Privacy Notice

Last updated: 5th October 2026

1. Introduction

Bright Sky HR Ltd respects your privacy and is committed to protecting your personal data.

This privacy notice explains how we collect and use your personal data when you visit our website, contact us, subscribe to our emails, download one of our resources, purchase or use one of our products or services, attend an event or programme, or otherwise interact with us.

Our website is https://brightskyhr.co.uk.

Bright Sky HR Ltd is the data controller responsible for your personal data.

Our details are:

Bright Sky HR Ltd
Company number: 10118747
Registered office: 2A The Quadrant, Epsom, Surrey, KT17 4RH
Email: hello@brightskyhr.co.uk

If you have any questions about this privacy notice or how we use your personal data, please contact us using the email address above.

Please let us know if the personal information we hold about you changes so that we can keep our records accurate and up to date.

2. The personal data we collect

Personal data means any information that identifies you, or that could be used to identify you.

Depending on how you interact with us, we may collect and use the following types of personal data:

Identity Data
This may include your name, title and other information you provide to identify yourself.

Contact Data
This may include your email address, telephone number, postal address, billing address and delivery address.

Transaction Data
This may include details of products and services you have purchased, payments made and other information relating to transactions with us.

Payments are generally processed for us by third-party payment providers. We would not normally receive or store your full payment card details.

Profile Data
This may include information relating to products, services, programmes or resources you have purchased, registered for or used, your preferences, feedback, survey responses and information you choose to provide when working with us.

Marketing and Communications Data
This may include your preferences about receiving emails and other communications from us, as well as information about your interactions with those communications.

Technical Data
This may include your IP address, browser type and version, device information, operating system, time zone, approximate location and other technology you use to access our website.

Usage Data
This may include information about how you use our website, emails, products and services.

We may also use aggregated or anonymised information for reporting, analysis and improving our business. Where information has been properly anonymised so that it can no longer identify you, it is not personal data.

Special category data

Certain types of personal data receive additional protection under data protection law. These include information about health, race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric information, sex life and sexual orientation.

We do not generally ask you to provide special category data.

However, because some of our services involve coaching, professional development and discussions about work and career experiences, you may choose to share information with us that falls within one of these categories, for example information about your health.

Where we need to process special category data, we will only do so where permitted by law and where an appropriate additional legal condition applies.

We do not intentionally collect information about criminal convictions or offences unless there is a specific and lawful reason to do so.

3. How we collect your personal data

We collect personal data in several ways.

Information you give us directly

You may provide personal data when you:

• contact us by email, telephone, through our website or through social media;
• enquire about or purchase one of our products or services;
• book a call or appointment;
• take part in coaching, a programme, course, workshop, webinar or event;
• subscribe to our HR Coffee Time emails or other email communications;
• download a free resource;
• complete a form, questionnaire or survey;
• register for an online session or event;
• provide feedback or a testimonial; or
• otherwise communicate or work with us.

Information collected automatically

When you use our website, certain Technical Data and Usage Data may be collected automatically through cookies, server logs and similar technologies.

You can find more information in our Cookie Policy.

Information received from other organisations

We may receive personal data from third parties where this is necessary and lawful.

These may include:

• payment providers such as Stripe;
• sales and checkout platforms such as ThriveCart;
• appointment booking providers;
• email and marketing platforms such as Kit;
• online programme and course platforms such as MemberVault;
• accounting providers such as Xero;
• event, video conferencing and form providers such as Zoom and Jotform;
• analytics, advertising or social media platforms;
• professional advisers and service providers;
• referral partners or organisations that introduce you to us; and
• publicly available sources such as LinkedIn and company websites.

The Essential HR Planner

The physical edition of The Essential HR Planner may be sold and fulfilled by a third-party printing and fulfilment provider, such as Summit Print.

Where the third-party provider is responsible for taking your order, payment and delivering your planner, it will process your information in accordance with its own privacy notice.

We may receive limited information about your purchase, such as your name and email address, where this is necessary to provide planner-related information, bonuses or benefits associated with your purchase, or where you have agreed to receive further communications from us.

Choosing to receive our marketing emails is separate from purchasing the planner. You can unsubscribe from marketing emails at any time.

4. How and why we use your personal data

We will only use your personal data where we have a lawful basis for doing so.

The main lawful bases we rely on are:

Contract
Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.

Legitimate interests
Where processing is necessary for the legitimate interests of our business or a third party, provided your interests and fundamental rights do not override those interests.

Legal obligation
Where we need to process personal data to comply with the law.

Consent
Where you have given us clear consent to process your personal data for a particular purpose.

