Privacy Policy

What data we collect

When you use this website, we may collect the following types of personal data:

• Information you provide directly — for example through contact forms or enquiries: your name, email address, and any other details you choose to share. We use this to respond to your enquiries and provide the services you request.
• Technical data collected automatically — including your IP address, browser type and version, device type, operating system, and the pages you request. We process this to deliver and secure the website.

How we use your data

Lawful basis for processing

Under UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are:

• Contract — where processing is necessary to provide the website and the services you request, such as responding to your enquiries.
• Legitimate interests — where we process technical data to operate, secure, and improve the site, and for the other processing described in "How we use your data" above that relies on this basis. You have the right to object to processing based on legitimate interests (see your rights below).

Where we use cookies or third-party embedded content that is not essential, we rely on your consent, which you give through the cookie preference centre and can withdraw at any time.

Third-party processors

This site may use third-party embedded content (such as video players, maps, and CDN services) that process personal data on our behalf. When you interact with these embeds, the third-party service may collect:

• IP address and approximate location
• Device type, browser, and operating system
• Pages visited and interactions with embedded content
• Cookies and similar tracking technologies set by the third party

Embedded content that needs your consent, such as a video player or a map, does not load until you have given that consent through the cookie preference centre.

Services needed to run the site, such as hosting it or delivering a message you send us, do not depend on your cookie consent.

Some of these processors are based outside the UK. Where personal data is transferred internationally, we rely on the safeguards shown below — such as an adequacy decision or standard contractual clauses — to keep your data protected. The processors we use, their location, and the transfer basis relied upon are:

For the full list of cookies each processor sets, see our cookie policy.

How long we keep your data

• Responding to your enquiries

  Kept for:

  Up to 2 years after your enquiry is resolved, or longer if it leads to work with us, as part of that work's records

• Checking the form is not spam

  Kept for:

  Not kept by this website after the check

We keep any other personal data only for as long as we need it for the purposes described in this policy, including to meet any legal, accounting or reporting requirements. How long that is depends on the kind of data and why we hold it.

How long each cookie lasts is listed in our cookie policy.

Cookies

This website uses cookies — small text files stored on your device — to support core functionality and, where you have consented, to enable third-party embedded content.

For full details of the cookies we use, the third-party services that set them, and how to manage your preferences, please see our cookie policy.

Your rights under UK GDPR

Under UK data protection law you have the following rights. To exercise any of these rights, please contact us at ross@hblackhall.com or via our contact page.

Right of access

You may request a copy of the personal data we hold about you (a Subject Access Request).

Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to erasure

You may request deletion of your personal data where there is no compelling reason for its continued processing.

Right to restriction of processing

You may ask us to restrict the processing of your personal data in certain circumstances, for example while we verify its accuracy.

Right to data portability

Where processing is based on consent or a contract, you may request your data in a structured, commonly used, machine-readable format.

Right to object

You may object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.

Rights related to automated decision-making

You have the right not to be subject to decisions based solely on automated processing — including profiling — that produce legal or similarly significant effects on you.

Right to withdraw consent

Where we rely on consent as the lawful basis, you may withdraw it at any time without affecting the lawfulness of prior processing. You can withdraw cookie consent via the cookie preference centre.

Right to complain to the ICO

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: ico.org.uk/make-a-complaint/.