Privacy Notice

HR Now Limited (trading as HR Now) is the data controller responsible for your personal information. We are committed to protecting your privacy and being transparent about how we collect, use and store your data. This privacy notice explains what information we hold about you, how we collect it, what we do with it, and your rights under the Data Protection (Jersey) Law 2018. If you have any questions about this notice, please contact us using the details below.

We have appointed an external Data Protection Manager to help us comply with our data protection obligations. You can contact them if you have any questions or concerns about how we handle your personal data:

• Name: Nicky Maddox
• Email: DPO@hrnow.je

We collect and process personal information about you when you interact with us as a client, prospect, or website visitor. This includes information you provide directly to us, information we collect automatically when you visit our website, and information we receive from third parties such as recruitment agencies or other HR service providers.

Most of the information we hold falls into standard personal data categories such as your name, contact details, and business information. However, in some circumstances we may also process special category data (more sensitive information) such as health or medical information, for example if you disclose health conditions or needs when we are arranging workplace adjustments or event attendance.

We collect your personal information in a number of ways:

• Directly from you when you contact us, request our services, complete forms, register for events, or communicate with us by telephone, email or post.
• From third parties such as recruitment agencies, employment service providers, or other HR consultants who may refer you to us or provide your details with your consent.
• Automatically when you visit our website through cookies and similar technologies (see the section on cookies below).
• From publicly available sources or professional networks where relevant to our services.

In addition to the standard personal data listed above, we may in some circumstances collect special category data, which is more sensitive personal information that the law recognises as requiring extra protection. This includes:

• Information about your health or medical conditions, including health diagnosis data, medical history, allergy information, and doctor's or hospital reports, where this is relevant to our provision of HR services or workplace adjustments.
• Information relating to family circumstances such as baby due dates, maternity leave information, parental leave information, surrogacy information or adoption arrangements, where disclosed to us in connection with our services.
• Information about sickness or absence from work, where relevant to services we are providing.
• Information about potential disability or impairment where this affects the services we provide or adjustments we need to make.

We only collect and use special category data where we have a lawful basis to do so under the Data Protection (Jersey) Law 2018. We process such information with extra care and apply additional safeguards to protect it. If you do not wish to disclose health information or other special category data to us, please let us know and we will discuss alternative ways of working with you.

We use your personal information for a number of purposes, depending on the nature of our relationship with you and the services you have requested. Below we explain the lawful bases we rely on under the Data Protection (Jersey) Law 2018 for different uses of your information.

1. Processing necessary for a contract with you (Article 9, Schedule 2 Part 1, of the Data Protection (Jersey) Law 2018)

Where you are a client or prospect and you have asked us to provide HR services, we process your information to fulfil our contractual obligations to you. This includes:

• Managing your relationship with us and delivering the HR services you have requested, such as recruitment support, employee management systems, change management advice or strategic HR solutions.
• Processing invoices, payments and other financial information related to services provided.
• Communicating with you about the progress and delivery of services.
• Maintaining records of your instructions and our work for you.

2. Processing necessary for compliance with legal obligations (Article 9, Schedule 2 Part 2, of the Data Protection (Jersey) Law 2018)

We are subject to various legal and regulatory requirements that may require us to process your personal information:

• Verifying your identity and conducting checks required under money laundering or financial crime legislation.
• Maintaining records as required by tax and accounting laws in Jersey and the UK.
• Responding to requests from the Jersey authorities, law enforcement or the courts.

3. Processing necessary for our legitimate interests (Article 9, Schedule 2 Part 1, of the Data Protection (Jersey) Law 2018)

We also process your information where we have a legitimate interest in doing so and that interest is not overridden by your rights and freedoms. For each activity below, we have carried out a balancing test to weigh our legitimate interest against your privacy interests, and we are satisfied that our interest is not overridden by your rights and freedoms. The specific activities and the interests we are pursuing are set out in the table below.

If you would like further information about the balancing tests we have carried out in relation to any of the activities above, please contact us using the details set out in this notice.

4. Processing with your consent

In some cases, we may ask for your explicit consent to process your personal information. This may include consent to receive marketing communications, to process special category data, or to use information for a purpose beyond what you would reasonably expect. You have the right to withdraw consent at any time by contacting us using the details below.

We will only use your personal information for the purposes we have described in this notice, or for purposes that are compatible with those purposes. If we wish to use your information for a new purpose that is materially different from the purposes for which we collected it, we will notify you and explain the legal basis for the new use. Where required by law, we will obtain your consent before processing your information for that new purpose.

