High Tide HR Consultancy ("we," "us," or "our") is committed to protecting the privacy and security of your personal data . This privacy policy outlines how we collect, use, store, and protect the personal information of our clients, prospective clients, and other relevant parties in compliance with the Data Protection (Jersey) Law 2018 (DPJL). This privacy policy is referred to in section 17 of our Terms of Business.

1. Who are we?

1.1. High Tide HR Consultancy is a Jersey registered company (34563). We provide consultancy services in the field of HR, specialising in the creation of HR/people policies, employee handbooks and supporting documentation and training. We also undertake HR projects and workplace investigations on behalf of employers.

1.2. For the purposes of data protection legislation, we act as the data controller for the personal data we process in connection with our Services . There are also instances where we receive information from others, for example from employers, where we are likely to be either a joint controller or processor of that data.

1.3. High Tide HR Consultancy is registered as a Data Controller with the Office of the Information Commissioner, registration number 71119.

1.4. If you have any questions about this policy, or how we handle your data, please contact us:

Business name: High Tide HR Consultancy

Email: melanie@hightidehr.je

2. What information do we collect? (Clients and prospective clients)

2.1. We aim to collect only personal data that is necessary for us to deliver our Services to you and respond to your queries. In this respect, we may collect and hold the following types of personal data (this list is not exhaustive as each matter, due to its nature, is different and has different requirements).

a) Your name and business contact details

b) Matter information (where it includes personal data e.g. the name or contact details for others)

c) In the course of investigations, in particular, we may hold additional personal information, which can include special category data e.g. about health, race.

2.2. We collect most of this information from you in person, by telephone, email, via a secure portal used to transfer data, or via a Microsoft Teams channel that may be set up to enable the delivery of our Services to you.

2.3. We are also likely to request your business’s existing employee handbook, contract of employment template or HR policies and other relevant documentation to allow us to carry out our HR consultancy services, albeit if these are in templated or anonymised formats, these will not amount to personal data.

3. How do we use your information?

3.1. Primarily we use your information to enable us to prepare a fee proposal, to fulfil our contractual obligations to you or to provide our Services to you that you have requested.

3.2. Managing client relationships, including communication, billing and feedback collection.

3.3. Complying with any legal obligations.

3.4. Improving our Services and understanding client needs.

3.5. Processing any complaints.

3.6. Marketing our HR consultancy services to existing and potential clients (where consent has been given).

3.7. Administering, supporting, improving and developing our business generally and enforcing our legal rights.

4. How do we store and protect your information?

4.1. We take appropriate measures to safeguard personal data against unauthorised access, alteration, disclosure or destruction. These measures include:

a) Secure data storage, including password protected systems and encryption where necessary and locked manual filing cabinets.

b) Limiting access to information to authorised personnel only.

5. Sharing your information

5.1. We may share your information with a third party, as required, to complete the Services. This could be third-party providers who assist us in delivering our services, for example an employment lawyer or IT support provider. We only allow third party providers to handle your personal data where necessary. In such circumstances there are formal agreements in place and we ensure those third parties take appropriate measures to protect your personal data.

5.2. In the context of an employment investigation, appropriate personal information may be shared in order for that investigation to be performed, which extends to any internal or external hearing following the investigation.

5.3. Legal or regulatory authorities, where required by law.

5.4. We may share your personal data with our insurers or any brokers – if there are grounds for a claim against us, or you make a claim against us.

5.5. The Jersey Office of the Information Commissioner or our insurers – if you make a data protection claim against us.

5.6. We would not share your personal data with any other third party without your prior consent.

6. Retention of information

6.1. After we have completed our Services, we will not retain your personal data for longer than necessary for the purposes outlined in this policy or to comply with legal obligations. The typically means:

a) Client data - Retained for the duration of the client relationship and for up to ten years thereafter for legal or financial record-keeping purposes.

b) Marketing data – retained until you withdraw consent previously given or opt-out.

6.2. In the scenario where we are performing an investigation on behalf of an employer, all information gained or produced in the course of that investigation will be provided to the employer at the end of the investigation and a shorter retention period of two years may be applied by us to that information. We reserve the right to retain that information for longer, in individual cases, should it be appropriate in the circumstances due to ongoing legal, regulatory or employment proceedings.

7. Your rights

7.1. The Data Protection (Jersey) Law 2018 (DPJL) gives you a number of rights, including rights to:

a) Request corrections to any mistakes in your personal data that we hold.

b) Access your personal data.

c) Restrict the processing of your personal data in certain circumstances.

d) Request that we erase your personal data in certain circumstances.

e) Withdraw consent for data processing, where applicable.

To exercise any of these rights, please contact us in writing using the details set out above in section one.

7.2. In the context of employment investigations, we are usually acting as a joint data controller with the employer who has appointed us to perform the investigation. If making a subject access request regarding personal information within an investigation, that request should be directed to the relevant employer in the first instance. We will co-operate with that employer, if necessary, to provide any additional information needed to enable an appropriate and lawful response to the request.

8. What happens in the event of a data breach?

8.1. In the event of a data breach, we shall ensure that our obligations under applicable data protection laws are complied with where necessary. The following steps will typically be taken:

a) We will contain the breach.

b) Assess the breach and any adverse consequences for individuals, based on how serious or substantial these are and how likely they are to happen, and

c) To limit the scope of the breach taking steps to mitigate the effects of the breach.

8.2. Within 72 hours, we will determine the seriousness of the breach and whether the Jersey Office of the Information Commissioner and/or data subjects need to be notified of the breach.

8.3. We will maintain a detailed record of all data breaches, regardless of whether they are reportable to the Jersey Office of the Information Commissioner. This record will include:

a) The nature of the personal data breach.

b) The categories and approximate number of data subjects concerned.

c) The categories and approximate number of personal data records concerned.

d) A description of the likely consequences of the personal data breach.

e) A description of the measures taken or proposed to be taken to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

9. Complaints

9.1. Should you wish to complain about our use of your personal data, please contact us via email at melanie@hightidehr.je. We will investigate all complaints received and will endeavour to respond to complaints promptly. You may also take your complaint directly to the Jersey Office of the Information Commissioner (JOIC).

10. Updates to this policy

10.1. We may update this policy from time to time. You can contact us at any time for the latest version of this policy. We recommend reviewing this policy periodically to stay informed about how we process your data.

END

Version 3.0

Last reviewed July 2026