Privacy Policy
Last updated: 29 July 2026
This Privacy Policy explains how H&K Business Associates Ltd (“the Company”, “we”, “our”, or “us”) collects, uses, shares, and protects your personal data when you visit our website, contact us, or use our online services. It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are committed to handling your personal data fairly, lawfully, and transparently.
1. Who We Are
H&K Business Associates Ltd
Unit 2B, 420 Eastern Avenue, Gants Hill, IG2 6NQ, United Kingdom
Website: https://handkbusiness.co.uk
Email: info@handkbusiness.co.uk
We are the data controller for the personal data described in this policy, unless otherwise stated. This means we decide how and why your personal data is processed.
2. Data Protection Officer
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our approach to data protection and for answering any questions about this Privacy Policy or how we handle your personal data.
Data Protection Officer: MD Ahasan Habib
Email: habib@handkbusiness.co.uk
Postal address: Data Protection Officer, H&K Business Associates Ltd, Unit 2B, 420 Eastern Avenue, Gants Hill, IG2 6NQ, United Kingdom
If you have any questions or concerns about how we use your personal data, please contact our DPO in the first instance.
3. What Personal Data We Collect
We may collect and process the following categories of personal data:
- Identity Data: first name and last name.
- Contact Data: email address and phone number.
- Technical Data: IP address, browser type and version, device identifiers, operating system, and data collected through cookies and similar technologies.
- Usage Data: pages visited, time spent on the website, and navigation paths.
- Social Media Data: if you choose to log in via a social media account (such as Google, Facebook, or X/Twitter), we may receive your name, email address, and basic profile information from that provider.
- Transactional Data: records of services you have requested or purchased from us.
We do not intentionally collect special category data (such as data about your health, ethnicity, or religion) through our website. If you send us such information voluntarily and unsolicited, we will delete it unless a specific condition under Article 9 UK GDPR (such as your explicit consent, or the establishment, exercise, or defence of legal claims) allows us to retain it and retention is necessary.
4. How We Collect Your Data
We collect personal data from the following sources:
- Directly from you – when you complete forms on our website, contact us by email or phone, subscribe to updates, or otherwise interact with us.
- From social media authentication providers – where you choose to log in or register using a social media account, that provider shares certain profile information with us in line with your settings on their platform.
- Automatically through our website – technical and usage data is collected through cookies, server logs, and similar technologies when you browse our website (see Section 13).
We do not purchase personal data from third-party marketing list providers.
5. Legal Bases for Processing
We only process your personal data where we have a valid legal basis under UK GDPR. Depending on the circumstances, we rely on:
- Contract – where processing is necessary to provide services you have requested or to take steps at your request before entering into a contract.
- Consent – where you have agreed to the processing, for example receiving marketing communications or accepting optional cookies. You can withdraw your consent at any time.
- Legitimate Interests – where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and freedoms. Our legitimate interests include maintaining the security of our website, preventing fraud and misuse, responding to enquiries, understanding how our website is used, and improving our services. We have assessed these interests and balanced them against your rights and freedoms, and we do not use legitimate interests where the impact on you would be unfair or unexpected.
- Legal Obligation – where processing is necessary to comply with laws and regulations that apply to us, such as accounting, tax, and regulatory requirements.
6. How We Use Your Data
The table below summarises the purposes for which we use your personal data and the legal basis we rely on for each purpose:
| Purpose | Legal Basis |
|---|---|
| Delivering the services you request and managing your account | Contract |
| Responding to your enquiries and requests | Legitimate interests / Contract |
| Operating, maintaining, and improving our website and services | Legitimate interests |
| Sending marketing communications, updates, and offers | Consent (you may opt out at any time) |
| Monitoring website performance and detecting security threats or fraud | Legitimate interests |
| Keeping business and financial records | Legal obligation |
| Complying with legal and regulatory obligations | Legal obligation |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.
7. If You Do Not Provide Your Data
You are not obliged to provide personal data to us. However, where personal data is required for us to provide our services or respond to your request – for example, contact details needed to reply to an enquiry or to deliver a service you have purchased – failure to provide that data may mean we are unable to fulfil your request or provide the service. Where this is the case, we will tell you at the time.
8. Automated Decision-Making and Profiling
We do not carry out automated decision-making or profiling that produces legal effects or similarly significant effects on individuals. If this changes in the future, we will update this policy and provide you with the information required by law, including your right to request human intervention.
