1. Introduction

Hello HQ Ltd (“we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This policy outlines how we comply with the General Data Protection Regulation (GDPR) and ensure the lawful, fair, and transparent processing of personal data. By using our services, you acknowledge that your data will be processed in accordance with this policy.

2. Roles and Responsibilities

We may act as both a Data Controller and a Data Processor, depending on the nature of data processing:

• As a Data Controller, we determine the purposes and means of processing personal data.
• As a Data Processor, we process data on behalf of a Data Controller in accordance with their instructions.

3. Lawful Basis for Data Processing

We only process personal data when there is a lawful basis to do so, including:

• Contractual necessity – To provide our services to you.
• Legal obligation – To comply with applicable laws and regulations.
• Legitimate interest – When necessary for business operations and does not override your rights.
• Vital interests – When processing is necessary to protect someone’s life.
• Consent – When required, we will obtain explicit consent before processing your data.

4. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Access – Request a copy of the data we hold about you.
• Rectification – Request corrections to inaccurate or incomplete data.
• Erasure (“Right to be Forgotten”) – Request the deletion of your data when no longer necessary.
• Restriction of processing – Request limited processing of your data under certain conditions.
• Data portability – Request to receive your data in a structured format.
• Objection – Object to processing based on legitimate interests.
• Automated decision-making – Not to be subject to decisions based solely on automated processing.

To exercise these rights, submit a Subject Access Request (SAR) by contacting us at howdy@hellohq.co.uk. We will respond within one month in accordance with GDPR requirements.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. The specific retention period depends on the type of data and legal obligations. Once data is no longer required, it is securely deleted or anonymised. If you wish to request deletion of your data, please contact us at howdy@hellohq.co.uk.

6. Data Protection and Security

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, alteration, disclosure, or destruction. We also ensure that any third parties processing data on our behalf comply with GDPR standards.

7. International Data Transfers

If personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), to maintain GDPR compliance.

8. Data Breach Notification

In the event of a data breach that poses a risk to individuals’ rights and freedoms, we will notify the Information Commissioner’s Office (ICO) and affected individuals without undue delay, in accordance with GDPR requirements.

9. Contact Information

For any inquiries or concerns regarding our GDPR compliance, please contact our Data Protection Officer (DPO) at: Email: howdy@hellohq.co.uk

10. Updates to This Policy

We may update this GDPR policy from time to time. Any significant changes will be communicated via our website or other appropriate means.

By using our services, you acknowledge that your data will be processed in line with this policy.