Privacy Policy — PHARE HR Consulting

Effective date: 30 October 2026

1. Who we are

PHARE HR CONSULTING, LTD (“PHARE HR”, “we”, “us” or “our”) is a company based in London, England and Wales. We provide HR consulting and related services to businesses, including HR audits, recruitment support, HRIS and payroll assistance, benefits administration, employee engagement support and on-demand HR advice.

Our website is www.pharehr.com.

For personal data processed as a controller, PHARE HR is responsible for deciding why and how that data is processed. For some HR consulting services, we process employee or candidate data on behalf of a client business, acting as that client’s processor. Section 5 explains this distinction.

Contact us about privacy:

Email: hello@pharehr.com
Registered office: 3 Carney Place, Flat 11, London, England, SW9 8GH
Company number: 14524277

2. Who this policy applies to

This policy explains how we handle personal data when you:

visit or use our website;
contact us, including through a contact form;
book or attend a discovery call;
communicate with us as a client, prospective client, supplier or business contact; or
are an employee, worker or candidate whose data is provided to us in connection with a client engagement.

This policy is intended to address the UK GDPR and, where it applies to our processing, the EU GDPR, together with applicable UK data protection and electronic communications laws. The laws that apply may depend on where you are located and the circumstances of the processing.

Where a client’s own privacy notice applies to data that we process on its behalf, that client’s notice should also be consulted.

3. Personal data we may collect

The data we collect depends on how you interact with us and the services involved.

Website visitors, enquiries and discovery-call bookings

We may collect:

your name, business name, job title and contact details, including email address and phone number;
information you provide in a contact form, email or other communication;
information you provide when arranging or attending a discovery call, including booking details and meeting-related communications;
website and device information, such as IP address, browser and device type, pages visited, referral source and approximate location; and
cookie and similar technology information, subject to your cookie choices and applicable law.

Discovery-call bookings may be arranged using Google Calendar scheduling functionality. Google and other service providers may process information required to provide that functionality.

Client, supplier and business-contact data

In the course of operating our business, we may process contact details, correspondence, contract and transaction information, payment and billing records, and other information needed to manage our professional relationships.

HR engagement data

Depending on the services requested and the client’s instructions, HR engagement data may include information about employees, workers or candidates such as:

identity and contact details;
employment, role, work history and recruitment information;
attendance, leave, performance, training and disciplinary information;
compensation, payroll, tax, benefits and pension information;
survey responses and workplace feedback; and
information about health, disability, absence, diversity or other sensitive matters where relevant to the HR work.

Some HR information may be special category data under data protection law, such as health data, or may otherwise be particularly sensitive. We ask clients to share only information that is relevant and necessary for the engagement and to use secure, agreed channels.

4. How and why we use data, and our lawful bases

We use personal data only where we have a lawful basis to do so. Depending on the circumstances, our lawful bases may include:

Contract: processing needed to enter into or perform a contract with you, or to take steps you request before entering into a contract.
Legitimate interests: processing needed for our legitimate business interests, where those interests are not overridden by your rights and interests. These may include responding to business enquiries, managing client relationships, improving our services and website, and protecting our business.
Consent: processing based on your freely given consent, which you may withdraw at any time.
Legal obligation: processing needed to comply with a legal or regulatory obligation.

Purpose	Examples of data used	Potential lawful basis
Responding to enquiries and arranging discovery calls	Contact details, enquiry details and booking information	Steps at your request before a contract; legitimate interests
Providing, administering and improving HR consulting services	Client contact details, engagement information and, where applicable, HR data	Contract; legitimate interests; legal obligation
Carrying out recruitment or workforce-related work for a client	Candidate or employee information relevant to the client’s instructions	Usually processing on the client’s behalf; the client is responsible for establishing its lawful basis
Managing client, supplier and business relationships	Contact, contract, correspondence and payment information	Contract; legitimate interests; legal obligation
Operating, securing and improving our website	Technical, usage and cookie information	Consent where required; otherwise legitimate interests for strictly necessary activities
Meeting legal, accounting and regulatory requirements	Relevant business and transaction records	Legal obligation
Sending optional marketing communications	Business contact details and communication preferences	Consent or, where permitted by law, legitimate interests; you can opt out at any time

Where we rely on legitimate interests, you can contact us for more information about the interests involved. You may object to processing based on legitimate interests, as described in Section 10.

Special category data

Where we act as a controller and need to process special category data, we will do so only where an additional condition under applicable data protection law permits it, and we will apply appropriate safeguards. Depending on the circumstances, that condition may include explicit consent or a condition relating to employment, social protection, health or another substantial public interest recognised by law.

Where we process special category data as a client’s processor, the client is responsible for identifying and documenting the lawful basis and applicable special category condition. We process that data only in accordance with the client’s documented instructions and our agreement, unless the law requires otherwise.

5. Client and candidate data: controller and processor roles

Our role depends on the particular processing:

When we act for our own business purposes, such as handling our own enquiries, contracts, billing and legal records, we generally act as a controller.
When we handle employee, worker or candidate data to provide HR services on a client’s instructions, the client will generally be the controller and PHARE HR will generally act as its processor. The client decides why the data is used and is responsible for providing applicable privacy information and establishing a lawful basis.
In some engagements, PHARE HR may act as a controller for particular activities, for example where we determine the purposes and means of processing independently. We will assess our role in context and provide any additional information required.