9. Who We Share Your Data With
We may share your personal data with the following categories of recipients:
- Service providers who process data on our behalf under contract, including our website hosting provider, IT support providers, cloud storage providers (for example, Microsoft 365 or Google Workspace), customer relationship management (CRM) systems, and email marketing platforms.
- Analytics providers, such as Google Analytics, which help us understand how visitors use our website (see Section 13 on cookies).
- Professional advisers, including accountants, auditors, lawyers, and insurers, where reasonably necessary.
- Business partners where you have specifically requested services delivered jointly with a partner. We will make this clear to you at the time.
- Regulators and public authorities, such as HMRC or the Information Commissioner’s Office, where we are legally required to do so.
All third-party service providers acting on our behalf are required to process your personal data only on our instructions, under written contracts, and with appropriate security measures in place.
We do not sell your personal data.
10. International Transfers
Some of our service providers – including cloud storage, analytics, and social media authentication providers – are based outside the United Kingdom or store data on servers located outside the UK, including in the United States. This means your personal data may be transferred outside the UK.
Whenever we transfer your personal data outside the UK, we ensure a similar degree of protection is afforded to it by using at least one of the following safeguards:
- Adequacy regulations – transfers to countries that the UK Government has determined provide an adequate level of protection for personal data (for example, transfers to the United States under the UK–US Data Bridge, where the recipient is certified).
- International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission’s Standard Contractual Clauses – contractual terms approved by the UK Government that give personal data the same protection it has in the UK.
- Additional safeguards – where appropriate, we apply supplementary measures such as encryption and data minimisation.
You may contact our DPO for further information on the specific safeguards applied to any transfer of your personal data outside the UK, including a copy of the relevant safeguard where applicable.
11. Data Retention
We keep your personal data only for as long as necessary to fulfil the purposes we collected it for, including legal, accounting, and reporting requirements. Our standard retention periods are:
| Data Category | Retention Period |
|---|---|
| Account and contractual data | Up to 6 years after the end of our relationship, in line with legal and accounting requirements |
| Marketing data | Until you withdraw consent or unsubscribe |
| Enquiry records (no ongoing relationship) | Up to 2 years from last contact |
| Usage and technical data | Usually no longer than 2 years, unless needed for security or compliance |
When personal data is no longer required, we securely delete or anonymise it.
12. Your Rights
Under UK data protection law, you have the following rights:
- Access – request a copy of the personal data we hold about you.
- Rectification – ask us to correct inaccurate or incomplete data.
- Erasure – ask us to delete your data (the “right to be forgotten”), in certain circumstances.
- Restriction – ask us to limit how we use your data, in certain circumstances.
- Data portability – receive the data you provided to us in a structured, commonly used, machine-readable format.
- Objection – object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent – at any time, where consent is the legal basis. This does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, contact our Data Protection Officer at habib@handkbusiness.co.uk or by post at the address in Section 2. We will respond within one month. We will not charge a fee unless your request is manifestly unfounded or excessive, and we may need to verify your identity before acting on your request.
If you are unhappy with how we have handled your data or responded to your request, you have the right to complain to the Information Commissioner’s Office (ICO):
- Website: www.ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.
13. Cookies and Tracking Technologies
We use cookies and similar technologies on our website. Cookies are small text files placed on your device that help websites function and provide information to site owners. We use the following categories:
- Essential cookies – required for the website to operate (for example, security and cookie-consent settings). These do not require consent.
- Functional cookies – remember your preferences and choices to improve your experience. Set only with your consent.
- Analytics cookies – help us understand how visitors use our website, including through Google Analytics. Set only with your consent. Information collected is aggregated and used to improve the website.
- Marketing cookies – used to personalise content and measure the effectiveness of our marketing. Set only with your consent.
Google Analytics is provided by Google LLC. Google may also process this information for its own purposes as described in its privacy policy, available at https://policies.google.com/privacy.
When you first visit our website, our cookie consent banner allows you to accept or reject non-essential cookies. You can change your preferences at any time through the cookie settings link on our website or through your browser settings. Blocking some cookies may affect how the website functions.
Full details of the specific cookies we use, their purposes, their duration, and any third-party providers are set out in our Cookies Policy, available on our website.
14. Security
We use appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, alteration, and disclosure. These include access controls, encryption where appropriate, staff awareness, and contractual obligations on our service providers. While no system can be guaranteed as completely secure, we regularly review and enhance our safeguards. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the ICO as required by law.
