Data Protection Policy

---

Latitude HR is committed to protecting the privacy and rights of all clients, participants, partners and individuals whose personal data is processed in the course of delivering consultancy, coaching, facilitation, assessment and related professional services. This policy explains how personal data is collected, used, stored and safeguarded in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Samantha Mullins - Director is the Data Controller for the data Latitude HR process.

Principles of Data Protection

Latitude HR adheres to the following UK GDPR principles. Personal data will be:

• Processed lawfully, fairly and transparently
• Collected for specified, explicit and legitimate purposes
• Adequate, relevant and limited to what is necessary
• Accurate and kept up to date
• Stored only for as long as necessary
• Handled securely, using appropriate technical and organisational measures

What Personal Data Latitude HR collects

The type of personal data collected depends on the nature of the work and may include:

• Contact details (name, email address, phone number)
• Professional information (role, organisation, work history)
• Information shared during coaching, facilitation or consultancy sessions
• Assessment or evaluation data (e.g., feedback, learning reflections)
• Website enquiries or communication records
• Any other information voluntarily provided by clients or participants

We do not intentionally collect special category data unless it is directly relevant to the service being provided and explicit consent has been given.

How Personal Data Is Used

Personal data is used only for legitimate business purposes, including:

• Delivering consultancy, coaching, facilitation and assessment services
• Communicating with clients and participants
• Managing contracts, proposals and invoicing
• Evaluating and improving services
• Meeting legal or regulatory obligations

Personal data is never sold, shared for marketing purposes, or used in ways that are incompatible with the original purpose of collection.

Lawful Basis for Processing

Latitude HR relies on the following lawful bases under UK GDPR:

• Contract – to deliver agreed services
• Legitimate interests – to operate and develop the business
• Consent – where explicit permission is required (e.g., for sensitive data)
• Legal obligation – where required by law or regulation

Data Sharing and Third Parties

Personal data may be shared with trusted third parties only when necessary, such as:

• IT service providers (email, secure storage, video conferencing)
• Professional partners or subcontractors involved in delivering services
• Legal or regulatory bodies where required

All third parties are required to maintain appropriate data protection standards. Data is not transferred outside the UK unless adequate safeguards are in place.

Data Storage and Security

Latitude HR takes appropriate technical and organisational measures to protect personal data, including:

• Secure, password‑protected digital storage
• Encrypted devices and secure cloud services
• Controlled access to files and systems
• Regular review of security practices
• Avoidance of unnecessary data retention
• Paper records are kept to a minimum and stored securely.
• 
  

Data Retention

Personal data is retained only for as long as necessary:

• Client records: typically up to 7 years for legal and financial purposes
• Coaching or development notes: up to 2 years, unless agreed otherwise
• Email correspondence: up to 2 years
• Assessment or evaluation data: up to 2 years

Retention periods may vary depending on contractual or legal requirements.

Your Rights

Individuals have the following rights under UK GDPR:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object
• Rights related to automated decision‑making (not used by Latitude HR)

Requests can be made by contacting Latitude HR directly who will respond within one month.

Website, Cookies & Analytics

Latitude HR’s website may use basic analytics to understand visitor behaviour. Any cookies used are for functionality or performance only. No profiling or targeted advertising is conducted.

Data Breaches

If a data breach occurs that poses a risk to individuals’ rights or freedoms, Latitude HR will:

• Take immediate steps to contain and assess the breach
• Notify affected individuals where required
• Report the breach to the Information Commissioner’s Office (ICO) within 72 hours if legally necessary

Questions, Concerns or Complaints 

Questions regarding data management and use should be directed to:

Samantha Mullins, Director, Latitude HR. 

Telephone: 07789 654855

You can also complain to the ICO if you are unhappy with how we have used or managed your data.

The ICO’s address: 

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk