Policy
Privacy & AI
Who we are
Hunter and Young Limited is a management consultancy providing HR services to employers across the United Kingdom. We are registered in England and Wales under company number 11672964.
For anything in this notice, write to satpal@hunterandyoung.co.uk or to Carleton House, 266–268 Stratford Road, Shirley, B90 3AD.
When we are the controller, and when we are not
This distinction decides who you should contact, so it comes first.
We are the controller
For our own business contacts: people who enquire about our services, the people we deal with at client organisations, suppliers, and applicants for roles at Hunter and Young. We decide why and how that data is used, and this notice describes it.
We are usually the processor
For the personal data of our clients' employees. When we advise on a grievance, run a redundancy consultation, investigate a complaint or handle a TUPE transfer, we act on our client's documented instructions. Your employer remains the controller and its own privacy notice governs that data. If you are an employee of one of our clients and you want to exercise your rights, contact your employer first. You may still contact us and we will pass your request to them.
What we collect, and why
If you enquire or become a client
Name, employer, job title, email address, telephone number, and whatever you choose to tell us about your situation. We use it to answer you, to provide the service, and to keep records of the advice we have given. The lawful basis is performance of a contract, or our legitimate interest in responding to an enquiry before a contract exists.
If you are an employee of a client
Whatever the engagement requires, which commonly includes employment records, correspondence, meeting notes, and in employee relations work information about health, sickness absence, alleged misconduct or grievances. Where that includes special category data or data about criminal allegations, our client relies on the employment, social security and social protection condition in Article 9 and Schedule 1 of the Data Protection Act 2018, and we process it on their instructions.
If you visit this website
This site sets no cookies, runs no analytics, and does not track you. It loads two typefaces from Google Fonts, which means Google receives your IP address in order to serve the font files.
The enquiry form on our contact page is handled by Netlify, who host this website. What you type is stored in our account with them and we are notified of it by email. Netlify act only on our instructions and do not use it for anything of their own. We use it to answer you, and nothing else. If you would rather not use a form, write to us directly at the address above.
How we use artificial intelligence
We use AI tools in parts of our work, and we would rather tell you plainly than leave you to wonder.
What we use it for
- Drafting. First drafts of policies, letters, templates and reports, which a consultant then reviews and edits.
- Research. Summarising legislation, guidance and case law so that we can find the relevant point faster. We verify anything we rely on against the source.
- Administration. Note taking, scheduling, summarising our own internal records.
- Taking sales enquiries. An AI agent answers calls about working with us, takes the details and passes them to a consultant. Described in full below.
What we do not use it for
- We do not let an AI tool decide anything about a person. Dismissals, grievance outcomes, disciplinary sanctions, selection for redundancy and recruitment decisions are made by people, and the decision always rests with our client.
- We do not send a document to a client that a consultant has not read in full.
- We do not put client or employee personal data into public or consumer AI tools. We use a range of AI tools rather than one, and we do not list them individually here because that list changes. What does not change is the condition: every account we use is a business account configured so that what we put into it is not used to train anybody's model.
- We do not use AI to profile individuals or to score them.
Automated decision making
We do not carry out automated decision making that produces legal effects or similarly significant effects on you within the meaning of Article 22 of the UK GDPR.
When you call us
Calls about working with us are answered by an AI agent. It tells you at the start of the call that you are speaking to an AI and that the call is recorded. It takes what you tell us about your enquiry and passes it to a consultant, who reads it and comes back to you. It is there to make sure a call is never missed, not to decide anything: it does not assess you, price the work, or give you advice.
The call is recorded and transcribed so we have an accurate record of what you asked for. Recordings and transcripts are deleted after 30 days, and are used for nothing beyond answering your enquiry. If the enquiry becomes a piece of work, the details we need are written into the client file in the ordinary way, and the recording and transcript are still deleted on the same timetable.
If you would rather not speak to an AI agent at all, email us at the address above and a person will reply.
Meetings and notes
We occasionally use an AI tool to record a meeting and turn it into notes and a summary. We tell you at the start when we are going to do it. The recording is deleted once the notes are written, and access to it in the meantime is limited to the people who were in the meeting. It goes no further than that, and it is never used for anything other than writing up what was said.
Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing. We share it only where the work requires it, for example with a client's legal advisers, with Acas during early conciliation, or with an employment tribunal.
We rely on service providers too: the companies that host our email and files, run our business systems, provide the AI tools described above, and keep our accounts. Each is bound by a written contract that limits them to acting on our instructions.
Some of those providers store or access data outside the United Kingdom, in the European Economic Area and the United States. Transfers to the European Economic Area are covered by the UK adequacy regulations. For transfers to the United States and elsewhere we rely on the UK International Data Transfer Addendum to the standard contractual clauses, or on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it.
How long we keep it
We delete client data when the piece of work it belongs to finishes. The exception is anything we are required to keep for a legal, regulatory or compliance reason, which we keep for as long as that reason lasts and no longer.
Recordings and transcripts of calls answered by our AI agent are deleted after 30 days, whether or not the enquiry goes anywhere.
We would rather not hold your data than hold it in case it is useful one day. If you want to know what we still have, ask.
Your rights
Where we are the controller you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we act as processor for your employer, those requests go to them and we will help them answer.
We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data, tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
This is version 1.1. Version 1.1 added the section on calls answered by our AI agent, and the 30 day deletion of call recordings and transcripts. If we change how we use personal data again we will update this notice and change the version and date at the top of the page.