As a processor, we use client data only to deliver the agreed services, follow documented instructions, restrict access to authorised personnel and service providers, assist the client with applicable data protection obligations where agreed, and return or delete data in accordance with our agreement and applicable law. If an individual contacts us about data we process for a client, we may refer the request to that client or assist the client in responding.

We do not use identifiable client employee or candidate data for unrelated purposes or our own marketing.

6. Cookies and similar technologies

Our website uses browser storage to remember your cookie choice. The consent control stores your analytics choice and the time it was made in local storage for up to 180 days. This is necessary to remember your preferences.

Optional analytics is off by default. If you choose to accept analytics, the website may use PostHog to understand which pages are visited and how visitors navigate the site. PostHog analytics is not loaded until you opt in. If analytics is enabled, PostHog may use cookies or similar technologies to collect website and device usage information for these analytics purposes. We do not use advertising or marketing cookies on the current website.

You can accept or reject analytics using the consent banner, and reopen Cookie settings at any time from the footer to change or withdraw your choice. If you withdraw consent, analytics will be disabled on the site. You can also manage storage through your browser settings, although blocking necessary storage may mean the site cannot remember your cookie choice. If our cookie providers or purposes change, we will update this notice and request consent where required. Contact us using the details in Section 1 for more information.

We may disclose personal data, where necessary and subject to appropriate safeguards, to:

service providers supporting our website hosting, email, communications, scheduling, cloud storage, analytics, security and business operations;
professional advisers, such as lawyers, accountants and insurers;
regulators, public authorities, courts or law enforcement bodies where required or permitted by law; and
a successor or relevant parties in connection with a business reorganisation, sale or transfer, subject to appropriate confidentiality and data protection safeguards.

Our service providers are permitted to process personal data only as necessary to provide their services or as otherwise allowed by law. Where required, we put appropriate contractual data protection terms in place.

We do not sell personal data.

8. International transfers

PHARE HR serves clients in the UK, US, Ghana and Nigeria, and service providers may operate in other countries. Personal data may therefore be accessed or transferred outside the UK or, where applicable, the European Economic Area.

Where data protection law restricts a transfer, we will use a lawful transfer mechanism. Depending on the destination and circumstances, this may include an adequacy regulation or decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses. We may also take additional steps where required to provide appropriate protection.

We do not assume that a country has an adequacy status. If you would like information about the safeguards applying to a particular transfer, contact us using the details in Section 1.

9. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to meet legal, accounting, contractual and reporting requirements. Retention depends on the type of data, the nature of the engagement, applicable law and any relevant client agreement.

Our usual retention approach is:

Enquiries and discovery-call information: generally up to 24 months after our last meaningful contact, unless an engagement begins or a longer period is reasonably required.
Client, supplier and contract records: generally for the relationship and up to six years after it ends, where needed for legal, accounting or contractual purposes.
HR engagement data processed for a client: for the period set out in our client agreement or the client’s documented instructions, after which it is returned or securely deleted unless retention is required by law or necessary to establish, exercise or defend legal claims.
Candidate information used in a client recruitment engagement: in accordance with the client’s instructions and applicable retention requirements. The client should provide candidates with its own privacy information.
Website and analytics data: for the period set by the relevant cookie, analytics service or consent settings, and no longer than needed for the relevant purpose.

When information is no longer needed, we will delete it or securely anonymise it.

10. Your data protection rights

Depending on the law that applies and the circumstances, you may have the right to:

access your personal data and receive information about how it is processed;
rectify inaccurate or incomplete data;
erase your data in certain circumstances;
restrict processing in certain circumstances;
data portability for certain data processed by automated means on the basis of consent or contract;
object to processing based on legitimate interests, and to direct marketing; and
withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing carried out before withdrawal.

These rights are not absolute and may be subject to legal conditions or exemptions. To exercise a right, email hello@pharehr.com. We may need to verify your identity before responding.

If we process your data on behalf of a client, we may forward your request to the client or ask you to contact the client directly. The client is generally responsible for deciding how to respond to requests about data for which it is controller.

You also have the right to complain to the relevant supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO). Information about making a complaint is available at ico.org.uk/make-a-complaint. If EU GDPR applies to the processing, you may also complain to the data protection authority in the EU country where you live, work or consider the issue to have occurred.

We would welcome the opportunity to address your concerns first. You can contact us using the details in Section 1.

11. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Measures may include access controls, confidentiality obligations, secure storage and transfer methods, and arrangements with service providers.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to protect personal data in a manner appropriate to its nature and the risks involved.

12. Children’s data

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect children’s personal data through the website for its own purposes.

In an HR engagement, a client may provide data about a person under 18 where that person is an employee, worker or candidate and the information is necessary for the agreed service. In that situation, we handle the data only as permitted by law and, where acting as a processor, in accordance with the client’s instructions and our agreement.

13. Automated decision-making

We do not use personal data collected through our website to make decisions about you solely by automated means that produce legal or similarly significant effects.

If an engagement involves a client’s use of automated decision-making or profiling affecting employees or candidates, the client is responsible for determining and communicating the relevant arrangements. PHARE HR will handle any related data in accordance with its role and the client’s instructions.

14. Changes to this policy

We may update this policy from time to time, for example to reflect changes in our services, data processing practices or legal requirements. The current version will be published on our website with its effective date. Where required by law, we will take additional steps to notify affected individuals of material changes.