Privacy Policy

Vesta People | www.vestapeople.co.uk

Last updated: 16 October 2026

1. Introduction

At Vesta People, we believe that trust, transparency and confidentiality are at the heart of good people management. Protecting your personal information is an important part of that commitment.

This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, contact us, book a consultation or engage with our HR consultancy services. We are committed to handling personal information responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.

2. Who We Are

Vesta People provides independent HR consultancy, employment relations advice and people management support to businesses across the UK.

Business name: Vesta People

Legal status: Sole Trader trading under Vesta People

Website: www.vestapeople.co.uk

Email: ashleigh@vestapeople.co.uk

For personal information that we collect and manage for our own business purposes, Vesta People is the data controller.

When delivering HR services for clients, our role as a data controller or data processor depends on the particular services and contractual arrangements.

3. What Information We Collect

Depending on how you interact with us, we may collect:

Contact information: Names, business email addresses, telephone numbers, job titles and business details.
Enquiry information: Details shared when contacting us, completing a website form or requesting HR advice.
Booking information: Appointment dates, consultation requirements, booking details and relevant communications.
Payment information: Transaction confirmations, billing information and invoice records. Payment card processing is handled by our payment service providers.
Professional information: Business contact details received through networking, referrals, professional platforms and publicly available business sources.
Website information: IP addresses, browser information, device details, cookie preferences and website interaction data.
Client service information: Information reasonably necessary to provide HR consultancy, including employee or employment relations information supplied during an engagement.

We aim to collect only the information necessary for a clearly identified and legitimate purpose.

4. How We Use Your Information

We use personal information to:

Respond to enquiries and requests for information.
Arrange, manage and deliver consultations and HR services.
Prepare proposals, service agreements and invoices.
Maintain professional relationships with clients and business contacts.
Communicate about relevant services and business opportunities where legally permitted.
Manage payments, accounts and financial records.
Improve our website, services and customer experience.
Meet legal, regulatory and professional obligations.
Protect the security and integrity of our business systems.

5. Our Legal Basis for Processing

We process personal information only where we have an appropriate lawful basis under the UK GDPR.

These include:

Contractual necessity: Where processing is necessary to take steps before entering into a contract or to deliver services under an agreement.

Legitimate interests: Where processing is reasonably necessary for operating and developing our business, responding to business communications, maintaining appropriate professional relationships or ensuring system security, provided these interests are not overridden by individuals' rights.

Legal obligations: Where information must be retained or processed to comply with applicable laws, including accounting and tax requirements.

Consent: Where consent is required, including certain electronic marketing activities or non-essential website technologies. Consent may be withdrawn at any time.

Our marketing activities are also subject to the Privacy and Electronic Communications Regulations (PECR).

6. HR Consultancy and Confidential Employee Information

As an HR consultancy, Vesta People recognises that certain client engagements may involve confidential or sensitive employee information.

This may include employment history, absence information, disciplinary or grievance records, workplace concerns, occupational health information or other employment-related records.

We will:

Access and process such information only where necessary and legally permitted.
Maintain appropriate confidentiality and information security safeguards.
Limit access to authorised individuals with a genuine business need.
Process information on behalf of clients according to applicable instructions and agreements where acting as a data processor.
Apply appropriate additional safeguards and lawful conditions where special category information is processed.
Retain and securely dispose of client information in accordance with applicable legal requirements and agreed retention arrangements.

Where our client is the data controller, that client's own employee privacy notice may also apply.

7. Where We Obtain Information

Most personal information is provided directly by you when you contact us, make a booking or engage our services. We may also obtain relevant business contact information from publicly available sources, including company websites, professional networking platforms, business directories and referrals.

Where we obtain personal information indirectly, we will provide appropriate privacy information in accordance with applicable legal requirements.

8. Sharing Your Information

We do not sell personal information to third parties.

Where necessary, information may be shared with trusted service providers supporting our business operations, such as:

Wix, which hosts and supports our website and its associated services.
Payment processing, booking and invoicing providers.
Email, document storage and business administration providers.
Professional advisers, where appropriate and necessary.
Regulators, public authorities or other parties where disclosure is legally required.

We take all reasonable steps to ensure that third-party providers handle personal information securely and subject to appropriate contractual and legal protections.

