GDPR Policy
NORi HR & Employment Law Limited
Last updated 12 August 2026.
1. Who we are
NORi HR & Employment Law Limited (“NORi”, “we”, “us”, “our”) is a company registered in England and Wales under company number 12130234. Our registered office is Oswaldtwistle Mills Business and Conference Centre, Clifton Mill, Pickup Street, Accrington, Lancashire, BB5 0EY. Our VAT registration number is 359713467.
We are registered with the Information Commissioner’s Office as a data controller. Our registration reference is ZA561997.
For anything to do with your personal data, including a subject access request or a data protection complaint, contact:
Amrita Govindji-Bruce, Data Protection Officer
Email: amrita.gb@norihr.co.uk
Telephone: 0330 043 5548
Post: Data Protection, NORi HR & Employment Law Limited, Oswaldtwistle Mills Business and Conference Centre, Clifton Mill, Pickup Street, Accrington, Lancashire, BB5 0EY
This notice covers our website at norihr.co.uk and the HR and employment law services we provide. It explains what personal data we handle, why, and what you can do about it.
2. The law we work to
- The UK GDPR, being Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland, as amended by the Data (Use and Access) Act 2025
- The Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended
We refer to these together as “the data protection legislation”.
Where this notice refers to the Information Commissioner’s Office or ICO, that includes the Information Commission, the successor regulator being established under the Data (Use and Access) Act 2025.
3. When we are a controller and when we are a processor
A controller decides why and how personal data is used. A processor acts on a controller’s instructions. Which one we are depends on the work.
We are a controller for personal data about:
- visitors to our website and people who make enquiries
- our client contacts, prospects and referral partners
- our own files, case notes and records of the advice we give
- job applicants and our own staff and consultants
- our suppliers
- people on our marketing list and attendees at our events, webinars and training
We are a processor where we handle personal data about a client’s workforce on that client’s instructions, for example administering a client’s HR system, operating an absence reporting process, or producing documents from information the client supplies. In those cases the client is the controller, the client’s own privacy notice governs, and our processing is covered by a written agreement that meets Article 28 UK GDPR.
Where we advise a client on an individual employment matter, we are also a controller in our own right in relation to our advice file and our record of the advice we gave. That is because we decide what to record and how long to keep it in order to run our business, meet our professional obligations, satisfy the conditions of our professional indemnity insurance, and defend claims.
If you are an employee, worker or former employee of one of our clients and you want to know how your personal data is handled, ask your employer first, because in most cases they are the controller. You can also contact us using the details in section 1 and we will help where we can.
4. What personal data we handle, and where we get it
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, job title, employer, email address, telephone number, postal address | You, your employer, our client, publicly available business sources |
| Business and account | Company name, company number, VAT number, service tier, contract and renewal records | You, Companies House and other public registers |
| Billing and payment | Billing name and address, bank details for direct debit, invoice and payment history | You. Card payments are handled by our payment provider and we do not store full card numbers |
| Enquiry and correspondence | Emails, letters, notes of calls and meetings, website form submissions, live chat messages | You |
| Call recordings | Recordings and notes of advice line and other telephone calls | The call itself. Where we record a call we tell you at the start |
| Employment case data | Information contained in contracts, handbooks, and grievance, disciplinary, capability, performance, absence, redundancy, settlement and tribunal files, including data about employees, managers, witnesses and complainants | Our client, you, and occasionally third parties such as Acas or an employment tribunal |
| Special category data | Health and sickness absence, disability and reasonable adjustments, pregnancy and maternity, racial or ethnic origin, religion or belief, sex life or sexual orientation, trade union membership, where these arise in an employment matter | Our client, you, occupational health or medical reports |
| Criminal offence data | Allegations, investigations, cautions, convictions and DBS outcomes, where relevant to an employment matter | Our client or you |
| Recruitment | CV, application form, references, right to work evidence | You or a recruitment agency |
| Website and technical | IP address, device and browser type, pages visited, referring URL, cookie and similar identifiers | Collected automatically. See section 12 |
| Marketing | Subscription and preference records, opt-ins and opt-outs, engagement with our emails and events | You, or generated by our systems |
We do not set out to collect data about children through our website. Where a child’s data appears in an employment matter, for example a dependant named in a bereavement, parental leave or flexible working case, we handle it with the same protections and no lesser care.
