Privacy Policy 

ThinkdifferentHR Ltd

Last updated: 9 October 2026

1. Introduction

ThinkdifferentHR Ltd (“we”, “us”, “our”) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website, contact us, or engage our HR consultancy services.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy should be read alongside any separate privacy notices or agreements we may provide to clients in the course of our professional relationship.

2. Who We Are

ThinkdifferentHR Ltd is a company registered in England and Wales. We are the data controller for personal data collected through our website, enquiries, marketing activities, and our own business administration.

Contact Details:

• Company Name: ThinkdifferentHR Ltd
• Company Number: 17507020
• Email: advice@thinkdifferenthr.com
• Telephone: 0203 916 5489
  ICO Registration Reference: ZC268825

Data Protection Contact: The Director is responsible for overseeing data protection compliance within our organisation.

3. Personal Data We Collect

We may collect and process the following categories of personal data:

Information you provide directly to us:

• Name, job title, employer or business name
• Contact details (email address, telephone number, postal address)
• Details of your enquiry or the services you are interested in
• Communications and correspondence you send to us
• Payment and billing information (where applicable)

Information collected automatically when you use our website:

• IP address
• Browser type and version
• Operating system
• Pages visited and time spent on the site
• Referring website addresses
• Cookie data (see Section 9)

Information provided in the course of HR consultancy services:

• Where we provide HR consultancy services to a client organisation, we may process employee-related information on that client’s behalf. In such circumstances, we typically act as a data processor and the client organisation is the data controller. This may include information such as:
  • Employee names, contact details, and job roles
  • Employment records, absence data, and performance information
  • Disciplinary, grievance, and employee relations matters
  • Special category data (such as health information, trade union membership, or equality monitoring data) where relevant and lawful

4. How We Use Personal Data

We use personal data for the following purposes:

Purpose

Lawful Basis

Responding to enquiries and providing our services

Performance of a contract / Legitimate interests

Managing client relationships and service delivery

Performance of a contract

Preparing proposals, contracts, and service documentation

Performance of a contract / Legitimate interests

Billing, accounts, and business administration

Performance of a contract / Legal obligation

Improving our website and services

Legitimate interests

Sending relevant updates or marketing communications (where permitted)

Consent / Legitimate interests (soft opt-in)

Complying with legal, regulatory, and professional obligations

Legal obligation

Where we rely on legitimate interests as our lawful basis, we have conducted a balancing test to ensure that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests (see Section 7).

5. Special Category Data

In the course of providing HR consultancy services, we may process special category data on behalf of client organisations. This may include information about health, sickness absence, disability, trade union membership, and other sensitive employment-related information.

We only process special category data where:

• We have a lawful basis under Article 6 of UK GDPR, and
• A relevant condition under Article 9 of UK GDPR and Schedule 1 of the Data Protection Act 2018 applies (such as employment law obligations, legal claims, or explicit consent where appropriate)

Appropriate safeguards are implemented to protect this type of information.

6. Who We Share Personal Data With

We do not sell personal data. We may share personal data with:

• Service providers and processors: Trusted third parties who assist us with IT, cloud storage, email, accounting, and other business operations, bound by contractual data protection obligations
• Professional advisers: Legal advisers, insurers, and accountants where necessary
• Regulatory and legal authorities: Where required by law, regulation, court order, or competent authority
• Client organisations: Where we act as a processor on behalf of a client, we share data with that client as instructed

Where we act as a data processor for a client organisation, that client is responsible for ensuring the lawfulness of the processing and for providing appropriate privacy information to their employees and workers.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: To request a copy of the personal data we hold about you
• Right to rectification: To have inaccurate or incomplete data corrected
• Right to erasure: To request deletion of your data in certain circumstances
• Right to restrict processing: To limit how we use your data in certain circumstances
• Right to data portability: To receive your data in a structured, machine-readable format (where processing is based on consent or contract and is automated)
• Right to object: To object to processing based on legitimate interests or for direct marketing purposes
• Right to withdraw consent: Where we rely on consent, you may withdraw it at any time (without affecting the lawfulness of prior processing)

To exercise any of these rights, please contact us using the details in Section 2. We will respond within one month, subject to any lawful extensions. We may need to verify your identity before actioning your request.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected. Our retention periods are determined by legal, contractual, and business requirements:

• Website enquiries: Retained for up to 2 years from the date of enquiry, unless a client relationship is established
• Client records: Retained for 7 years from the end of the engagement, in line with legal and professional obligations
• Marketing contacts: Retained until consent is withdrawn or after 3 years of inactivity
• HR consultancy processing (as processor): Retained in accordance with the client’s instructions and any applicable data processing agreement

When data is no longer needed, it is securely deleted or anonymised.

9. Cookies and Website Analytics

Our website uses cookies and similar technologies to enhance your experience and analyse how the site is used. Cookies are small text files placed on your device.

We use:

• Strictly necessary cookies: Essential for the website to function
• Analytics cookies: To understand how visitors use our site (e.g., Google Analytics), which require your consent
• Marketing cookies: To track visitors across websites for advertising purposes, which require your consent

You can manage or withdraw your cookie consent at any time through the cookie settings link on our website, or by adjusting your browser settings. Disabling certain cookies may affect website functionality.

10. International Transfers

Where personal data is transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with UK GDPR. This may include:

• Transfers to countries with an adequacy decision from the UK Secretary of State
• Use of International Data Transfer Agreements (IDTAs) or the UK Addendum to Standard Contractual Clauses
• Other lawful transfer mechanisms where applicable

You can request further information about the safeguards we use by contacting us.

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures include:

• Access controls and staff training
• Secure storage and transmission protocols
• Regular review of our security practices
• Contractual safeguards with third-party processors

No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

12. Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concerns directly before you approach the ICO. Please contact us using the details in Section 2.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. The “Last updated” date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.