Privacy notice

1. Who we are

1.1 Handbook Portal is provided by HR On Call Ltd, a company registered in England and Wales (company number 16891106), whose registered office is at 3 Pethill Close, Plymouth, PL6 8NL ("we", "us", "our").

1.2 We are the controller of the personal information described in this notice, except where section 5 says otherwise. This notice explains how we use personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

2. Who this notice covers

• Visitors to handbookportal.co.uk and its pages.
• Account holders: HR consultants on the reseller plan and organisations on the direct plan, and the people who sign in to manage their account.
• People in a handbook, such as staff and admins. For them, we mostly act on behalf of the organisation that runs the handbook (see section 5).

3. Information we collect

Account information

Your name, work email address, company name, password (stored only as a secure hash), plan, and the handbooks you set up.

Billing information

Your billing name and address, VAT number if you give one, subscription status and payment history. Card details are entered directly with our payment provider, Stripe. We never see or store your full card number.

Terms acceptance

Which version of our terms you accepted, when, and the IP address and browser it was accepted from, so that we can show what was agreed.

Usage and technical information

Sign-in records, activity in your workspace (for example, publishing a policy or inviting staff), IP addresses, browser and device type, and security logs, including failed sign-in attempts.

Communications

Emails and messages you send us, and records of the service emails we send you.

4. How and why we use it

4.1 We do not sell personal information, and we do not use it to train artificial intelligence models.

4.2 We do not make decisions about you based solely on automated processing.

5. People in a handbook

5.1 Each handbook is run by an organisation (the employer). For the staff and admins in a handbook, that organisation is the controller of their personal information, such as names, email addresses, groups, sign-in records and records of which policies they have acknowledged. Where an HR consultant runs the handbook for the employer, the consultant acts on the employer's behalf.

5.2 We process this information only to provide the handbook, on the organisation's instructions and under our data processing terms. The organisation's own privacy notice for its staff explains how it uses this information.

5.3 If you are a member of staff and want to access, correct or delete information held in your handbook, please contact your employer. If you contact us, we will pass your request to them and help them respond.

6. Who we share it with

6.1 We share personal information only with service providers who help us run Handbook Portal, under contracts that protect it:

6.2 We may also share information if the law requires it, to protect our rights or others' safety, or with a buyer if Handbook Portal or our business is sold (in which case this notice will continue to apply).

7. International transfers

Some of our providers store or process information outside the UK, including in the United States (for example, our hosting provider). Where this happens, we make sure the transfer is protected by an adequacy decision or appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework.

8. How long we keep it

9. How we protect it

We use appropriate technical and organisational measures, including encrypted connections (HTTPS), hashed passwords, limits on repeated sign-in attempts, separation of each handbook's information, restricted access for our own staff, and regular backups. No system is completely secure, but we work to keep the risk low and will act quickly if something goes wrong.

10. Your rights

You have the right to:

• access the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information, or to restrict how we use it, in certain circumstances;
• object to our use of your information based on legitimate interests, and to direct marketing at any time;
• receive your information in a portable format (data portability), where this applies;
• withdraw consent, where we rely on consent.

To use any of these rights, email [email protected]. We will respond within one month. For information held in a handbook, see section 5.3.

11. Complaints

11.1 If you are unhappy with how we have handled your personal information, you have the right to complain to us. Under the Data (Use and Access) Act 2025, we will make it easy for you to do so: email [email protected] or write to us at the address above. We will acknowledge your complaint within 30 days and respond without undue delay.

11.2 If you are not satisfied with our response, you can complain to the Information Commissioner's Office:

12. Changes to this notice

We may update this notice from time to time. The date at the top shows when it last changed. If we make significant changes that affect account holders, we will tell you by email or in your workspace.