5. Why we use personal data, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Respond to enquiries, provide quotes and proposals | Article 6(1)(b), steps taken at your request before entering a contract. Article 6(1)(f), our legitimate interest in responding to an approach about our services |
| Deliver our HR and employment law services | Article 6(1)(b), performance of our contract with our client. Article 6(1)(f) where the individual concerned is not the contracting party, our legitimate interest and our client’s legitimate interest in obtaining competent HR and employment law support |
| Handle special category data arising in an employment matter | Article 9(2)(b), employment, social security and social protection, read with Schedule 1 Part 1 paragraph 1 of the Data Protection Act 2018. Article 9(2)(f), establishing, exercising or defending legal claims. Article 9(2)(h) where occupational medicine applies. Article 9(2)(a), explicit consent, where no other condition applies |
| Handle criminal offence data | Conditions in Schedule 1 of the Data Protection Act 2018, principally paragraph 1 (employment) and paragraph 33 (legal claims), together with the additional safeguards those conditions require |
| Invoice, collect payment, manage credit control and recover debts | Article 6(1)(b), our contract. Article 6(1)(c), legal obligation for tax and accounting. Article 6(1)(f), our legitimate interest in recovering sums owed |
| Keep a record of the advice we give, and bring or defend claims, complaints and regulatory matters | Article 6(1)(c) where a legal obligation applies. Article 6(1)(f), our legitimate interest in protecting our position and meeting the conditions of our professional indemnity insurance. Article 9(2)(f) for special category data |
| Comply with law, and cooperate with regulators, insurers and auditors | Article 6(1)(c) and Article 6(1)(f) |
| Report a concern to a public authority, prevent or detect crime, or safeguard someone at risk | Article 6(1)(ea), recognised legitimate interests, under Annex 1 to the UK GDPR |
| Recruit staff and consultants | Article 6(1)(f) and Article 6(1)(c) for right to work checks |
| Market our services to businesses by email, post, telephone and social media | Article 6(1)(f), our legitimate interest in promoting our services to business contacts, subject to the Privacy and Electronic Communications Regulations. Article 6(1)(a), consent, where those Regulations require it |
| Run events, webinars and training | Article 6(1)(b) or Article 6(1)(f). Consent where we record a session and you appear in it |
| Operate, secure and improve our website | Article 6(1)(f). Consent under the Privacy and Electronic Communications Regulations where required for cookies and similar technologies |
| Produce internal management information and improve our services | Article 6(1)(f), using aggregated or anonymised data wherever possible |
Where we rely on legitimate interests, we balance that interest against your rights and interests before we proceed.
Where we rely on consent you can withdraw it at any time. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
We only use personal data for a new purpose where that purpose is compatible with the original one, or where you consent, or where the law otherwise allows it.
6. Where we get personal data other than from you
We receive personal data from our clients and their managers, from referral partners and introducers, from recruitment agencies, from Companies House and other public registers, from Acas and employment tribunals, from occupational health providers and other experts, from other professional advisers, and from publicly available business sources including LinkedIn and company websites.
7. Software, artificial intelligence and automated decisions
We use software to run our business, and some of it has artificial intelligence features that help us process absence reports, draft documents and manage our records. Where those tools are used on information about people, a member of our team reviews the output before any decision affecting an individual is taken.
We do not take decisions about individuals by solely automated means where those decisions produce legal effects or otherwise significantly affect them. If that changes, we will update this notice and tell affected individuals. In that situation you would have the right, under Articles 22A to 22D UK GDPR, to be given meaningful information about the decision, to make representations about it, to obtain human intervention, and to contest the outcome.
8. Who we share personal data with
- Our client, where we are acting for that client on an employment matter
- Our professional advisers, including solicitors, counsel and accountants
- Our professional indemnity insurers, our insurance brokers, and any claims handler, loss adjuster or panel solicitor they appoint
- Our IT and software suppliers, who host or support our HR software, CRM, document management, email, file storage and telephony systems
- Our bank, payment providers and accountants
- Acas, employment tribunals, courts and other bodies where a matter requires it
- Occupational health providers, medical experts and other experts instructed on a matter
- Regulators, law enforcement and other public authorities, where we are legally required to disclose or where disclosure is necessary for a purpose listed in Annex 1 to the UK GDPR
- A buyer or successor, if we sell, transfer or reorganise our business or any part of it
We require any supplier that handles personal data on our behalf to act only on our instructions and under a written contract meeting Article 28 UK GDPR. We are reviewing our supplier contracts to confirm that this is in place across all of them.