Responding to enquiries

We may use your Identity Data and Contact Data to respond when you contact us, answer questions about our products or services, or discuss potentially working together.

Our lawful basis is our legitimate interest in responding to enquiries and, where relevant, taking steps at your request before entering into a contract.

Providing products and services

We may use your Identity Data, Contact Data, Transaction Data and Profile Data to provide products, coaching, programmes, courses, workshops, resources and other services you have requested or purchased.

We may also use this information to communicate with you about the product or service and manage our relationship with you.

Our lawful basis is usually the performance of a contract with you.

Administering programmes, events and sessions

We may use your Identity Data, Contact Data and Profile Data to register you for and communicate with you about coaching sessions, programmes, workshops, webinars, planning sessions and other events or activities.

Our lawful basis may be performance of a contract, taking steps at your request before entering into a contract, or our legitimate interest in administering an activity you have requested.

Processing payments and maintaining business records

We may use Identity Data, Contact Data and Transaction Data to process payments, issue invoices, keep accounting records and meet our financial, tax and legal obligations.

Our lawful bases are performance of a contract, compliance with our legal obligations and our legitimate interest in managing our business.

Sending service-related communications

We may contact you with information that is necessary in connection with a product or service you have purchased or registered for.

For example, we may send appointment information, joining instructions, programme updates, information about planner benefits or important changes affecting a service.

These are service communications rather than marketing emails.

Our lawful basis may be performance of a contract or our legitimate interest in providing and administering the relevant product or service.

Sending marketing communications

Where appropriate, we may send you emails about HR Coffee Time, useful resources, events, products, services, programmes and other information we think may be relevant to you.

Where the law requires us to obtain your consent before sending marketing emails, we will do so.

In some circumstances, data protection and electronic marketing law may allow us to send marketing communications without specific consent, for example in certain existing customer or business-to-business situations. Where we rely on legitimate interests, we will consider your rights and expectations before doing so.

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in an email or by contacting hello@brightskyhr.co.uk.

Unsubscribing from marketing does not prevent us from contacting you where necessary in relation to a product or service you have purchased or requested.

Managing and improving our website and business

We may use Technical Data, Usage Data and other relevant information to:

• operate and maintain our website;
• keep our website and systems secure;
• troubleshoot technical problems;
• understand how our website, emails, products and services are used;
• measure and improve the effectiveness of our content and communications; and
• improve and develop our products, services and business.

Our lawful basis is our legitimate interest in operating, protecting, understanding and improving our business.

Where consent is required for cookies or similar technologies, we will ask for that consent.

Asking for feedback

We may contact you to ask for feedback about a product, service, programme or other experience with us.

Our lawful basis is our legitimate interest in understanding our customers’ and clients’ experiences and improving what we provide.

Protecting our business and legal rights

We may use personal data where necessary to establish, exercise or defend legal claims, resolve disputes, recover money owed to us, prevent fraud or protect our business.

Our lawful basis is our legitimate interest in protecting our business and legal rights and, where relevant, compliance with legal obligations.

5. Marketing choices

We want you to have control over the marketing communications you receive from us.

Where you have consented to receiving marketing emails, you can withdraw that consent at any time.

You can unsubscribe by:

• clicking the unsubscribe link at the bottom of one of our marketing emails; or
• emailing hello@brightskyhr.co.uk.

Withdrawing consent or unsubscribing will not affect the lawfulness of any processing that took place before you did so.

We may keep a minimal record of your email address after you unsubscribe so that we can respect your choice and make sure you are not accidentally added back to marketing communications.

6. Sharing your personal data

We may share your personal data with trusted third parties where this is necessary for the purposes described in this notice.

These may include:

• website, hosting and IT service providers;
• email and marketing platforms such as Kit;
• payment providers such as Stripe;
• checkout and sales platforms such as ThriveCart;
• accounting providers such as Xero;
• online programme and course platforms such as MemberVault;
• video conferencing and event providers such as Zoom;
• form and survey providers such as Jotform;
• appointment booking providers;
• file storage and document management providers;
• printing, postage and fulfilment providers where relevant;
• analytics and website service providers;
• professional advisers including accountants, lawyers and insurers;
• HM Revenue & Customs, regulators, courts and other authorities where required by law; and
• a prospective buyer, seller or adviser if we sell, transfer or restructure all or part of our business.

We only share personal data where we have an appropriate reason to do so.

Where a supplier processes personal data on our behalf, we require it to handle that information appropriately and in accordance with applicable data protection law.

Some organisations we work with may act as independent data controllers for the information they receive, rather than processing it solely on our behalf. Where that is the case, their own privacy notice will explain how they use your information.

