personal information covered by this notice, Shrewd HR Ltd is the data controller. This means we decide why and how that information is used.
We have not appointed a formal Data Protection Officer. Questions about privacy and data protection should be sent to the contact details above.
3. When we act on behalf of our clients
As an HR consultancy, we may handle personal information about a client’s employees, workers, contractors, job applicants and former employees.
In many of these circumstances, the client organisation is the data controller and Shrewd HR acts as its data processor. We only use the information in accordance with the client’s documented instructions and our agreement with them.
This may include information relating to:
- employment contracts and personnel records
- absence, health and reasonable adjustments
- disciplinary and grievance matters
- performance and capability
- recruitment and onboarding
- redundancy, restructuring and TUPE
- employee relations and workplace investigations
- settlement discussions and employment claims
- payroll, benefits and working arrangements
Where your information has been provided to us by your employer or another organisation, you should usually direct a data protection request to that organisation first. We will assist our client in responding where required.
There may be limited circumstances where Shrewd HR acts as an independent controller, including where we must keep information to meet our own legal obligations, protect our legal rights, manage conflicts or respond to a complaint or legal claim.
4. The personal information we collect
The information we collect depends on your relationship with us.
Identity and contact information
This may include your:
- name
- job title and employer
- postal address
- email address
- telephone number
- professional contact details
Enquiry and communication information
This may include:
- information submitted through our website forms
- emails, telephone calls and other correspondence
- WhatsApp messages
- details of the HR support or service you are interested in
- notes of meetings and conversations
- your communication and marketing preferences
Please avoid sending sensitive personal or employee information through a general website enquiry form unless it is necessary.
Client and business information
This may include:
- details about your organisation and workforce
- contracts, proposals and service requirements
- client contacts and authorised representatives
- records of advice and services provided
- meeting notes and correspondence
- account and relationship management information
- feedback, reviews and testimonials
Financial and transaction information
This may include:
- billing details
- invoices and payment records
- bank or payment information
- records required for accounting and taxation
We do not normally collect complete payment card details directly through the website.
Training and event information
This may include:
- registration and booking details
- your employer and job role
- dietary, accessibility or reasonable adjustment requirements
- attendance records
- feedback and course evaluation responses
- photographs or video where appropriate notice has been provided
Marketing information
This may include:
- newsletter subscriptions
- marketing consent
- event and service interests
- records of emails sent, opened or interacted with
- unsubscribe and objection records
Recruitment information
Where you apply for a role with Shrewd HR, this may include:
- your CV and employment history
- qualifications and professional memberships
- application and interview information
- references
- salary expectations and availability
- right-to-work information
- information relating to reasonable adjustments
- equality monitoring information, where collected
Website and technical information
When you use our website, we may collect:
- your IP address
- browser and device information
- approximate location derived from your IP address
- pages visited and time spent on the website
- links selected and referring websites
- cookie identifiers and consent preferences
- technical and website security information
Further information is provided in our Cookie Policy.
5. Special category and criminal offence information
Some personal information receives additional protection under data protection law. This includes information about health, disability, racial or ethnic origin, religious beliefs, trade union membership, sexual orientation and certain other sensitive matters.
Because we provide HR and employment support, we may need to process this type of information when dealing with sickness absence, reasonable adjustments, workplace concerns, equal opportunities, employee relations or legal claims.
We will only use special category information where:
- it is necessary to meet employment, social security or social protection obligations
- it is needed to establish, exercise or defend legal claims
- there is a substantial public interest condition under data protection law
- you have given explicit consent where consent is appropriate
- another lawful condition applies
We only process criminal offence information where we have a lawful basis and the processing is authorised by law.