9. International Data Transfers

Some technology and service providers may process or store information outside the United Kingdom although we ourselves are based in the United Kinjgdom, this could be, for example, a pay platform. Where personal information is subject to an international restricted transfer, we will ensure that an appropriate legal mechanism or safeguard is in place, such as applicable UK adequacy regulations or approved contractual safeguards.

You may contact us for further information about relevant transfers and safeguards.

10. How Long We Keep Information

We retain personal information only for as long as necessary for the purpose for which it was collected, subject to applicable legal requirements.

Retention periods depend on the type of information and may be determined by:

The duration and nature of a client relationship.
Whether an enquiry remains active or requires reasonable follow-up.
Contractual obligations and relevant limitation periods.
Tax, accounting and regulatory record-keeping requirements.
The sensitivity of information and the risk associated with retaining it.

Confidential HR case records are subject to appropriate, case-specific retention arrangements and when information is no longer required, we will securely delete, anonymise or otherwise dispose of it as appropriate.

11. Cookies and Website Analytics

Our website is hosted through Wix and uses only generic cookies or similar technologies to support website operation, security and functionality. Depending on the services and integrations enabled, these technologies may also help us understand website usage, measure advertising performance or improve the visitor experience. Strictly necessary cookies support essential website functions.

Other technologies, including advertising and certain analytics cookies, will be used only where the required consent has been obtained or an applicable legal exception is satisfied.

Visitors can manage cookies through the website's available privacy controls and their browser settings. Where consent is the basis for using a cookie, visitors may withdraw it.

12. Marketing and Business Communications

We may contact relevant business representatives regarding HR consultancy services, professional collaboration or business opportunities where permitted by law.

Such communications may use professional contact details provided directly to us or obtained through legitimate business sources.

We respect individuals' communication preferences and comply with applicable data protection and electronic marketing requirements.

You have the right to object to the use of your personal information for direct marketing at any time.

To stop receiving marketing communications, reply to the relevant email or contact ashleigh@vestapeople.co.uk.

We will respect your objection and retain only the minimum information necessary to ensure that your preference continues to be honoured.

13. Keeping Your Information Secure

We take reasonable technical and organisational measures to protect personal information against unauthorised access, accidental loss, alteration, disclosure or misuse.

These measures may include access restrictions, appropriate account security, secure storage arrangements and confidentiality requirements.

Although no electronic system can be guaranteed to be completely secure, we take our responsibility to protect information seriously.

14. Your Data Protection Rights

Under UK data protection legislation, you may have the right to:

Access personal information we hold about you.
Request correction of inaccurate or incomplete information.
Request deletion of your information in certain circumstances.
Request restrictions on how your information is processed.
Object to processing, particularly for direct marketing.
Request transfer of your information where data portability rights apply.
Withdraw consent where consent is the lawful basis.

These rights are subject to applicable legal conditions and exemptions.

To exercise these rights, please contact ashleigh@vestapeople.co.uk.

We will respond within the timeframes required by applicable data protection legislation.

15. Complaints

If you have concerns about how we handle your personal information, please contact us first so that we can investigate and respond.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: www.ico.org.uk

16. External Websites

Our website may contain links to external websites, services or platforms such as pay platforms.

We are not responsible for the privacy practices of third-party websites and recommend reviewing their privacy policies before providing personal information.

17. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our services, business practices or legal requirements.

The latest version will be made available on our website, together with its most recent update date.

Where changes materially affect the way we use personal information, we will take appropriate steps to bring those changes to the attention of affected individuals.

18. Contact Us

For questions about this Privacy Policy, your personal information or your data protection rights, please contact:

Vesta People

Email: ashleigh@vestapeople.co.uk

Website: www.vestapeople.co.uk

Your people. Our priority.

Privacy Policy

​

Vesta People | www.vestapeople.co.uk

Last updated: 16 October 2026

1. Introduction

At Vesta People, we believe that trust, transparency and confidentiality are at the heart of good people management. Protecting your personal information is an important part of that commitment.

2. Who We Are

Vesta People provides independent HR consultancy, employment relations advice and people management support to businesses across the UK.

Business name: Vesta People

Legal status: Sole Trader trading under Vesta People

Website: www.vestapeople.co.uk

Email: ashleigh@vestapeople.co.uk

For personal information that we collect and manage for our own business purposes, Vesta People is the data controller.

