Privacy Policy

OneSource HR Limited is a specialist trauma-informed HR consultancy. We are a company registered in England and Wales.

Evida is a trading name of OneSource HR Limited and provides generalist HR consultancy. Evida is not a separate company. If you engage with Evida, you are engaging with OneSource HR Limited, and this policy applies in full.

Scenari is a workplace conduct training platform. It is a separate legal entity, owned personally by Chloe Wallace, the founder of OneSource HR Limited. Scenari is not part of OneSource HR Limited.

Because the two businesses share a founder and complementary services, we may want to pass your details to Scenari where their training platform is relevant to your enquiry.

We will only ever do this if you have specifically agreed to it. We ask you clearly, we do not pre-tick the box, and saying no makes no difference to the service you receive from us. If you change your mind later, tell us and we will stop.

We handle different information depending on how you come to us.

What we collect: Your name, organisation, job title, email address, telephone number, the size of your organisation, and whatever you choose to tell us about your enquiry.

Why: So that we can respond to you, understand what you need, and decide whether we are the right people to help.

Our lawful basis: Legitimate interests. You have contacted us asking for help, and we need this information to respond.

Who reads it: A qualified HR consultant. Always. Enquiries are never read by an automated system alone, and never by anyone unqualified to handle what you might be telling us.

How long we keep it: Two years from your last contact with us, unless you ask us to delete it sooner.

A note on our investigations enquiry form: We deliberately ask you not to include names or identifying details of other people at the enquiry stage. This protects them, and it protects you. If you do send us identifying information, we will handle it carefully, but we would rather you did not need to.

Our website offers a free self-assessment tool that asks your organisation seventeen questions about its approach to preventing sexual harassment, and returns a readiness score and report.

What we collect: Your name, work email address, and organisation. Optionally, your role, your sector, and the size of your organisation. And your answers to the seventeen questions.

Why: To generate your report, and so that a specialist can follow up with you if you would find that helpful.

Our lawful basis: Consent. You choose to use the tool and you choose what to tell us.

What happens to your answers: Your answers generate your report on screen. A copy of your result is sent to our team so that a qualified HR consultant can understand your position before speaking with you. We do not publish your answers, and we do not share them with any other organisation.

What we store, and where: Your details, your result and your answers are held only in the copy sent to our team by email. We do not store them anywhere else, and we do not add you to any mailing list unless you separately ask to join one.

How long we keep it: Two years from your last contact with us, in line with how we handle any other enquiry, unless you ask us to delete it sooner.

Your result is yours. Using the tool creates no obligation to speak to us, and no obligation to do anything at all. If you would rather we deleted everything, email us and we will.

What we collect: Contact details, contractual information, and the information necessary to carry out the work you have instructed us to do.

Why: To deliver the service, to meet our legal and professional obligations, and to keep records that would stand up to scrutiny if they ever needed to.

Our lawful basis: Contract, and our legal obligations.

How long we keep it: Six years, in line with standard practice in employment matters, or until we hand the records back to you as the data controller, as set out in our contract with you.

This is the most sensitive information we handle.

What we may collect: Information about your employees and other individuals, including their names, employment details, health and medical information, information about their sex life or sexual orientation, information about alleged criminal offences, racial or ethnic origin, religious beliefs, disability, and anything else relevant to the matter under investigation.

Much of this is what data protection law calls special category data and criminal offence data. It carries the highest level of legal protection, and we treat it accordingly.

Our lawful basis: Contract and legal obligation. For special category data, we rely on the condition that processing is necessary for the purposes of carrying out obligations in the field of employment law, and for the establishment, exercise or defence of legal claims.

Our role: Depending on the engagement, we act as a joint data controller with you, or as a data processor on your instruction. Which one applies is set out in the contract we agree with you before any work begins.

How long we keep it: Six years, in line with standard practice in employment matters, or until we return the records to you and delete our copies, as agreed in your contract.

How we protect it: Investigation material is stored securely, access is restricted to those working on the case, and we follow the same trauma-informed principles in how we handle information as we do in how we handle people.

What we collect: Your name, organisation, email address, and your responses to pre and post delivery impact assessments.

Why: To deliver the training, issue your certificate, and measure the impact of the learning.

Impact assessments are anonymous. They are analysed in aggregate. We do not report individual responses back to your employer, and we cannot identify you from them.

How long we keep it: Six years for training records and certificates.

What we collect: Your contact details, and notes taken during supervision sessions.

Why: To provide effective supervision.

Confidentiality: Supervision is confidential. Where an organisation has arranged supervision for you, we do not report back to your employer on what you discuss, and we do not assess or comment on your performance or capability. What is stored, how it is stored, and how long it is kept, is agreed with you in your supervision contract before we begin.

Our lawful basis: Contract.

What we collect: Your first name and email address.

Why: To send you the resource, and to send you occasional emails about our work if you have agreed to receive them.

Our lawful basis: Consent.

How to stop: Every email we send has an unsubscribe link. One click, no questions.

We do not sell your information. We never have and we never will.

We share information only in these circumstances.

With service providers who help us operate. These are:

Each of these acts on our instructions under a contract, and cannot use your information for their own purposes.

With Scenari, but only if you have specifically agreed. See above.

Where the law requires it. If we are required by law, or by a court, or by a regulator, to disclose information, we will. Where we are permitted to tell you that this has happened, we will tell you.

Where there is a serious risk of harm. If, in the course of our work, we become aware of a risk of serious harm to a child or an adult at risk, we may have a legal or ethical duty to report it to the appropriate authority. We would tell you we were doing so unless doing so would increase the risk.

Where we need legal or professional advice, for example from our solicitors or insurers.

Your information is stored within the UK or the European Economic Area wherever possible.

Some of our service providers process data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

You have rights over your information. You can exercise any of them by emailing help@onesourcehr.co.uk. We will respond within one month.

The right to be informed. To know what we hold and why. This policy is part of that.

The right of access. To ask for a copy of the information we hold about you.

The right to rectification. To have inaccurate information corrected.

The right to erasure. To ask us to delete your information. This right is not absolute. Where we hold information as part of an investigation, or where we have a legal obligation to retain it, we may not be able to delete it. We will always explain our reasoning.

The right to restrict processing. To ask us to pause what we are doing with your information.

The right to object. To object to us processing your information on the basis of legitimate interests.

The right to data portability. To receive your information in a portable format.

The right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. This will not affect anything we did before you withdrew it.

Exercising your rights costs nothing, and we will not treat you any differently for doing so.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time.

Our website uses cookies. Some are necessary for the site to work. Others help us understand how the site is being used so we can improve it.

You will be asked to choose which non-essential cookies you accept when you first visit the site. You can change your mind at any time.

We do not use cookies to track you across other websites, and we do not sell advertising.

We take the security of your information seriously, particularly given the nature of what people share with us.

We restrict access to information to those who need it. We use reputable providers with appropriate security measures. We store investigation material securely and separately. We train our people. And we review our practices regularly.

No system is perfect. If a breach ever occurred that put your rights and freedoms at risk, we would tell you, and we would tell the ICO within 72 hours, as the law requires.

Our services are for organisations and the adults who work in them. We do not knowingly collect information about children through this website.

Where an investigation involves safeguarding concerns relating to a child, we handle that information under the terms of our contract with the organisation instructing us, and in line with our safeguarding obligations.

We will update this policy when our practices change, or when the law does. The date at the top tells you when it was last updated. If we make a significant change, we will say so clearly.

If you have a question about your information, or about anything in this policy, we would rather you asked than wondered.