15. Children’s Privacy
Our website and services are not directed at children under 13, and we do not knowingly collect personal data from children. If you believe we have collected personal data from a child, please contact us and we will delete it.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Changes will be posted on this page with a revised “Last updated” date. Where changes are significant, we will notify you by email or by a prominent notice on our website.
17. Contact Us
For any privacy-related questions or to exercise your rights, please contact:
H&K Business Associates Ltd
Data Protection Officer: MD Ahasan Habib
Unit 2B, 420 Eastern Avenue, Gants Hill, IG2 6NQ, United Kingdom
Email: habib@handkbusiness.co.uk (or info@handkbusiness.co.uk for general enquiries)
2. What Data We Collect
We may collect the following categories of personal data:
-
- Identity Data: first name, last name.
- Contact Data: email address, phone number, postal address.
- Technical Data: IP address, browser type/version, device identifiers, operating system, cookies and similar technologies.
- Usage Data: pages visited, time spent on the website, navigation paths.
- Social Media Data (if you log in via Google, Facebook, X/Twitter, etc.): name, email address, profile information.
- Transactional Data: records of services requested or purchased.
We do not intentionally collect special category data (e.g. health, ethnicity, religion) or children’s data.
3. Legal Bases for Processing
We process your personal data only when we have a valid legal basis, including:
- Contract: to provide you with services you request.
- Consent: when you agree (e.g. marketing communications, optional cookies).• Legitimate Interests: to improve services, ensure security, and develop our business.
- Legal Obligation: to comply with UK laws and regulations.
- Public Interest (Data (Use and Access) Act 2025): where anonymised or pseudonymised data may be used for approved research, innovation, or public-interest projects. We will only share your data for such purposes when safeguards are in place.
4. How We Use Your Data
We use your data to:
- Deliver and improve our services and website.
- Manage your account and requests.
- Communicate with you about updates, offers, and news (if you opt in).
- Monitor website performance and detect security threats.
- Comply with legal and regulatory obligations.
- Contribute anonymised or aggregated data to research or innovation projects as permitted by the Data (Use and Access) Act 2025.
5. Sharing Your Data
We may share your personal data with:
- Service providers who process data on our behalf (e.g. hosting, analytics, IT support).
- Business partners where you have requested joint services.
- Regulators or public authorities where legally required.
- Third parties in business transfers, such as mergers or acquisitions.
We do not sell your personal data
6. International Transfers
If we transfer your data outside the UK, we ensure appropriate safeguards are in place, such as UK-approved adequacy decisions or standard contractual clauses.
7. Data Retention
We retain your data only as long as necessary:
- Account/contractual data: up to 6 years after the end of the relationship.
- Marketing data: until you withdraw consent.• Usage/technical data: usually no longer than 2 years, unless required for security or compliance
8. Your Rights
You have the following rights under UK data protection law:
- Access – obtain a copy of your personal data.
- Rectification – correct inaccurate or incomplete data.
- Erasure – request deletion (“right to be forgotten”).
- Restriction – limit how we use your data.
- Data portability – receive your data in a reusable format.
- Object – to certain uses of your data, including marketing.
- Withdraw consent – at any time, where consent is the legal basis.
- Right to information – to know if your anonymised data is being used under the Data (Use and Access) Act 2025.
To exercise your rights, contact us at info@handkbusiness.co.uk.
If you are unhappy with our response, you can complain to the Information Commissioner’s Office (ICO): www.ico.org.uk.
This Privacy Policy explains how H&K Business Associates Ltd (“the Company”, “we”, “our”, or “us”) collects, uses, shares, and protects your personal data when you visit our website, contact us, or use our online services. It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are committed to handling your personal data fairly, lawfully, and transparently.
1. Who We Are
H&K Business Associates Ltd
Unit 2B, 420 Eastern Avenue, Gants Hill, IG2 6NQ, United Kingdom
Website: https://handkbusiness.co.uk
Email: info@handkbusiness.co.uk
We are the data controller for the personal data described in this policy, unless otherwise stated. This means we decide how and why your personal data is processed.
2. Data Protection Officer
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our approach to data protection and for answering any questions about this Privacy Policy or how we handle your personal data.
Data Protection Officer: MD Ahasan Habib
Email: habib@handkbusiness.co.uk
Postal address: Data Protection Officer, H&K Business Associates Ltd, Unit 2B, 420 Eastern Avenue, Gants Hill, IG2 6NQ, United Kingdom
If you have any questions or concerns about how we use your personal data, please contact our DPO in the first instance.