We do not sell personal data. We do not share it with third parties for their own marketing.
If you want to know more about the suppliers we use in connection with your personal data, contact us using the details in section 1.
9. Transfers outside the UK
Most of the personal data we handle stays in the UK. Some of our suppliers process personal data outside the UK, including in the European Economic Area and the United States. Where that happens, we rely on a lawful transfer mechanism permitted by Chapter V of the UK GDPR. Depending on the supplier, that is one of the following:
- UK adequacy regulations, sometimes called a data bridge, including the UK Extension to the EU-US Data Privacy Framework where the supplier is certified under it
- the International Data Transfer Agreement, or the International Data Transfer Addendum to the EU standard contractual clauses, supported by a transfer risk assessment where one is required
- another safeguard permitted by Chapter V of the UK GDPR
We are reviewing our international transfers to confirm the mechanism, and where required the transfer risk assessment, for each supplier that processes personal data outside the UK.
If you want to know more about a particular transfer, contact us using the details in section 1.
10. How long we keep personal data
| Record | How long we keep it |
|---|---|
| Website and general enquiries that do not become client engagements | 24 months from last contact |
| Client contract, account and billing records | 7 years from the end of the engagement |
| Advice files, case notes and correspondence on an employment matter | 7 years from closure of the file, and longer where a claim, complaint or tribunal matter is live or reasonably anticipated |
| Call recordings and call notes | 12 months, and longer where the call relates to a live or anticipated matter |
| Accounting and tax records | 6 years from the end of the accounting period they relate to, as HMRC requires |
| Applications from unsuccessful candidates | 12 months from the recruitment decision |
| Marketing contacts and preferences | Until you opt out. We then keep a minimal suppression record indefinitely, so that we do not contact you again by mistake |
| Website analytics and cookie data | As set out in section 12 |
| Records of data protection requests, complaints and breaches | 3 years from closure, or longer where a regulatory matter is open |
We set these periods by reference to how long we need the records for the purpose we collected them, and to the limitation periods that apply to claims and to our legal, tax and insurance obligations. You can ask us about any period in this table.
Where a matter is subject to a claim, an insurance notification, a regulatory investigation or a legal hold, we keep the file until the matter is concluded and the relevant limitation periods have expired, even if the period in the table above has passed.
When a retention period ends we delete the data securely or anonymise it so that you can no longer be identified from it.
11. How we keep personal data secure
- Access limited to those who need it, with individual accounts and role based permissions
- Multi-factor authentication on our core business systems, which we are extending across all platforms
- Encryption of personal data in transit and, on our main systems, at rest
- Most personal data held in the UK, with any international processing subject to the safeguards in section 9
- Due diligence on suppliers before we use them, and a requirement for a written contract meeting Article 28 UK GDPR where they handle personal data on our behalf
- Confidentiality obligations in every contract of employment and consultancy agreement, and data protection training for our people
- A breach response process, under which we report qualifying breaches to the ICO within 72 hours and notify affected individuals where there is a high risk to them
- Regular backups, and secure destruction of paper records and redundant hardware
No system is completely secure. If something does go wrong we will act on it promptly and tell you where the law requires us to.
12. Cookies and similar technologies
Cookies and similar technologies, including pixels, tags, scripts and browser storage, put information on your device or read information from it. We use them to make the website work, to keep it secure, and to understand how it is used.
Since 5 February 2026, the Privacy and Electronic Communications Regulations no longer require consent for certain lower risk purposes, including storage and access used solely to collect statistics about how the site is used in order to improve it, to adjust how the site appears to you, for security and fraud prevention, for functionality, and for software updates. Those exceptions apply only where the technology is used solely for the stated purpose, and only where we tell you clearly about it and give you a simple and free way to opt out. Anything outside those exceptions, including advertising, remarketing, and any analytics that also feeds advertising or profiling, still needs your consent.
