Privacy Policy.

HR Hues (“HRH,” “we,” “us”) provides HR and advisory services to clients with teams around the world. This Privacy Policy explains how we collect, use, disclose, and protect personal information when we act as a controller under laws such as the EU/UK GDPR (including Germany’s BDSG), California CCPA/CPRA, Canada’s PIPEDA, Brazil’s LGPD, India’s Digital Personal Data Protection Act (DPDP Act), and similar data protection laws in other regions where we operate.

1. Information We Collect

We may collect the following categories of personal information:

• Identification and contact data: name, business title, company, business email, business phone, postal address.

• Account and portal data: login credentials for our client portal (business email, password you set), and usage activity within the portal. We never see your full password; it is stored in hashed form.

• Newsletter data: email address and related subscription preferences when you sign up to receive our newsletter or updates.

• Billing and transaction data: invoicing details and limited payment-related information processed via our payment providers; we do not store full credit card numbers.

• Technical and usage data: IP address, device identifiers, browser type, operating system, pages visited, timestamps, and cookie identifiers on our website and portal.

• Any other information you choose to provide via forms, email, meetings, or surveys.

2. How We Use Your Information

We use personal information only for specific and legitimate purposes, including:

• To create and manage client portal accounts, authenticate users, and secure access to client materials.

• To deliver and manage our consulting and advisory services for you and your organization.

• To send you newsletters or updates when you subscribe, and to manage your subscription (you can unsubscribe at any time via the link in each email).

• To operate, secure, and improve our website, client portal, and services, including analytics on how our site and portal are used.

• To comply with legal, regulatory, tax, and accounting obligations, to exercise or defend legal claims, and to respond to lawful requests from authorities.

Where required by law, we rely on legal bases such as: performance of a contract (for client work and portal access), legitimate interests (for running and securing our services, preventing abuse, improving our offerings), compliance with legal obligations, and your consent where applicable (for example, for certain cookies or newsletters).

3. Cookies and Similar Technologies

Our website and client portal use cookies and similar technologies to:

• Make the site and portal function (for example, keeping you logged in, security, load balancing).

• Understand how visitors and clients use our site and portal, so we can improve content and performance.

• Remember your preferences, including cookie choices.

The cookie banner provided by our website platform informs you about the use of cookies and allows you to accept or reject non essential cookies, in line with applicable law. You can also manage cookies through your browser settings, which may allow you to delete or block cookies altogether; if you do so, some features of the site or portal may not function properly.

4. International Transfers

HRH is based in the United States and may process personal information in the US and other countries where our clients, partners, or service providers are located, including Canada, the European Economic Area (EEA), the UK (including Germany), India, Brazil, and other parts of Asia.

When we transfer personal information from jurisdictions that restrict cross border transfers, we use appropriate safeguards permitted by law, such as standard contractual clauses, data processing agreements, or other legally recognized transfer mechanisms.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share personal information only with:

• Service providers that support our operations (for example, website and portal hosting, email/newsletter tools, security and analytics providers, professional advisors) under contracts that require them to protect your data and use it only on our instructions.

• Clients and their authorized representatives, where necessary to deliver our services under a contract.

• Authorities, regulators, courts, or other third parties when required by law or where necessary to protect our rights, your rights, or the rights of others.

6. Data Security and Retention

We use technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration, including access controls, encryption in transit where appropriate, and limiting access to those who need it to perform their role.

We keep personal information only for as long as needed to fulfill the purposes described in this Policy, including meeting legal, accounting, and reporting requirements, and then delete or anonymize it in line with applicable laws and our internal retention rules. Client portal accounts and related data may be retained for as long as your organization maintains a relationship with us and for a reasonable period afterward for legal and record keeping purposes.

7. Your Rights

Depending on where you live and applicable law, you may have the following rights regarding your personal information:

• Access: to know whether we process your personal information and to receive a copy.

• Rectification: to correct inaccurate or incomplete information.

• Deletion: to request deletion of your information, subject to legal and contractual limits.

• Restriction and objection: to request that we limit certain processing or object to processing based on legitimate interests.

• Portability: to receive certain information in a structured, commonly used, machine readable format and to request we transmit it to another controller where technically feasible.

• Consent withdrawal: where processing is based on consent (for example, newsletters, certain cookies), to withdraw that consent at any time, without affecting prior lawful processing.

Residents of certain jurisdictions may have additional rights, including:

• EEA/UK (including Germany): the right to lodge a complaint with your local data protection authority if you believe we have not complied with data protection laws.

• California: additional rights under CCPA/CPRA, such as the right to know categories of personal information collected and disclosed, and to limit certain uses of sensitive personal information, where applicable.

• Canada: rights under PIPEDA to access, correct, and challenge our handling of your personal information, including with the Office of the Privacy Commissioner of Canada.

• Brazil: rights under LGPD, including confirmation of processing, anonymization, and review of automated decisions, where applicable.

• India: rights under the DPDP Act to obtain information about processing, seek correction or erasure, and file grievances with a designated authority, where established.

To exercise your rights, please contact us using the details below. We may need to verify your identity before responding, and some rights may be subject to limitations under applicable law.

8. Children’s Data

Our website, newsletter, and services are intended for business and professional audiences. We do not knowingly collect personal information from children where this is prohibited by applicable law. If you believe we have collected such information, contact us and we will take appropriate steps to delete it.

9. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will update the “last updated” date above and may provide additional notice where required by law (for example, via our website or email).

10. Contact Us

If you have questions or requests regarding this Privacy Policy or our handling of personal information, please contact us at letstalk@hrhues.com, including '! Important re Website Privacy Policy' in the subject line and include your country or region so we can consider the correct privacy laws when responding.