Privacy Policy
Introduction
At Howard Lock Consulting Ltd (“we”, “us”, “our”), we respect your privacy. This Privacy Policy explains what personal data we collect on howardlockconsulting.com, how we use it, and the choices you have.
We comply with UK data protection law, including the UK GDPR, the Data Protection Act 2018 and other relevant UK privacy rules. You can learn more about your rights on the Information Commissioner’s Office (ICO) website.
Who We Are (Data Controller)
Howard Lock Consulting Ltd is the data controller for personal data processed via this Website.
- Company Name: Howard Lock Consulting Ltd
- Company Number: 11347465
- Registered Office: C/O Contrast Accounting Unit E4 Arena Business Centre, Holyrood Close, Poole, Dorset, United Kingdom, BH17 7FP
- VAT Number: 316637401
- ICO Registration Number: C1535912
- Website: howardlockconsulting.com
- Email: info@howardlockconsulting.com
- Phone: 07725 219 270
- Contact Page: howardlockconsulting.com/contact/
We have appointed a Data Protection Officer (“DPO”) who is responsible for overseeing questions about this policy and our privacy practices.
- DPO Email: info@howardlockconsulting.com
- DPO Postal Address: Howard Lock Consulting Ltd, C/O Contrast Accounting Unit E4 Arena Business Centre, Holyrood Close, Poole, Dorset, United Kingdom, BH17 7FP
Personal Data We Collect
We may collect, use, store and transfer different kinds of personal data depending on how you use our Website and services.
- Identity Data: First name, last name, title, date of birth, gender, username or similar identifier, and any other identity details you provide.
- Contact Data: Billing address, delivery address, email address, telephone number and other contact details.
- Recruitment, CV And Profile Data: Information you provide when applying for opportunities, submitting a CV, business resume or cover letter, creating an account, using our services, sharing preferences, giving feedback or completing surveys.
- Special Category Data: Information such as health, disability, race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic data or biometric data, where this is relevant and lawfully required for our services. We only process this type of data where we have a valid lawful basis, such as your explicit consent or where it is needed for contractual obligations.
- Financial Data: Bank account, payment card or payment-related details, where relevant. This is usually collected only from recruiter or end-hirer customers making a purchase.
- Transaction Data: Details about payments to and from you and services purchased from us.
- Marketing And Communications Data: Your preferences for receiving marketing from us and your communication preferences.
- Usage Data: Information about how you use our Website and services, including pages viewed, time on page, clicks and diagnostic data.
- Technical Data: IP address, browser type and version, device information, time zone setting, operating system, platform and similar technical information.
- Security & Anti-Spam Data: Technical data collected by security tools, including Cloudflare Turnstile if used, to verify legitimate traffic and reduce spam.
- Transactional/Service Data: Records of enquiries, accounts, services, orders, placements, invoices, support requests and communications.
- Aggregated Data: Statistical or demographic data that does not directly identify you. If we combine aggregated data with personal data in a way that can identify you, we treat it as personal data.
- Cookies and Similar Technologies: See our Cookie Policy for specific cookies and controls.
How We Use Personal Data & Lawful Bases
We only use your data when we have a lawful basis. The table below shows the main ways we use personal data.
