Privacy Notice
This privacy notice tells you what to expect us to do with your personal information when you deal with Holly McAlpine Consulting Ltd.
Contact for data protection matters: dpo@hollymcalpine.com
What information we collect, use, and why
To provide and improve services for clients we collect or use: names and contact details, addresses, gender, pronoun preferences, occupation, date of birth, marital status, third party information (such as family members or other relevant parties), payment details, financial data, transaction data, usage data, employment details (including salary, sick pay and length of service), credit history and credit reference information, health information, criminal records data, information relating to compliments or complaints, audio recordings (e.g. calls), records of meetings and decisions, account access information, and website user and device information. Where relevant we may also collect special category data: racial or ethnic origin, religious or philosophical beliefs, trade union membership, health information, and sexual orientation information.
For the operation of client or customer accounts we collect or use: names and contact details, addresses, purchase or service history, and account information including registration details, along with the special category data listed above where relevant.
To comply with legal requirements we collect or use: name, contact information, identification documents, client account information, criminal offence data, any other personal information required to comply with legal obligations, and the special category data listed above where relevant.
For dealing with queries, complaints or claims we collect or use: names and contact details, payment details, account information, purchase or service history, witness statements and contact details, relevant information from previous investigations, customer or client accounts and records, financial transaction information, and correspondence.
Lawful bases and your data protection rights
Under UK data protection law, we must have a lawful basis for collecting and using your personal information. You can find out more about lawful bases on the ICO’s website.
Your rights, in brief:
- Access – you can ask for copies of your personal information.
- Rectification – you can ask us to correct or delete information you think is inaccurate or incomplete.
- Erasure – you can ask us to delete your personal information.
- Restriction of processing – you can ask us to limit how we use your information.
- Objection – you can object to the processing of your personal data.
- Data portability – you can ask that we transfer the information you gave us to another organisation, or to you.
- Withdrawing consent – where we rely on consent, you can withdraw it at any time.
If you make a request, we must respond without undue delay and in any event within one month. To make a request, contact dpo@hollymcalpine.com. More detail on each right, and the exemptions that may apply, is on the ICO’s website.
Our lawful bases for providing and improving services for clients: consent, contract, legal obligation, legitimate interests (reference and case studies; marketing and business development), and vital interests.
For the operation of client or customer accounts: consent, contract, legal obligation, and vital interests.
To comply with legal requirements: consent, contract, and legal obligation.
For dealing with queries, complaints or claims: consent, contract, legal obligation, and vital interests.
Which lawful basis we rely on may affect which of your rights apply. For example, where we rely on legal obligation, the rights to erasure, objection and portability may not apply; where we rely on consent, all rights apply except objection (and you can withdraw consent at any time).
Where we get personal information from
Directly from you; legal bodies or professionals (such as courts or solicitors); debt collection agencies; publicly available sources; previous employment; credit reference agencies; and suppliers and service providers.
How long we keep information
See the data retention schedule below.
Who we share information with
Professional or legal advisors; emergency services; organisations we’re legally obliged to share personal information with; previous employers; suppliers and service providers; and professional consultants.
How to complain
If you have any concerns about our use of your personal data, you can complain to us at dpo@hollymcalpine.com.
If you remain unhappy after raising a complaint with us, you can complain to the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. ico.org.uk/make-a-complaint
Data Retention Schedule
We keep personal data only as long as necessary, then securely delete or anonymise it. Digital data is erased so it cannot be recovered; paper records are shredded.
| Category | Retention period | Why |
|---|---|---|
| Client data (contracts, communications) | 6 years from end of relationship | Limitation Act 1980; potential legal claims |
| Employee data (payroll, performance, disciplinary) | 6 years from end of employment | Employment Rights Act 1996; potential legal claims |
| Consultancy project data (reports, analyses) | 3 years from end of engagement | Legitimate interest for reference and case studies |
| Client employee data (processed to deliver services) | 1 month from end of engagement | Returned to the client (data controller) or securely deleted |
| Financial records (invoices, receipts, tax) | 6 years from end of financial year | HMRC requirements |
| Marketing data (mailing lists, campaigns) | 2 years from last interaction | Legitimate interest in marketing |
| Supplier data (contracts, payment details) | 6 years from end of relationship | Limitation Act 1980 |
| Health and safety records | 6 years from date of incident | Limitation Act 1980 |
| Job applicant data (unsuccessful applicants) | 6 months from decision | Legitimate interest for future reference |
| Data subject request records | 2 years from request | GDPR compliance tracking |
| IT system logs | 1 year from creation | Security monitoring and auditing |
This schedule is reviewed annually, or when business processes or the law change. Holly McAlpine, as Director, is responsible for compliance with this schedule.
Last reviewed: June 2026.