Privacy Notice

Holistic HR Services LTD (trading as The Employer Support Hub) is the data controller responsible for the personal data you provide when you use The Employer Support Hub (the "Service"). This notice explains what personal data we collect, why we collect it, how we use it, and the rights you have over it.

We collect the following categories of personal data:

• Account and contact data: your name, business name, email address, phone number, and company details, used to create and manage your membership.
• Authentication data: your login credentials and sign-in information, used to keep your account secure.
• Employee data you upload: information about your employees that you add to HR software or upload for setup (for example via the Breathe HR data template), used solely to provide the Service to you.
• Support and advice data: messages and questions you send to our consultants and to our AI companion Cora, used to provide HR support and improve responses.
• Usage and telemetry data: how you use the Service, your device identifiers, browser type, and IP address, used to operate, secure, and improve the Service.

We use your personal data for the following purposes, each with a lawful basis:

• To provide the Service (account creation, HR advice, document management, software access) — under the lawful basis of contract performance.
• To process payments and manage your subscription — handled by our payment provider Paddle (see "Data sharing" below) — under contract performance.
• To provide customer support and respond to your enquiries — under contract performance and legitimate interests.
• To keep the Service secure and prevent fraud — under legitimate interests and our legal obligations.
• To improve and develop the Service — under legitimate interests.
• To send you service-related updates about your membership — under contract performance. Any marketing communications require your consent, which you can withdraw at any time.
• To meet our legal and regulatory obligations — under legal obligation.

We share personal data with the following categories of recipients:

• Service providers and subprocessors that help us run the Service — including hosting and database providers, HR software providers (such as Breathe HR), benefits providers (such as Paycare), and analytics tooling. They process data on our behalf and only as instructed.
• Paddle, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance, and invoicing. Paddle is the data controller for the payment data they collect. See Paddle's Privacy Notice.
• Professional advisers such as legal and accounting advisers, where needed.
• Authorities and regulators, where we are required to do so by law.

Some of the service providers we use may process your personal data outside the UK and EEA. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or reliance on an adequacy decision, so your data is protected to UK and EEA standards.

We keep your personal data only for as long as is necessary to provide the Service and to meet our legal, accounting, and reporting obligations. When your membership ends, we retain your data for a limited period to allow you to export it, after which we delete or anonymise it, unless we are required to keep it for longer by law.

Under UK and EU data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct (rectify) inaccurate data;
• ask us to erase your data, in certain circumstances;
• restrict the processing of your data;
• receive a copy of your data in a portable format (portability);
• object to processing based on legitimate interests or for direct marketing;
• withdraw your consent at any time where processing relies on consent; and
• lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We aim to respond to requests within one month. To exercise any of these rights, please contact us using the details below.

We take appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, and regular review of our security practices. No method of transmission or storage is completely secure, but we work to protect your data to the standard required by law.

We use a small number of cookies and similar technologies. Essential cookies are needed for the Service to function (for example keeping you signed in). We may also use analytics cookies to understand how the Service is used and marketing cookies with your consent. You can manage your cookie preferences in your browser settings at any time.

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have collected a child's data in error, please contact us and we will delete it.

We may update this Privacy Notice from time to time. We will notify members of material changes in advance and post the updated notice here with a revised "last updated" date.

If you have any questions about this Privacy Notice or your personal data, please contact us at charlotte@holistichrservices.co.uk. The law applicable to this notice is that of England and Wales.