| Purpose | Examples | Lawful Basis | Retention |
|---|---|---|---|
| Respond To Enquiries | Reply to contact forms, emails, calls and messages | Legitimate Interests (to respond); Pre-contractual Steps | Up to 24 months after last contact, unless you become a customer, candidate, associate, recruiter or end-hirer |
| Register You As A Website User Or Customer | Create or manage your account, where account functionality is available | Contract; Pre-contractual Steps | For as long as your account is active and then for as long as reasonably needed for legal, regulatory or business purposes |
| Provide Recruitment, Consultancy Or Related Services | Assess your suitability, manage applications, promote your CV or business resume for relevant roles, communicate with recruiters or end-hirers | Contract; Pre-contractual Steps; Legitimate Interests; Explicit Consent where required for Special Category Data | For as long as reasonably needed to provide the service. We may periodically ask associates or candidates whether they want us to keep their details for future opportunities |
| Share Candidate Or Associate Details With Recruiters Or End-Hirers | Sharing CVs, business resumes, application information and relevant profile details for suitable roles or opportunities | Contract; Legitimate Interests; Explicit Consent where required | For as long as reasonably needed for the role, placement, opportunity or service relationship |
| Process Orders And Payments | Manage purchases, payments, invoices, fees, charges and debt recovery | Contract; Legal Obligation; Legitimate Interests (to recover money owed) | Usually 6 years for tax, accounting and contract records |
| Manage Our Relationship With You | Notify you about changes to our services, terms, policies, records or account information | Contract; Legal Obligation; Legitimate Interests | For as long as reasonably needed for the relationship and our legal or business records |
| Marketing And Service Updates | Send relevant updates, service information, opportunities or marketing communications where permitted | Legitimate Interests; Consent where required by law | Until you opt out, or until we no longer reasonably need the data for this purpose |
| Social Media Outreach | Contacting recruiters or end-hirers via social media messaging channels about our services | Legitimate Interests, where permitted under PECR and data protection rules | For as long as reasonably needed to manage the communication, unless you ask us to stop |
| Analytics (Consent) | Google Analytics 4 via Consent Mode, where installed | Consent, which you can withdraw at any time | As per Cookie Policy, usually up to 2 years for _ga cookies |
| Advertising & Conversions (Consent, If Installed) | Google Ads conversions; Meta Pixel; LinkedIn Ads; Reddit Ads; TikTok Ads | Consent | As per Cookie Policy and platform settings |
| Security, Anti-Spam And Website Administration | Hosting, troubleshooting, testing, system maintenance, support, reporting, fraud prevention, security logs and bot protection | Legitimate Interests (to run and protect our business and Website); Legal Obligation | Up to 12 months for routine logs, unless needed to investigate an issue, legal claim or security incident |
| Handle Data Protection Requests Or Complaints | Responding to privacy rights requests, data concerns or complaints | Legal Obligation; Legitimate Interests | For as long as reasonably needed to handle the request or complaint and keep appropriate records |
Where We Get Data From
- Directly From You: When you submit a form, create an account, email us, call us, upload a CV or business resume, apply for services, make a purchase, subscribe to updates, give feedback or otherwise contact us.
- Automated: Cookies, analytics, log files, security tools and similar website technologies.
- Third Parties And Public Sources: Analytics providers, payment providers such as Stripe, recruiters, end-hirers, technical service providers, Companies House, the Electoral Register and other public or professional sources where relevant.
Third-Party Links
Our Website may include links to third-party websites, plug-ins, platforms and applications. If you click those links or use those services, third parties may collect or share data about you.
We do not control third-party websites and are not responsible for their privacy policies. When you leave our Website, we recommend reading the privacy policy of the website or platform you visit.
Who We Share Data With
We share data only when necessary.
- Recruiters And End-Hirers: Where relevant to our services, we may share CVs, business resumes, application information and profile details with recruiters or end-hirers who may be interested in your skills or experience.
- Website & Hosting: Our hosting provider(s), CDN provider(s), website support providers and IT service providers.
- Security & Bot Protection: Cloudflare Turnstile, where used, to verify legitimate traffic and prevent spam submissions.
- Forms & Email Delivery (If Used): WPForms for form handling and Postmark for transactional email.
- Payments (If Used): Stripe or other payment providers where payment processing is required.
- Analytics (If You Consent): Google Analytics 4 via Consent Mode.
- Ads/Attribution (If You Consent): Google Ads conversions, Meta Pixel, LinkedIn Ads, Reddit Ads and TikTok Ads.
- Social Media Platforms: Platforms such as LinkedIn, where we communicate with you or where you interact with our profiles.
- Professional Services: Accountants, lawyers, bankers, insurers, auditors or other advisers where required.
- Legal/Compliance: HM Revenue & Customs, law enforcement, regulators or other authorities where the law requires.
- Business Transfers: Third parties if we sell, transfer or merge part of our business or assets.
We do not sell your personal data.
Where recruiters or end-hirers receive CVs, business resumes or application details, they are responsible for handling that personal data lawfully and securely.
Marketing And Opting Out
We may send you marketing communications if you have requested information from us, used our services, purchased services from us, or where we have another lawful basis to contact you.
We will ask for your consent where the law requires it, including before sharing your personal data with third parties for their own marketing purposes.
You can ask us to stop sending marketing messages at any time by contacting us at info@howardlockconsulting.com or by using our Contact Page.
