Privacy Policy

---

 Effective Date: 15th April 2025

1. Introduction
WHG ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy sets out how we collect, use, store, and safeguard your personal information when you visit our website or engage with our services. It also informs you of your privacy rights and how the law protects you.

This Privacy Policy applies to all visitors, users, clients, and prospective clients of WHG and covers all personal data collected via our website and any related communications.

2. Who We Are
WHG is a professional management consultancy providing compliance advice and support for ISO certification and related services. For the purposes of data protection legislation, WHG is the "data controller" in respect of your personal data.

If you have any questions about this policy or your personal data, you can contact us at:
Email: phil@whginfo.co.uk

3. Data We Collect
We may collect, use, store and transfer different kinds of personal data about you, including:

• Identity Data – name, job title, company name.
   
• Contact Data – email address, phone number, business address.
   
• Technical Data – IP address, browser type/version, time zone settings, device identifiers, operating system, and platform.
   
• Usage Data – information about how you use our website and services.
   
• Marketing and Communications Data – your preferences in receiving marketing from us and your communication preferences.
   
• Professional Information – including certifications held, compliance status, and audit records (where relevant to services requested).
   

We do not collect any Special Categories of Personal Data (e.g. health data, religious beliefs, etc.) unless explicitly required and lawfully justified.

4. How We Collect Your Data
We collect data using the following methods:

• Direct interactions – when you contact us via our website, email, telephone, or request our services.
   
• Automated technologies – such as cookies and analytics tools when you interact with our website.
   
• Third-party sources – including business directories, accreditation bodies, or where your organisation refers you to us.
   

5. How We Use Your Data
We will only use your personal data where legally permitted. Common uses include:

• To respond to your enquiries or requests.
   
• To provide consultancy and certification support services.
   
• To manage our relationship with you or your organisation.
   
• To comply with legal obligations.
   
• For marketing communications, where you have provided consent.
   
• To improve our website, services, and customer experience.
   

6. Legal Basis for Processing
We rely on the following lawful bases:

• Contractual Necessity – where data is required to perform a contract with you.
   
• Legitimate Interests – to run our business efficiently and improve our services.
   
• Consent – for sending marketing material or non-essential communications.
   
• Legal Obligation – where required to comply with applicable law.
   

7. Sharing Your Data
We do not sell or rent your data. We may share your personal data with trusted third parties where necessary, including:

• IT and system providers supporting our website or business operations.
   
• Professional advisers (lawyers, accountants, consultants).
   
• Accreditation or certification bodies (when required for delivery of services).
   
• Regulatory authorities, if legally obliged to do so.
   

All third parties are required to respect the confidentiality and security of your data and to process it only in accordance with applicable law.

8. International Transfers
We do not routinely transfer your personal data outside the UK. If we do, appropriate safeguards will be in place (e.g. Standard Contractual Clauses or UK adequacy regulations) to ensure your data is protected.

9. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes we collected it for, including legal, accounting or reporting requirements. Typically, we retain client-related data for up to 7 years.

10. Your Rights
You have the following rights under UK data protection law:

• Right to access your personal data.
   
• Right to rectification if your data is inaccurate or incomplete.
   
• Right to erasure (‘right to be forgotten’).
   
• Right to restrict or object to processing.
   
• Right to data portability.
   
• Right to withdraw consent (where applicable).
   
• Right to lodge a complaint with the Information Commissioner’s Office (ICO).
   

To exercise your rights, please contact us using the details above.

11. Security
We implement appropriate technical and organisational measures to secure your personal data from unauthorised access, alteration, disclosure, or destruction.

12. Cookies
Our website uses cookies to enhance your user experience. You can control or disable cookies through your browser settings. Please refer to our [Cookie Policy] for more details.

13. Changes to This Policy
We may update this policy from time to time. Any changes will be posted on this page and, where appropriate, notified to you by email. Please check this page regularly to stay informed.