1. Who we are
This policy explains how Human Collective collects, uses, stores and protects personal data through our website, https://human-collective.co.uk. For the purpose of UK data protection law, Human Collective is the “data controller” of the personal data described in this policy.
Our contact details are: Human Collective Community Limited, Bank House, 71 Dale Street, Rochdale, England OL16 3NJ, enquiries@human-collective.co.uk.
This policy sits alongside, and does not replace, our internal Data Protection & GDPR Policy, which sets out in more detail how we handle personal data as part of delivering client engagements.
2. Scope of This Policy
This policy covers personal data we collect through our website — from visitors browsing the site, people who contact us, subscribe to updates, comment on our blog, or apply for a role. It does not cover personal data we process on behalf of a client while delivering a contracted engagement, which is governed by the relevant client contract or Data Processing Agreement instead.
3. The Personal Data We Collect
Depending on how you interact with our website, we may collect the following:
| If you… | We collect | How |
| Simply browse the site | IP address, browser and device information, and pages viewed | Automatically, via cookies and similar technologies (Section 5) |
| Submit a contact or enquiry form | Your name, email address, phone number, and the content of your message | Directly from you |
| Subscribe to updates or a newsletter | Your name and email address | Directly from you, or via our email platform’s sign-up form |
| Leave a comment on our blog | Your name, email address, an optional website address, your IP address and browser user agent, and the comment itself | Directly from you, via the comment form |
| Apply for a role with us | The details in your CV, application and any references you provide | Directly from you, or from a recruitment platform you apply through |
If you upload an image to the site — for example as part of a comment or application — please avoid including embedded location data (EXIF GPS). Visitors to the site could otherwise download and extract location data from images published on it.
4. How We Use Your Data, and Our Lawful Basis
We only use personal data where we have a lawful basis to do so under UK GDPR. The table below sets out our main purposes and the basis we rely on for each.
| Purpose | Lawful basis |
| Responding to an enquiry you send us | Legitimate interests — to respond to people who contact us — or steps taken at your request before entering into a contract |
| Sending newsletter or update emails you have signed up for | Consent, which you can withdraw at any time |
| Publishing and moderating blog comments, and detecting spam | Legitimate interests — running a functioning, spam-free comment section |
| Providing an anonymised hash of your email to the Gravatar service, if you comment, so your profile picture can be shown | Legitimate interests — a standard feature of the comment system we use |
| Understanding how our website is used, through analytics | Consent, where analytics relies on non-essential cookies (Section 5) |
| Assessing a job application | Steps taken at your request before entering into a contract, and compliance with our legal obligations as an employer |
5. Cookies and Similar Technologies
Our website uses cookies and similar technologies in line with the Privacy and Electronic Communications Regulations 2003 (as amended) and UK GDPR.
- Strictly necessary cookies — for example to remember that you accepted a cookie notice, or to keep you logged in to an account area. These do not require consent and cannot be switched off.
- Comment cookies — if you leave a comment, you may opt in to saving your name, email address and website in a cookie for your convenience next time. These last for one year. A separate, short-lived cookie checks whether your browser accepts cookies at all.
- Login cookies — if you or a colleague log in to the site (for example to manage content), cookies save login information and screen display choices. Login cookies last two days, or two weeks if “Remember Me” is selected, and are removed when you log out.
- Analytics cookies — [we use Google Analytics / confirm analytics tool] to understand how visitors use our site. These are non-essential and are only set with your consent, given through our cookie banner.
You can withdraw or change your cookie consent at any time through our cookie banner, or by changing your browser settings — though blocking some cookies may affect how parts of the site work.
6. Media and File Uploads
If you upload an image or other file to our website, please check it does not contain personal or location data you would not want made public. Visitors to the site can, in principle, download and extract any location data embedded in an image published on it, and we do not strip this data automatically.
7. Embedded Content From Other Websites
Articles or pages on our site may include embedded content — for example videos, social media posts, or documents hosted elsewhere. Embedded content behaves exactly as if you had visited the other website directly: that website may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with the embedded content, including tracking your interaction if you have an account and are logged in to that website.
8. Who We Share Your Data With
We do not sell personal data. We share it only with the following categories of recipient, where necessary to run our website and respond to you:
| Who | Why | Safeguard |
| Our website hosting provider — GoDaddy | To host and operate the website | Contract / data processing agreement in place |
| Our email or newsletter platform — Mailpoet | To send emails you have signed up for | Contract / data processing agreement in place |
| Our website analytics provider — WordPress | To understand how the site is used | Contract / data processing agreement in place; IP addresses anonymised where possible |
| Automattic (Gravatar / Akismet), where relevant | Profile picture lookup for commenters, and spam detection | Governed by Automattic’s own privacy policy, https://automattic.com/privacy/ |
| A password reset request | Your IP address is included in the password reset email, as a security measure | Not applicable — sent directly to you |
9. International Data Transfers
Some of the third parties in Section 8 may store or process data outside the UK, including in the United States. Where this happens, we only use providers that offer an adequate level of protection — through the UK’s data protection adequacy regulations, standard contractual clauses, or an equivalent recognised safeguard under UK GDPR.
10. How Long We Keep Your Data
| Type of data | How long we keep it |
| Contact / enquiry form submissions | [Retention period — e.g. 12 months from your last contact, unless a longer period applies] |
| Blog comments and their metadata | Retained indefinitely, so that we can recognise and approve follow-up comments automatically rather than holding every comment in a moderation queue — unless you ask us to remove one |
| Newsletter subscriber details | Until you unsubscribe, or [period] of inactivity |
| Job applications | [Retention period — e.g. 6 months from the closing date], unless you are successful or agree we can keep your details on file for future roles |
| Registered site accounts (if any) | For as long as the account exists; you can see, edit or delete the personal information in your profile at any time, except your username |
Full retention periods for how we handle personal data across the business, including client engagements, are set out in the Retention Schedule that forms part of our internal Data Protection & GDPR Toolkit.
11. Your Rights Over Your Data
If we hold personal data about you — including if you have an account on this site, or have left a comment — you have the right to:
- Request a copy of the personal data we hold about you, including any data you have provided to us.
- Ask us to correct inaccurate or incomplete data.
- Ask us to erase your personal data, subject to any data we are obliged to keep for administrative, legal or security purposes.
- Ask us to restrict how we use your data, or object to us using it, in certain circumstances.
- Ask us to provide your data in a portable, machine-readable format, where we process it based on your consent or a contract.
- Withdraw your consent at any time, where we rely on consent — for example for the newsletter or analytics cookies — without affecting anything we did before you withdrew it.
To exercise any of these rights, contact us using the details in Section 1. If you are not satisfied with how we have handled your data, you also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
12. Keeping Your Data Secure
We apply technical and organisational measures appropriate to the personal data we hold, in line with our internal Information Security Policy — including encrypted, access-controlled cloud storage and restricting access to those who need it. No method of transmission over the internet is completely secure, but we work to protect your data at every stage we control.
13. Automated Decision Making
We do not use your personal data for any automated decision-making, including profiling, that produces legal or similarly significant effects on you.
14. Children’s Policy
Our website is intended for a professional, business audience and is not directed at children. We do not knowingly collect personal data from children, and if we become aware that we have done so, we will delete it promptly.
15. Changes to This Policy
We review this policy at least annually, or sooner if our website, the data we collect, or data protection law changes materially. The version history at the front of this document records when it was last updated.
16. Contact Use
If you have a question about this policy or how we handle your data, please contact us using the details in Section 1. If you would prefer to raise a concern independently, you can contact the Information Commissioner’s Office at ico.org.uk.