6. How we collect your information
We may collect information:
- directly from you
- through our website, forms, newsletter and event registrations
- through email, telephone, WhatsApp or face-to-face conversations
- from your employer or another client organisation
- from colleagues, professional advisers, referees and business contacts
- from event organisers and delivery partners
- from recruitment agencies and referees
- from publicly available professional sources such as Companies House, company websites and professional networking platforms
- through cookies, analytics tools and website security systems
- from social media platforms when you interact with our pages or content
- from reviews that you post publicly or provide directly to us
7. How and why we use personal information
We must have a lawful basis for each way in which we use personal information.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and discussing possible services | Steps requested before entering into a contract and our legitimate interest in responding to business enquiries |
| Preparing proposals and setting up a client relationship | Contract or steps before a contract, and legitimate interests where the contract is with an organisation |
| Delivering HR consultancy, employment law support, training and related services | Contract, legitimate interests and legal obligations |
| Handling information on a client’s instructions | We normally act as a processor under our contract with the client |
| Managing client accounts and communications | Contract and our legitimate interest in providing an effective service |
| Issuing invoices, taking payment and maintaining financial records | Contract and legal obligation |
| Administering training courses and events | Contract, steps before a contract and legitimate interests |
| Sending newsletters, event invitations and promotional emails | Consent where required, or legitimate interests where business-to-business marketing is permitted |
| Recording marketing preferences and opt-outs | Legal obligation and legitimate interests |
| Understanding website use through non-essential analytics | Consent |
| Maintaining website security and preventing misuse | Legitimate interests and legal obligation |
| Managing complaints, disputes and legal claims | Legitimate interests, legal obligation and the establishment, exercise or defence of legal claims |
| Recruiting employees and contractors | Steps before a contract, legitimate interests and legal obligations |
| Managing suppliers and professional advisers | Contract and legitimate interests |
| Publishing agreed testimonials, case studies, photographs or video | Consent or legitimate interests, depending on the circumstances |
| Improving our services, processes and client experience | Legitimate interests |
Where we rely on legitimate interests, these may include operating and improving our business, responding to enquiries, maintaining professional relationships, protecting our systems, keeping appropriate records and communicating with relevant business contacts.
We consider the effect of the processing on the people involved and do not rely on legitimate interests where their rights and interests outweigh ours.
8. Marketing communications
We may send you newsletters, employment law updates, event information and details of our services where:
- you have asked to receive them
- you have given consent
- we have another lawful basis and electronic marketing rules allow us to contact you
You can unsubscribe at any time by:
- selecting the unsubscribe link in a marketing email
- emailing [email protected]
- contacting us on 0191 375 5770
Withdrawing consent does not affect the lawfulness of anything we did before consent was withdrawn.
You have an absolute right to object to the use of your personal information for direct marketing. When you object, we will stop using it for that purpose.
We may keep a minimal suppression record containing your email address or other contact details so that we can respect your request and avoid contacting you again.
We do not sell personal information to advertisers or mailing list providers.
9. Cookies and website analytics
Our website uses cookies and similar technologies.
Some cookies are necessary for the website to function properly. Other cookies, including analytics cookies, should only be used where you have given the appropriate consent.
Where enabled with your consent, Google Analytics may collect information about how visitors find and use the website. This helps us understand which pages are useful and identify areas that could be improved.
You can accept, reject or change your choices through the website’s cookie consent controls. You can also manage cookies through your browser settings.
More information about the cookies in use, their purpose and how long they remain on your device should be provided in our separate Cookie Policy.
10. WhatsApp, social media and external platforms
Our website includes links to WhatsApp, LinkedIn, Instagram and other external websites or platforms.
When you select one of these links, the relevant provider may collect information about you in accordance with its own privacy notice. Shrewd HR does not control how an external platform uses information collected through its service.
Where you contact us through WhatsApp or social media, we may retain relevant messages in our own business records where this is necessary to respond to you or manage our relationship.
Our website may also use third-party review or content widgets. These services may receive technical information when they are loaded, subject to your cookie choices and the provider’s own privacy practices.
11. Who we share personal information with
We only share personal information where there is a proper reason to do so.
Recipients may include:
- Shrewd HR employees, consultants and contractors who need the information for their role
- website hosting, technical support and cybersecurity providers
- email, cloud storage, document management and communication providers
- customer relationship management and enquiry management providers
- newsletter and email marketing providers
- analytics and cookie consent providers
- accounting, payment and banking providers
- event venues, trainers and booking providers
- occupational health, health and safety, investigation and other specialist partners where their involvement has been agreed
- insurers, accountants, auditors, solicitors and other professional advisers
- regulators, courts, law enforcement agencies and public authorities
- a buyer, investor or adviser involved in a proposed sale, restructure or transfer of the business
Where another organisation processes personal information on our behalf, we require it to protect the information and only use it for the agreed purpose.
Where we introduce you to an independent partner, that partner may become a separate data controller. It should provide its own privacy information explaining how it will use your details.
12. International transfers
Some technology, email, analytics, communication or cloud service providers may process information outside the United Kingdom.
