Blossom HR Ltd Privacy Notice

Last Updated: 13th March 2025

This Privacy Notice explains how we collect, use, store and share your personal data and sets out your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and PECR. Please read it carefully. Depending on your interaction with us, Blossom HR Ltd may act in different roles:

  • When you contact us directly (for enquiries, job applications, or similar), we act as the Data Controller and determine the purposes and means of processing your data.
  • When we provide HR services on behalf of our client organisations, we act as a Data Processor. In these cases, our clients are the Data Controllers and decide how your data is processed. If you have questions about that processing, you should contact the relevant client.

1. Who We Are

Blossom HR Ltd is a UK-based HR consultancy offering outsourced HR services predominantly to SMEs.

  • Registered in England and Wales: Company No. 13497135
  • ICO Registration: ZB161941
  • Data Protection Lead: Rosie Wicks
  • Contact Details:

2. Our Role – Data Controller and Data Processor

Direct Contact (Data Controller):
When you contact us via our website, email, or other channels (for example, making enquiries or applying for a role), Blossom HR Ltd is responsible for deciding why and how your personal data is processed.

On Behalf of Our Clients (Data Processor):
When we provide HR consultancy services for our client organisations, we process your personal data strictly on their instructions. In such instances, your employer or the client organisation is the Data Controller and is responsible for the purposes and means of processing. For any issues about the overall processing, please approach your employer;

3. What Personal Data We Collect

Depending on how you interact with us, we may collect and process different types of personal data, including:

  • Contact Information:
    Name, address, email, telephone number.
  • Employment Details:
    Job title, work history, recruitment information and related HR records.
  • HR Service Data:
    Information required for managing disciplinary cases, grievances, absence management, performance data, and other HR-related processes.
  • Special Category Data:
    Where necessary and legally permitted, we may process sensitive data (for example, data relating to health or ethnicity). Such processing is subject to additional conditions under the UK GDPR.

Some of this data is provided directly by you (for example, when filling in a contact form or job application) while other information may be collected indirectly as part of our provision of HR services on behalf of our clients.

4. How We Use Your Personal Data

We use your personal data for purposes including, but not limited to:

  • When Acting as Data Controller:
    • Responding to your enquiries or processing your job application.
    • Managing any contractual or service-related arrangements you have with us.
    • Communicating with you regarding updates, services, or regulatory requirements.
  • When Acting as Data Processor for Our Clients:
    • Assisting in the delivery of HR services as instructed by the client.
    • Processing data strictly in line with our client’s requirements and any legal obligations.

5. Lawful Bases for Processing

We ensure that there is a valid legal basis for processing your personal data:

  • For Data Collected Directly (when we are the Data Controller):
    • Contract: Processing is necessary to perform our contractual obligations with you.
    • Legal Obligation: Processing is required to comply with UK law.
    • Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your rights.
    • Consent: In specific cases (particularly when processing sensitive data), we may rely on your explicit consent.
  • For Data Processed on Behalf of Clients (as a Data Processor):
    • We only process your data on the clear instructions of our client, who is the Data Controller, and who is responsible for establishing the lawful basis.

6. Who We Share Your Personal Data With

Your personal data may be shared with:

  • Trusted Third Parties:
    Service providers and partners who help us operate our business and deliver our services.
  • Legal and Regulatory Authorities:
    Where required by law, including fraud prevention and law enforcement agencies.
  • Client Organisations:
    When we act as a Data Processor, data is shared with our clients solely for the purpose of delivering HR services.

We ensure that all sharing of your data complies with the UK GDPR and other applicable data protection laws.

7. International Data Transfers

We do not routinely transfer your personal data outside the UK. If any international transfers become necessary, appropriate safeguards will be implemented to ensure that your data remains protected in line with UK data protection requirements.

8. Data Retention

Your personal data will be retained only for as long as is necessary to fulfil the purposes for which it was collected, including meeting any legal, contractual, or legitimate business needs. Once the data is no longer required, we will securely delete, archive, or anonymise it in accordance with our data retention policies.

9. Data Security

We take the security of your personal data very seriously. We have implemented robust technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, or destruction. Access to your personal data is restricted to those with a legitimate need to know.

10. Cookies

Our website uses cookies to enhance your user experience, support essential site functions, and gather non-personal analytical data. You can manage your cookie preferences by accepting or rejecting non-essential cookies when you open our site.

data is restricted to those with a legitimate need to know.

11. Your Rights

Under the UK GDPR, you have certain rights regarding your personal data. Please note the following distinctions:

When Blossom HR Ltd is the Data Controller (direct enquiries):

  • Right to be Informed: You have the right to clear information about our processing of your data.
  • Right of Access: You can request a copy of the personal data we hold about you.
  • Right to Rectification: You may request corrections to any inaccurate or incomplete data.
  • Right to Erasure: In certain circumstances, you can ask for your data to be deleted.
  • Right to Restrict Processing: You can request limitations on how your data is processed.
  • Right to Data Portability: You have the right to receive your data in a structured, commonly used format.
  • Right to Object: You may object to certain types of processing, including direct marketing or processing based on legitimate interests.
  • Right Regarding Automated Decision-Making: You are entitled to not be subject to decisions based solely on automated processing.

When Blossom HR Ltd Acts as a Data Processor (on behalf of a client):

  • The overall purposes and means of processing are determined by the client (the Data Controller). For any issues regarding these aspects, please contact the client organisation directly.
  • You may still contact us for information about how we process your data as a Processor.

To exercise your rights, please contact us at the details provided below. If your query relates to processing carried out on behalf of a client, you will need to contact that organisation directly.

12. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. Any changes will be communicated via our website, and the ‘Last Updated’ date at the top of this notice will be revised accordingly. We encourage you to review this notice periodically.

13. Complaints

If you have any concerns about our handling of your personal data, please contact our Data Protection Lead, Rosie Wicks, at hr@blossomhr.co.uk or 01749 372990. If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) via https://ico.org.uk.

14. Contact Us

If you have any questions about this Privacy Notice or our data protection practices, please contact:

Blossom HR Ltd
Email: hr@blossomhr.co.uk
Telephone: 01749 372990
Data Protection Lead: Rosie Wicks