Our analytics is provided by Google Analytics 4. Because that involves data passing to Google, which may use it for its own purposes, it falls outside the statistical exception and we ask for your consent before we set those cookies.
| Category | Purpose | Consent needed |
|---|---|---|
| Strictly necessary | Running the site, keeping it secure, and remembering your cookie choices | No |
| Analytics | Understanding how the site is used so we can improve it. Provided by Google Analytics 4 | Yes |
We are completing a full technical review of the cookies and similar technologies on this site, and will publish the detail here, including individual cookie names and how long each one lasts, when that review is finished.
You can change your choices at any time using the Cookie settings link in the footer of every page. You can also block or delete cookies through your browser settings, though parts of the site may then not work properly.
13. Your rights
Under the data protection legislation you have the following rights. We will always work to uphold them.
- To be informed about how we use your personal data. This notice does that, and you can ask us for more
- To access the personal data we hold about you. See below
- To have inaccurate or incomplete data corrected
- To have your data erased in certain circumstances
- To restrict our processing of your data in certain circumstances
- To object to our processing where we rely on legitimate interests. You have an absolute right to object to direct marketing, and if you do we will stop
- To withdraw consent, where consent is the basis we rely on
- To data portability, where we hold data you gave us, we process it by automated means, and our basis is consent or contract
- Rights in relation to automated decision-making, under Articles 22A to 22D UK GDPR
- To complain, to us and to the ICO. See section 14
Not every right applies in every situation. Some are qualified, and some are limited where we need to keep data to comply with the law, to defend a legal claim, or to protect the rights of others, for example the confidentiality of a colleague who gave evidence in a workplace investigation. If we cannot do what you ask, we will tell you why and tell you how to challenge that.
Please keep us informed if your details change, so that what we hold stays accurate.
Making a subject access request
Contact us using the details in section 1. You can make a request verbally, but putting it in writing helps us understand exactly what you want. There is normally no charge.
- We will respond within one month of receiving your request
- We may ask you to confirm your identity before we disclose anything, and we may ask for reasonable clarification where we genuinely need it to identify the data or the processing activity you mean. Where we do, the time limit pauses from the day we ask until the day you reply
- We may extend the deadline by up to two further months where the request is complex or where you have made several requests. If we do, we will tell you within the first month and explain why
- We are required to carry out a reasonable and proportionate search, not an exhaustive one. We will tell you what we searched
- Where a request is manifestly unfounded or excessive, for example if it repeats a request we have already answered, we may charge a reasonable fee or refuse it. We will explain our reasoning and your right to challenge it
14. Complaints
If you think we have handled your personal data wrongly, tell us. You have a right to complain to us directly, and we would rather put things right ourselves than have you go to the regulator first.
How to complain to us
- Email amrita.gb@norihr.co.uk, putting “Data protection complaint” in the subject line, or
- Telephone us on 0330 043 5548 and ask for the Data Protection Officer
There is no form to complete, and no particular wording or legal citation you need to use. Just tell us what happened and what you want us to do. We will accept your complaint however it reaches us, so you do not have to use one of the routes above.
What we will do
- Acknowledge your complaint within 30 days of receiving it
- Look into it without undue delay, make appropriate enquiries, and keep you updated on progress
- Tell you the outcome and our reasons
- Keep a record of the complaint, how we handled it and what we decided
If you are not satisfied
You can complain to the Information Commissioner’s Office at any time. You do not have to come to us first.
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
You can also seek a remedy through the courts, and you may be able to claim compensation if you have suffered damage.
15. Marketing
We market our services mainly to businesses. If you are a corporate subscriber, for example a limited company or a limited liability partnership, we may send you marketing by email without your prior consent, as the Privacy and Electronic Communications Regulations permit. If you are an individual subscriber, such as a sole trader or an individual at an unincorporated business, we will only email you marketing where you have consented or where you are an existing customer and we are marketing similar services.
Every marketing email we send identifies us and gives you a one click way to unsubscribe. You can also opt out at any time using the details in section 1, or by signing up to the Telephone Preference Service, the Corporate Telephone Preference Service or the Mailing Preference Service.
16. Links to other websites
Our website contains links to other sites. We do not control how those sites collect or use personal data. Please read their own privacy information before giving them anything.
17. Changes to this notice
We review this notice at least annually, and whenever the law or our business changes in a way that affects personal data. The date of the current version is shown at the top. Where a change is significant we will draw attention to it on the website and, where appropriate, tell affected individuals directly.