If you opt out of marketing, we may still contact you about service, account, legal, contractual or transactional matters.
International Transfers
Some providers, including cloud, hosting, payment, analytics, advertising, CDN and security services, may process data outside the UK/EEA.
Where this happens, we rely on recognised safeguards such as international data transfer agreements or standard contractual clauses, together with risk assessments and technical measures where appropriate.
How We Keep Data Secure
We use administrative, technical and physical safeguards to protect personal data. This includes:
- HTTPS encryption on all pages
- Secure hosting, CDN and website infrastructure
- Bot protection using Cloudflare Turnstile, where used
- Access controls and confidentiality measures
- Regular security reviews
- Procedures for handling suspected personal data breaches
No method of transmission or storage is 100% secure, but we work to reduce risk.
How Long We Keep Data
We keep data only as long as necessary for the purposes described in this policy, or to meet legal, regulatory, tax, accounting or reporting requirements.
For invoices, contracts and tax records, we usually retain data for at least 6 years.
We may keep personal data for longer if needed for a complaint, legal claim, regulatory matter, debt recovery or ongoing service relationship.
If you are an associate, candidate, recruiter or end-hirer, we may periodically ask whether you want us to keep your details for future opportunities or services.
In some circumstances, we may anonymise personal data so it can no longer identify you. We may then use this anonymised information for research or statistical purposes.
Your Privacy Rights
You have rights over your personal data, including:
- Access to the personal data we hold about you
- Correction of inaccurate or incomplete data
- Erasure of your personal data in certain circumstances
- Restriction of processing in certain circumstances
- Objection to processing, including direct marketing
- Data portability, where applicable
- Withdrawal of consent, where consent is the lawful basis
To exercise these rights, please contact our DPO at info@howardlockconsulting.com or use the Contact Page.
We may need to verify your identity before responding. You will not usually have to pay a fee, but we may charge a reasonable fee or refuse a request if it is clearly unfounded, repetitive or excessive.
We try to respond to legitimate requests as soon as possible. If your request is complex, or if you have made several requests, it may take longer. In that case, we will let you know and keep you updated.
Data Protection Complaints
If you’re unhappy with how we’ve handled your personal data, you can make a data protection complaint to us.
This might include concerns about how we collect, use, store, share, update or delete your personal information.
Please contact us using the details on this Website and include Data protection complaint in your message.
Please include:
- Your name
- Your contact details
- A clear description of your concern
- Any relevant dates, emails, forms, screenshots or other information
- What you’d like us to do to help resolve it
Please do not send sensitive personal information unless it is needed for your complaint.
We’ll acknowledge your complaint within 30 days. We’ll then look into it and respond without undue delay. If the matter is complex, or if we need input from a recruiter, end-hirer, supplier or third-party platform, we’ll let you know and keep you updated.
You can read our full procedure here: Data Protection Complaints Procedure.
We may keep a record of your complaint, our investigation, our response and any action we take. We’ll only keep complaint records for as long as we reasonably need them for legal, regulatory and business purposes.
Cookies
For details of cookies and how to manage your preferences, see our Cookie Policy.
Analytics and advertising tags only load after you consent via the banner, where those tools are installed.
Children’s Data
Our Website is not intended for anyone under the age of 18. We do not knowingly collect children’s personal data. If you believe a child has provided data, please contact us so we can delete it.
Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects about you.
Contact Us
If you have any questions about this policy, your privacy rights or how we use your data, please contact us:
- Email: info@howardlockconsulting.com
- Phone: 07725 219 270
- Contact Page: howardlockconsulting.com/contact/
- Postal Address: Howard Lock Consulting Ltd, C/O Contrast Accounting Unit E4 Arena Business Centre, Holyrood Close, Poole, Dorset, United Kingdom, BH17 7FP
Your Right To Complain To The ICO
If you’re not satisfied with our response to a data protection complaint, you can complain to the UK data protection regulator, the Information Commissioner’s Office (ICO).
Visit ico.org.uk/make-a-complaint or call 0303 123 1113.
Changes To This Policy
We may update this policy to reflect changes in our processing or legal requirements. We will update the “Last Updated” date below and, where appropriate, notify you via the Website.
Last Updated
May 12, 2026
Howard Lock Consulting Ltd (howardlockconsulting.com)