Where personal information is transferred internationally, we take appropriate steps to protect it. Depending on the destination and provider, these may include:
- relying on UK adequacy regulations
- using the UK International Data Transfer Agreement
- using the UK Addendum to approved contractual clauses
- completing an appropriate transfer risk assessment
- using another safeguard or exception permitted by law
Further information about the safeguards used for a particular provider can be requested using the contact details in this notice.
13. How long we keep personal information
We keep information only for as long as it is reasonably needed for the purpose for which it was collected, including legal, accounting and reporting requirements.
Our usual retention periods are:
| Information | Usual retention period |
|---|---|
| General enquiries that do not become clients | Up to 24 months after the last meaningful contact |
| Client contracts, advice and relationship records | Normally up to seven years after the relationship ends |
| Financial and accounting records | Normally six years after the relevant financial year |
| Newsletter and marketing records | Until you unsubscribe or object |
| Marketing suppression records | For as long as needed to ensure your opt-out is respected |
| Training and event administration records | Normally up to two years after the event |
| Unsuccessful recruitment applications | Normally six months after the recruitment process ends |
| Recruitment talent pool information | Up to two years where separate consent has been obtained |
| Website analytics | For the period stated in the Cookie Policy or analytics settings |
| Complaints and related correspondence | Normally up to six years after the complaint is closed |
| Information processed for a client | In accordance with the client’s instructions and our agreement with them |
We may retain information for longer where this is necessary because of an ongoing complaint, investigation, legal claim, regulatory requirement or safeguarding concern.
Information that is no longer required will be securely deleted, destroyed or anonymised.
14. How we protect personal information
We use appropriate organisational and technical measures to protect personal information from accidental loss, misuse, unauthorised access, alteration or disclosure.
These measures may include:
- access controls and password protection
- multi-factor authentication where available
- secure cloud storage and encrypted systems
- staff confidentiality requirements
- data protection and information security procedures
- regular system updates and backups
- supplier due diligence and contractual safeguards
- limiting access to people who need the information for their role
No online system can be guaranteed to be completely secure. Where we become aware of a personal data breach, we will investigate it and notify affected individuals and the Information Commissioner’s Office where required by law.
15. Your data protection rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
- be informed about how your information is used
- request access to the personal information we hold about you
- ask us to correct inaccurate or incomplete information
- ask us to erase your information
- ask us to restrict how your information is used
- object to certain uses of your information
- receive certain information in a portable format
- withdraw consent at any time
- ask for human involvement where a significant decision has been made solely by automated means
- make a complaint about our use of your information
Some rights are subject to legal conditions and exemptions. For example, we may need to retain information where there is a legal requirement or an ongoing legal claim.
To exercise a right, email [email protected] with the subject line Data protection request.
We may need to ask for information to confirm your identity. We will respond within the applicable legal timescale and will not normally charge a fee.
16. Automated decision-making
We do not use information collected through the website to make decisions about you solely by automated means where those decisions would have legal or similarly significant effects.
Where automated tools are used as part of a client service, their use and the applicable safeguards will be considered separately. Any significant decision should include appropriate human involvement and oversight.
17. Children’s information
Our website and services are intended for businesses and working professionals. They are not directed at children, and we do not knowingly collect personal information directly from children through the website.
We may process limited information about children where this is necessary when providing HR support to a client, for example in relation to family leave or employee benefits. In these circumstances, we process the information on the client’s instructions and apply appropriate safeguards.
18. Making a data protection complaint
You can raise a concern or complaint by emailing [email protected] and using the subject line Data protection complaint.
Please include:
- your name and contact details
- a clear description of your concern
- the outcome you would like us to consider
- copies of relevant correspondence or evidence
We will acknowledge a data protection complaint within 30 days, investigate it without undue delay, keep you appropriately informed and explain the outcome.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection. You do not need to complete our internal complaints process before contacting the ICO, although we would appreciate the opportunity to address your concern directly.
19. External links
Our website may contain links to websites operated by other organisations.
We are not responsible for the privacy, security or content of external websites. You should read the privacy notice of any external service before providing personal information to it.
20. Changes to this notice
We may update this privacy notice when our services, systems or legal obligations change.
The date at the top of the notice shows when it was last reviewed. Significant changes may also be highlighted on the website or communicated directly where appropriate.
21. Contact us
Questions, requests and complaints about this privacy notice or our use of personal information should be sent to:
Shrewd HR Ltd
Durham Cricket
Banks Homes Riverside
Chester-le-Street
County Durham
DH3 3QR
Email: [email protected]
Telephone: 0191 375 5770