Back to site

Privacy Policy

This policy explains what we do with your personal information when you visit our website, send us an enquiry, or work with us. We have written it in plain English rather than legal language, and we have kept it as short as we sensibly can.

If anything here is unclear, please ask. You can reach us through the contact form on our website or by phone on 01629 343116. We deliberately do not publish an email address anywhere on this site, because it attracts a great deal of spam. The form and the phone both come straight to Sarah.

Who we are

Enso HR Consultancy is the trading name of ENSO HR CONSULTANCY LTD, a company registered in England and Wales under company number 08917106. The business is run by Sarah Woodman, an independent HR consultant and leadership coach, who works with clients directly.

For the purposes of the UK GDPR and the Data Protection Act 2018, ENSO HR CONSULTANCY LTD is the data controller for the information described in this policy, except where we are acting as a processor for a client (see Client work and employee information below).

What we collect

Enquiry details

Our contact form asks for three things: your name, your email address, and a brief outline of what you need. Whatever you choose to put in that outline box is up to you, so please do not include sensitive details about a named employee at this first stage. A short summary is plenty to get us started.

When you submit the form, it is sent to our business inbox as an email. The form is protected by a hidden field that only automated bots fill in (a honeypot) and by a simple arithmetic question. We deliberately do not use a third party CAPTCHA service, so answering that question does not send any of your data to Google or anyone else.

Server logs

Our hosting provider keeps standard server logs. These typically record your IP address, the type of browser you are using and the pages you visited. Logs of this kind are created automatically by almost every website and are used to keep the site running safely.

Analytics and website usage

If you agree to analytics cookies through our cookie banner, we collect information about how the site is used: which pages are popular, roughly where visitors are in the world, what type of device they use, and how they moved through the site. We use three tools for this, described below.

Session recordings

Please read this part carefully, because we would rather you knew than were surprised by it. If you accept analytics cookies, one of our tools, Microsoft Clarity, creates a session recording. That means it captures your mouse movements, clicks, scrolling and other interactions with the page, and plays them back to us as an anonymous replay of a visit, alongside heatmaps showing where people click and how far down they read.

We use this to spot practical problems, for example a button nobody can find or a section where people give up reading. We are not watching you personally, and the replays are not linked to your name. Clarity's default settings mask the contents of form fields, so what you type into the contact form should not appear in a recording, although no masking can be promised as perfect. If you would prefer not to be recorded at all, simply decline analytics cookies on the banner, or withdraw your consent later. Nothing on the site stops working if you do.

Client information

If you go on to work with us, we will hold the information we need to deliver and administer that work, such as your contact details, notes of our discussions, documents you send us, and billing records.

How we use your information

We do not use your information for advertising or remarketing. We do not sell it, rent it or share it for anyone else's marketing. We do not use it for automated decision making or profiling.

Our lawful bases

The UK GDPR requires us to have a lawful basis for using your personal information. Ours are:

Client work and employee information

Much of our HR work involves other people's information. When we advise a business client on a disciplinary, a grievance, an investigation, a restructure or a similar matter, the papers we are given will usually contain personal information about that client's employees, and sometimes about third parties such as witnesses or complainants. It may include sensitive information, for example about someone's health or a workplace complaint.

In that situation the employer remains the data controller for its own employee information, and we act as a processor on the employer's instructions. Those engagements are governed by the separate terms of business and data processing terms we agree with each client, which set out what we may do with the information, how it is protected, and what happens to it at the end of the work. Those terms sit alongside this policy and take precedence over it for that client information.

If you are an employee of one of our clients and you want to know how your information is being handled, your employer is the right first port of call, as the controller. You are welcome to contact us as well and we will help where we properly can.

Who we share information with

We keep the list of suppliers short and deliberate. We share information with the following, and only so they can provide their service to us:

We may also share information with our professional advisers, such as our accountant, or with anyone we are legally required to disclose it to. That is the whole list. Nobody buys data from us, because we do not sell it.

Sending information outside the UK

Our website hosting sits within the European Union. Google and Microsoft are United States companies, and the analytics information they collect for us may be transferred to and stored in the USA.

Where that happens, the transfer is covered by the safeguards UK law recognises, namely the UK Extension to the EU-US Data Privacy Framework (often called the UK-US Data Bridge) and, where that does not apply, the International Data Transfer Agreement or the equivalent addendum to the standard contractual clauses. In plain terms, those providers are contractually required to protect your information to UK standards.

If you would rather no analytics information about your visit left the UK, decline analytics cookies. Only the essential parts of the site will then run.

How long we keep things

How we look after it

We take sensible, proportionate steps to keep information safe. The website is served over an encrypted connection (HTTPS). Devices and accounts are protected by strong passwords, multi factor authentication where it is offered, and up to date software. Client papers are kept in access controlled storage, and only Sarah handles them. Where a trusted associate is brought in to help with a piece of work, they are bound by the same duties of confidentiality and data protection.

No system can ever be guaranteed completely secure, but if something did go wrong and it presented a risk to you, we would tell you and the regulator as the law requires.

Your rights

Under the UK GDPR you have the following rights over your personal information. They are free to use.

To use any of these rights, get in touch through the contact form or by phone on 01629 343116. We may need to check who you are before we act, simply so that we do not hand someone's information to the wrong person. We will respond within one month, and we will tell you if we need longer because a request is complicated.

Where we hold information as a processor for a business client, we will pass your request to that client, who is the controller and the right person to answer it.

If you are unhappy

Please tell us first if you can, so that we have a chance to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection.

Children

This website is aimed at employers, business owners and professionals. It is not designed for or directed at children, and we do not knowingly collect information about children through it. If you believe a child has sent us information through the website, please let us know and we will delete it.

Cookies

Cookies and similar storage get a document of their own. Please see our Cookie Policy for the full list of what is set, by whom, why, and for how long, together with how to change or withdraw your consent.

Changes to this policy

We will update this policy when the way we work changes, or when we add or remove a tool. When we do, we will change the date below. If a change is significant, we will make that clear on the website.

Last updated: July 2026.

See also our Cookie Policy, Terms of Use and Accessibility statement.