HR Now shares your personal data with carefully selected third-party service providers (known as "processors") who help us deliver our HR services. These processors are contractually bound to process your data only on our instructions and in accordance with data protection law.

The following table sets out the processors we use, the purpose of their processing, and where you can find further information about their privacy practices.

All processors listed above are located within Jersey, the UK, or the European Economic Area. Your personal data is not transferred outside Jersey, the UK, or the EEA.

HR Now takes the security of your personal data very seriously. We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, access controls, secure storage facilities, and regular security assessments.

Our staff are trained in data protection and confidentiality obligations. Access to your personal data is restricted to those employees and processors who need it to perform their duties.

However, no method of transmission or storage of data is completely secure. Whilst we do our best to protect your information, we cannot guarantee absolute security. If you have concerns about the security of your data with us, please contact our Data Protection Manager.

HR Now retains your personal data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The table below sets out the retention periods or criteria we apply to the main categories of personal data we hold.

Where a specific legal obligation requires data to be kept for a defined period, we will retain it for that period regardless of the general retention periods above. Once the applicable retention period expires, your personal data will be securely deleted or irreversibly anonymised, unless we are under a legal obligation to retain it for longer.

If you wish to request earlier deletion of your personal data where this is legally permissible, please contact us using the methods set out in the section headed "How to Request Your Information" below.

Under the Data Protection (Jersey) Law 2018, you have the following rights in relation to your personal data:

• Right of access: you have the right to request a copy of the personal data we hold about you and to be informed about how we use it.
• Right to rectification: you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure: in certain circumstances, you have the right to request that we delete your personal data, subject to legal and contractual obligations we may have to retain it.
• Right to restrict processing: you have the right to request that we limit the use of your personal data in certain circumstances, for example while we consider a rectification request.
• Right to data portability: in certain circumstances, you have the right to request that we provide your personal data in a structured, commonly-used, and machine-readable format, and to transmit it to another controller.
• Right to object: you have the right to object to our processing of your personal data where we rely on legitimate interests as the lawful basis, subject to our own legitimate interests or legal obligations.

To exercise any of these rights, please use the methods described in the section headed "How to Request Your Information" below.

You can submit a request to exercise any of your data subject rights (including requests for access, rectification, erasure, restriction, portability, and objection) using our Data Rights Portal.

Alternatively, you can also email your request to DPO@hrnow.je or write to us at the address below.

When you submit a request, we will ask you to verify your identity to ensure we disclose information only to the person entitled to receive it. Please provide as much detail as possible about the type of information you are seeking to help us locate it quickly.

HR Now
8 Hill Street
St Helier
Jersey JE2 4UA

Telephone: 01534 747559
Email: DPO@hrnow.je
Website: https://www.hrnow.je/

We will respond to your request within four weeks of receipt. If your request is complex or you have made multiple requests, we may extend this period by a further eight weeks. We will inform you of any extension within the original four-week period and explain the reasons for it. We will not charge you a fee for your request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to respond.

Where we rely on your consent as the lawful basis for processing your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before you withdrew your consent.

To withdraw your consent, please contact us using the Data Rights Portal or by emailing DPO@hrnow.je.

We do not use automated decision-making or profiling in relation to your personal information.

HR Now may update this privacy notice from time to time to reflect changes in our processing activities, legal requirements, or other relevant matters. Where we make material changes to this notice, we will notify you by email or by a prominent notice on our website before the change takes effect.

Your continued use of our services following notification of changes will constitute your acceptance of the updated privacy notice. We encourage you to review this notice regularly to stay informed about how we protect your personal data.

The current version of this privacy notice is dated 23 June 2026. Previous versions are available on request.

If you believe that HR Now has breached your data protection rights or this privacy notice, you have the right to lodge a complaint.

First, please contact us:
Data Protection Manager (Nicky Maddox)
Email: DPO@hrnow.je

Or contact HR Now directly:
8 Hill Street
St Helier
Jersey JE2 4UA
Telephone: 01534 747559
Email: DPO@hrnow.je

We will investigate your complaint and respond within a reasonable timeframe.

If you are not satisfied with our response, you can lodge a complaint with the supervisory authority:

Jersey Office of the Information Commissioner
2nd Floor
5 Castle Street
St Helier
Jersey JE2 3BT

Telephone: +44 (0) 1534 716530
Email: enquiries@jerseyoic.je
Website: jerseyoic.org

You have the right to lodge a complaint with the Jersey Office of the Information Commissioner at any time. You do not need to contact us first, although we would welcome the opportunity to resolve your concerns.