We do not sell your personal data.

7. International transfers

Some of the companies we use to provide technology and other services operate internationally. This means that your personal data may sometimes be processed or stored outside the UK.

Where personal data is transferred internationally, we take appropriate steps to ensure that the transfer complies with UK data protection law.

Depending on the circumstances, this may include:

• transferring information to a country or organisation covered by UK adequacy regulations;
• using an approved international data transfer agreement or UK addendum and carrying out any required risk assessment;
• relying on another safeguard permitted by UK data protection law; or
• where applicable, transferring personal data to an eligible US organisation participating in the UK Extension to the EU-US Data Privacy Framework.

You can contact us at hello@brightskyhr.co.uk if you would like further information about the safeguards used for a particular international transfer.

8. Data security

We take appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure or misuse.

Access to personal data is limited to people and organisations that have a legitimate business need to access it.

We also have procedures for responding to suspected personal data breaches and will notify affected individuals and the Information Commissioner’s Office where we are legally required to do so.

9. How long we keep your personal data

We keep personal data only for as long as we reasonably need it for the purposes for which it was collected, including meeting legal, accounting, tax and reporting requirements.

The period will depend on the type of information and why we hold it.

For example:

• financial, transaction and accounting information will normally be retained for at least six years where this is required for tax and accounting purposes;
• information relating to a contract or client relationship may be retained for an appropriate period after the relationship ends in case it is needed to deal with queries or legal claims;
• marketing information may be retained while you remain subscribed and we may retain limited suppression information after you unsubscribe so that we can respect your preferences;
• information provided through enquiries that do not lead to a client or customer relationship will be retained only for as long as we reasonably need it; and
• information held within third-party systems may be subject to the retention settings and backup arrangements of those providers.

When deciding how long to retain personal data, we consider the amount, nature and sensitivity of the information, the purpose for which we hold it, applicable legal requirements and the potential risks associated with keeping it.

Where appropriate, we may anonymise information so that it can no longer identify you. Anonymised information may be retained and used for statistical or analytical purposes.

10. Your data protection rights

Depending on the circumstances and the lawful basis on which we are processing your personal data, you may have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data in certain circumstances;
• request restriction of the way we process your personal data;
• object to processing of your personal data in certain circumstances;
• request data portability, where applicable;
• withdraw your consent at any time where we rely on consent; and
• raise a complaint about the way we handle your personal data.

Not all of these rights apply in every circumstance.

If you would like to exercise any of these rights, please contact us at hello@brightskyhr.co.uk.

We may need to ask you for information to confirm your identity before responding to a request. This helps us make sure that personal data is not disclosed to someone who is not entitled to receive it.

You will not normally have to pay a fee to exercise your rights. However, where permitted by law, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

We will respond to valid requests within the timescales required by data protection law.

Your right to object

You have the right to object at any time to our use of your personal data for direct marketing.

You may also have the right to object where we rely on legitimate interests as our lawful basis. If you object, we will stop processing your personal data unless we have compelling legitimate grounds to continue or the processing is necessary to establish, exercise or defend legal claims.

11. Data protection complaints

If you are concerned about how we have collected or used your personal data, please contact us at:

hello@brightskyhr.co.uk

We have a process for dealing with data protection complaints.

We will acknowledge a data protection complaint within 30 days and will take appropriate steps to investigate it without undue delay. We will keep you informed about the progress and outcome of our investigation as required by law.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.

You can find information about raising a concern with the ICO at www.ico.org.uk.

We would appreciate the opportunity to deal with your concerns directly where possible.

12. Automated decision-making

We do not currently use personal data to make decisions about you based solely on automated processing where those decisions produce legal or similarly significant effects.

If this changes, we will update this privacy notice and provide the information required by law.

13. Third-party websites

Our website and communications may contain links to websites, services or resources operated by third parties.

If you follow one of these links, the third party may collect or process information about you in accordance with its own privacy notice.

We are not responsible for the privacy practices of third-party websites and encourage you to read their privacy information before providing personal data.

14. Cookies

Our website uses cookies and similar technologies.

Some cookies are necessary for the website to work. Other cookies may be used for analytics or other purposes and, where required by law, will only be used with your consent.

You can find further information about the cookies we use and how to manage your choices in our Cookie Policy.

15. Changes to this privacy notice

We may update this privacy notice from time to time to reflect changes to our business, the services we use or applicable law.

The latest version will be published on this page and the date at the top of the notice will show when it was last updated.

Where a change significantly affects how we use your personal data, we will take appropriate steps to bring the change to your attention.