Hawthorn Management Solutions

Legal

Privacy Policy

Hawthorn Management Solutions Limited

Last updated:

1. Who we are

Hawthorn Management Solutions Limited ("Hawthorn", "we", "us", "our") is a company registered in England and Wales, company number 16910489, with its registered office at 50 Princes Street, Ipswich, Suffolk, IP1 1RJ, United Kingdom. Our VAT number is GB510491523.

We are a business management consultancy. We work with UK companies on business turnaround, operational restructuring, interim leadership and business support. Where a restructuring points to it, we also manage outsourcing and run functions such as payroll on a client's behalf.

This policy explains how we handle personal data when you visit hawthorn-management.com, enquire about our services, or engage us.

We are the data controller for personal data we process for our own purposes: running our website, responding to enquiries, managing client relationships, and employing our own staff.

We act as a data processor when we process personal data on behalf of a client, for example when we run payroll for a client's employees or produce transcripts on a client's instruction. In those cases the client is the controller and their own privacy notice governs. Our obligations are set out in our Data Processing Addendum.

If your employer uses Hawthorn to run its payroll, then your employer, not Hawthorn, is the controller of your data. Ask them for their privacy notice. You can still contact us using the details below and we will pass your request to them, but they decide what happens to your data, not us.

Contact for data protection matters: [email protected] or 0333 188 9873. ICO registration number: CSN3804035.

2. The personal data we collect

2.1 Website visitors

  • Technical data: IP address, approximate location derived from it, browser type and version, operating system, device type and screen size.
  • Usage data: pages viewed, time on page, referring source, links and buttons clicked.
  • Anything you type into our contact form: your name, email address, the service you are enquiring about, and the content of your message.

2.2 Clients and prospective clients

  • Names, job titles, business email addresses and telephone numbers, company name and address, company registration number, billing and payment details, and records of our correspondence with you.

2.3 Individuals whose data we handle during an engagement

  • Consultancy and restructuring work necessarily involves information about our clients' staff. Depending on the engagement this may include: name and job title, reporting line, length of service, salary and benefits, working pattern, performance and absence records, and, where a restructuring affects roles, selection criteria, scoring and consultation records.
  • Where a client outsources a function to us, for example payroll, we also process, on their instructions: full name, date of birth, home address, National Insurance number, tax code, bank account details, salary, hours and pay records, pension scheme membership and contributions, right to work and identity documents, employment contract terms, next of kin and emergency contacts, statutory payment records, and HMRC correspondence including P45, P60 and P11D.

2.4 Special category data

  • Restructuring work can involve health information. An example is where sickness absence or a disability affects redundancy selection, or where a reasonable adjustment has to be taken into account. We also handle health data where we administer statutory sick pay for an outsourced payroll.
  • We process this only where a condition under Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018 applies, normally the employment and social security condition. We maintain an Appropriate Policy Document setting out how we comply and how long we retain the data. A copy is available on request.
  • We do not seek criminal offence data, and it is not part of our services.

3. Why we process it, and our lawful basis

What we doLawful basis
Responding to your enquiryLegitimate interests, answering someone who has contacted us
Providing consultancy, turnaround and restructuring servicesPerformance of a contract with the client; legitimate interests in respect of their staff
Advising on and managing a restructuring that affects rolesLegitimate interests, and the client's legal obligations on consultation
Running payroll, RTI and pension automatic enrolment for clientsLegal obligation (client's), and our contract with the client
Keeping accounting and tax recordsLegal obligation
Anti money laundering and identity checks, where applicableLegal obligation
Website analyticsConsent
Marketing to business contactsLegitimate interests, or consent where required by PECR
Establishing or defending legal claimsLegitimate interests

Where we rely on legitimate interests we have considered your rights and have balanced them against ours. You can ask us for that assessment.

4. Who we share it with

  • HMRC, for PAYE, RTI and related filings.
  • The Pensions Regulator and pension providers, for automatic enrolment.
  • Banks and payment providers, to make payments we are instructed to make.
  • Our IT, hosting and software suppliers, who host this website, our payroll software and our document systems.
  • Our professional advisers, meaning accountants, insurers and solicitors.
  • Courts, regulators and law enforcement, where we are legally required to disclose.

We do not sell personal data, and we do not share it for anyone else's marketing.

5. Transfers outside the UK

Our website analytics provider processes data in the United States. Where personal data leaves the UK we rely on one of the transfer mechanisms permitted by Articles 44 to 46 of the UK GDPR, normally the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You can ask us which mechanism applies to a particular transfer.

6. How long we keep it

RecordRetention period
Payroll records6 years after the end of the tax year they relate to
Pension records6 years, or longer where scheme rules require
Right to work checks2 years after employment ends
Employment and HR records6 years after employment ends
Client contracts and correspondence6 years after the engagement ends
Accounting records6 years from the end of the financial year
Anti money laundering records, where applicable5 years from the end of the business relationship
Consultancy engagement files and working papers6 years after the engagement ends
Restructuring and consultation recordsAs instructed by the client, and no longer than the client's own retention period for HR records
Website enquiries24 months from your last contact with us
Website analytics26 months

When a retention period ends we securely delete or anonymise the data.

7. Your rights

You have the right to:

  • Be informed about how we use your data, which is what this policy does.
  • Access the personal data we hold about you.
  • Rectification of data that is inaccurate or incomplete.
  • Erasure, where we have no continuing reason to hold it.
  • Restrict our processing in certain circumstances.
  • Data portability, for data you gave us that we process by automated means under consent or contract.
  • Object to processing based on legitimate interests, and to direct marketing at any time.
  • Withdraw consent at any time, where consent is our basis. Withdrawing does not affect processing already carried out.
  • Not be subject to a solely automated decision with legal or similarly significant effects. We do not make such decisions.

How to exercise them. Email [email protected], telephone 0333 188 9873, or write to us at the registered office above.

We respond within one month. We may extend by up to two further months for complex or numerous requests, and will tell you within the first month if we do. Where a request is unclear or very broad we may ask you to clarify or narrow it, and the time limit pauses until you reply. We may also ask you to verify your identity before we disclose anything, and the time limit pauses until you do.

We carry out a reasonable and proportionate search for the information you have asked for.

If we act as a processor for a client, we will pass your request to that client, who is the controller, and tell you we have done so.

8. Complaints

If you are unhappy with how we have handled your personal data, please tell us first. Our Complaints Procedure explains how. We will acknowledge your complaint within 30 days of receiving it and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office at any time:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113 · ico.org.uk/make-a-complaint

9. Security

We use encryption in transit, access controls limiting data to staff who need it, multi factor authentication on systems holding personal data, and staff training. We have a documented breach procedure and will notify the ICO within 72 hours where a breach is reportable, and affected individuals where the risk to them is high.

10. Children

Our services are provided to businesses and our website is not directed at children. We do not knowingly collect data about children through this website. Where our payroll work involves a worker under 18, we handle their data with the additional care the law requires.

11. Changes

We review this policy at least once a year and whenever our processing changes materially. The date at the top shows when it was last updated.