Legal
Last updated
Sow HR understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone who visits this website, sowhr.com (“Our Site”), and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.
Please read this Privacy Policy carefully and ensure that you understand it. Your acceptance of this Privacy Policy is requested when you submit the contact form on Our Site.
Our Site is owned and operated by Sow HR Ltd, a private limited company registered in England under company number 17152926.
This Privacy Policy applies only to your use of Our Site and explains how any personal data collected through Our Site is used, as well as your rights and how to raise concerns or complaints.
Personal data is defined by the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 and other applicable legislation relating to data protection and privacy (“the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:
For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details in Part 11.
It is important that your personal data is kept accurate and up to date. If any of the personal data we hold about you changes, please keep us informed as long as we have that data.
Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.
If you have any cause for complaint about our use of your personal data, you have the right to complain to us using the contact details provided in Part 11. We will do our best to resolve your complaint. We will acknowledge your complaint within 30 days and will respond to it without undue delay. You also have the right to lodge a complaint with the Information Commissioner’s Office.
Depending upon your use of Our Site, we may collect and hold some or all of the personal data set out in the table below, using the methods also set out in the table. We do not collect any ‘special category’ or ‘sensitive’ personal data, personal data relating to children, or data relating to criminal convictions and/or offences. We also confirm that we do not use analytics or similar tracking technologies on Our Site.
| Data Collected | How We Collect the Data |
|---|---|
| Identity information including your name. | Submitted by you directly through the contact form on Our Site. |
| Contact information including your email address. | Submitted by you directly through the contact form on Our Site. |
| Business information including any details of your business that you choose to include in your message. | Submitted by you directly through the contact form on Our Site. |
| The content of your enquiry, including the subject line and message. | Submitted by you directly through the contact form on Our Site. |
Our Site is protected by a content delivery and security service which processes technical information, including your IP address, in order to keep the site available and to protect it from malicious traffic. This is described further in Part 8.
Under the Data Protection Legislation, we must always have a lawful basis for using personal data. The following table describes how we may use your personal data, and our lawful bases for doing so:
| What We Do | What Data We Use | Our Lawful Basis |
|---|---|---|
| Responding to your enquiry and communicating with you about it. | Identity, contact and business information, and the content of your enquiry. | Taking steps at your request prior to entering into a contract. |
| Supplying our services to you, if you go on to become a client. | Identity, contact and business information, and the content of your enquiry. | Performance of a contract. |
| Keeping a record of enquiries in order to administer our business and provide continuity of service. | Identity, contact and business information, and the content of your enquiry. | Legitimate interests, namely the effective administration of our business and being able to refer back to previous correspondence. |
| Keeping Our Site secure and available. | Technical information including IP address. | Legitimate interests, namely protecting Our Site and its visitors from malicious traffic. |
We do not send marketing emails or newsletters, and we will not use your details to contact you about anything other than your enquiry unless you ask us to.
We will only use your personal data for the purpose or purposes for which it was originally collected unless we reasonably believe that another purpose is compatible with that original purpose and need to use your personal data for that purpose. If we need to use your personal data for an unrelated purpose, we will inform you and explain the legal basis which allows us to do so.
We will not keep your personal data for any longer than is necessary in light of the reason or reasons for which it was first collected.
| Type of Data | How Long We Keep It |
|---|---|
| Enquiries that do not lead to us working together, including your name, email address and message. | 12 months from your last contact with us, after which the enquiry is deleted. |
| Records relating to clients, including correspondence. | 6 years from the end of our working relationship, in line with the limitation period for contractual claims and HMRC record-keeping requirements. |
| Technical information including IP address, processed by our security provider. | Retained by that provider for a short period only, as described in Part 8. |
We use a small number of service providers to operate Our Site and to receive enquiries submitted through it: a website hosting provider, a content delivery and security provider, a service that delivers contact form submissions to our inbox, and our business email provider. Each acts as a data processor on our behalf and may only process your personal data on our instructions.
Some of these providers are based in, or have parent companies in, the United States, so your personal data may be transferred outside the UK. Where that happens we rely on those providers’ use of UK International Data Transfer Agreements, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision, so that your personal data is treated just as safely and securely as it would be within the UK.
The security of your personal data is essential to us, and to protect your data we take a number of important measures, including the following:
We will not share any of your personal data with any third parties for any purposes, subject to the following exceptions.
We share personal data with the service providers described in Part 8, purely so that Our Site can operate and so that your enquiry reaches us. They may only process your personal data on our instructions.
If we sell, transfer, or merge parts of our business or assets, your personal data may be transferred to a third party. Any new owner of our business may continue to use your personal data in the same ways that we have used it, as specified in this Privacy Policy.
In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.
All subject access requests should be made in writing and sent to the email or postal address shown in Part 11. There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.
We will respond to your subject access request within one month of receiving it. In some cases, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.
To contact us about anything to do with your personal data and data protection, including to make a subject access request or a data protection complaint, please use the following details:
We may review and update this Privacy Policy from time to time to ensure continued compliance with the law and best practice. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.
Any changes will be immediately posted on Our Site and you will be deemed to have accepted the terms of the Privacy Policy on your first use of Our Site following the alterations. We recommend that you check this page regularly to keep up to date.