When delivering HR services for clients, our role as a data controller or data processor depends on the particular services and contractual arrangements.

3. What Information We Collect

Depending on how you interact with us, we may collect:

Contact information: Names, business email addresses, telephone numbers, job titles and business details.

Enquiry information: Details shared when contacting us, completing a website form or requesting HR advice.

Booking information: Appointment dates, consultation requirements, booking details and relevant communications.

Payment information: Transaction confirmations, billing information and invoice records. Payment card processing is handled by our payment service providers.

Professional information: Business contact details received through networking, referrals, professional platforms and publicly available business sources.

Website information: IP addresses, browser information, device details, cookie preferences and website interaction data.

Client service information: Information reasonably necessary to provide HR consultancy, including employee or employment relations information supplied during an engagement.

We aim to collect only the information necessary for a clearly identified and legitimate purpose.

4. How We Use Your Information

We use personal information to:

Respond to enquiries and requests for information.

Arrange, manage and deliver consultations and HR services.

Prepare proposals, service agreements and invoices.

Maintain professional relationships with clients and business contacts.

Communicate about relevant services and business opportunities where legally permitted.

Manage payments, accounts and financial records.

Improve our website, services and customer experience.

Meet legal, regulatory and professional obligations.

Protect the security and integrity of our business systems.

5. Our Legal Basis for Processing

We process personal information only where we have an appropriate lawful basis under the UK GDPR.

These include:

Contractual necessity: Where processing is necessary to take steps before entering into a contract or to deliver services under an agreement.

Legitimate interests: Where processing is reasonably necessary for operating and developing our business, responding to business communications, maintaining appropriate professional relationships or ensuring system security, provided these interests are not overridden by individuals' rights.

Legal obligations: Where information must be retained or processed to comply with applicable laws, including accounting and tax requirements.

Consent: Where consent is required, including certain electronic marketing activities or non-essential website technologies. Consent may be withdrawn at any time.

Our marketing activities are also subject to the Privacy and Electronic Communications Regulations (PECR).

6. HR Consultancy and Confidential Employee Information

As an HR consultancy, Vesta People recognises that certain client engagements may involve confidential or sensitive employee information.

This may include employment history, absence information, disciplinary or grievance records, workplace concerns, occupational health information or other employment-related records.

We will:

Access and process such information only where necessary and legally permitted.

Maintain appropriate confidentiality and information security safeguards.

Limit access to authorised individuals with a genuine business need.

Process information on behalf of clients according to applicable instructions and agreements where acting as a data processor.

Apply appropriate additional safeguards and lawful conditions where special category information is processed.

Retain and securely dispose of client information in accordance with applicable legal requirements and agreed retention arrangements.

Where our client is the data controller, that client's own employee privacy notice may also apply.

7. Where We Obtain Information

Where we obtain personal information indirectly, we will provide appropriate privacy information in accordance with applicable legal requirements.

8. Sharing Your Information

We do not sell personal information to third parties.

Where necessary, information may be shared with trusted service providers supporting our business operations, such as:

Wix, which hosts and supports our website and its associated services.

Payment processing, booking and invoicing providers.

Email, document storage and business administration providers.

Professional advisers, where appropriate and necessary.

Regulators, public authorities or other parties where disclosure is legally required.

We take all reasonable steps to ensure that third-party providers handle personal information securely and subject to appropriate contractual and legal protections.

9. International Data Transfers

You may contact us for further information about relevant transfers and safeguards.

10. How Long We Keep Information

We retain personal information only for as long as necessary for the purpose for which it was collected, subject to applicable legal requirements.

Retention periods depend on the type of information and may be determined by:

The duration and nature of a client relationship.

Whether an enquiry remains active or requires reasonable follow-up.

Contractual obligations and relevant limitation periods.

Tax, accounting and regulatory record-keeping requirements.

The sensitivity of information and the risk associated with retaining it.

Confidential HR case records are subject to appropriate, case-specific retention arrangements and when information is no longer required, we will securely delete, anonymise or otherwise dispose of it as appropriate.

11. Cookies and Website Analytics

Other technologies, including advertising and certain analytics cookies, will be used only where the required consent has been obtained or an applicable legal exception is satisfied.

Visitors can manage cookies through the website's available privacy controls and their browser settings. Where consent is the basis for using a cookie, visitors may withdraw it.

12. Marketing and Business Communications