3. What Personal Data We Collect
We may collect and process the following categories of personal data:
- Identity Data: first name and last name.
- Contact Data: email address and phone number.
- Technical Data: IP address, browser type and version, device identifiers, operating system, and data collected through cookies and similar technologies.
- Usage Data: pages visited, time spent on the website, and navigation paths.
- Social Media Data: if you choose to log in via a social media account (such as Google, Facebook, or X/Twitter), we may receive your name, email address, and basic profile information from that provider.
- Transactional Data: records of services you have requested or purchased from us.
We do not intentionally collect special category data (such as data about your health, ethnicity, or religion) through our website. If you send us such information voluntarily and unsolicited, we will delete it unless a specific condition under Article 9 UK GDPR (such as your explicit consent, or the establishment, exercise, or defence of legal claims) allows us to retain it and retention is necessary.
4. How We Collect Your Data
We collect personal data from the following sources:
- Directly from you – when you complete forms on our website, contact us by email or phone, subscribe to updates, or otherwise interact with us.
- From social media authentication providers – where you choose to log in or register using a social media account, that provider shares certain profile information with us in line with your settings on their platform.
- Automatically through our website – technical and usage data is collected through cookies, server logs, and similar technologies when you browse our website (see Section 13).
We do not purchase personal data from third-party marketing list providers.
5. Legal Bases for Processing
We only process your personal data where we have a valid legal basis under UK GDPR. Depending on the circumstances, we rely on:
- Contract – where processing is necessary to provide services you have requested or to take steps at your request before entering into a contract.
- Consent – where you have agreed to the processing, for example receiving marketing communications or accepting optional cookies. You can withdraw your consent at any time.
- Legitimate Interests – where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and freedoms. Our legitimate interests include maintaining the security of our website, preventing fraud and misuse, responding to enquiries, understanding how our website is used, and improving our services. We have assessed these interests and balanced them against your rights and freedoms, and we do not use legitimate interests where the impact on you would be unfair or unexpected.
- Legal Obligation – where processing is necessary to comply with laws and regulations that apply to us, such as accounting, tax, and regulatory requirements.
6. How We Use Your Data
The table below summarises the purposes for which we use your personal data and the legal basis we rely on for each purpose:
| Purpose | Legal Basis |
|---|---|
| Delivering the services you request and managing your account | Contract |
| Responding to your enquiries and requests | Legitimate interests / Contract |
| Operating, maintaining, and improving our website and services | Legitimate interests |
| Sending marketing communications, updates, and offers | Consent (you may opt out at any time) |
| Monitoring website performance and detecting security threats or fraud | Legitimate interests |
| Keeping business and financial records | Legal obligation |
| Complying with legal and regulatory obligations | Legal obligation |
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.
7. If You Do Not Provide Your Data
You are not obliged to provide personal data to us. However, where personal data is required for us to provide our services or respond to your request – for example, contact details needed to reply to an enquiry or to deliver a service you have purchased – failure to provide that data may mean we are unable to fulfil your request or provide the service. Where this is the case, we will tell you at the time.
8. Automated Decision-Making and Profiling
We do not carry out automated decision-making or profiling that produces legal effects or similarly significant effects on individuals. If this changes in the future, we will update this policy and provide you with the information required by law, including your right to request human intervention.
9. Who We Share Your Data With
We may share your personal data with the following categories of recipients:
- Service providers who process data on our behalf under contract, including our website hosting provider, IT support providers, cloud storage providers (for example, Microsoft 365 or Google Workspace), customer relationship management (CRM) systems, and email marketing platforms.
- Analytics providers, such as Google Analytics, which help us understand how visitors use our website (see Section 13 on cookies).
- Professional advisers, including accountants, auditors, lawyers, and insurers, where reasonably necessary.
- Business partners where you have specifically requested services delivered jointly with a partner. We will make this clear to you at the time.
- Regulators and public authorities, such as HMRC or the Information Commissioner’s Office, where we are legally required to do so.
All third-party service providers acting on our behalf are required to process your personal data only on our instructions, under written contracts, and with appropriate security measures in place.
We do not sell your personal data.
10. International Transfers
Some of our service providers – including cloud storage, analytics, and social media authentication providers – are based outside the United Kingdom or store data on servers located outside the UK, including in the United States. This means your personal data may be transferred outside the UK.
Whenever we transfer your personal data outside the UK, we ensure a similar degree of protection is afforded to it by using at least one of the following safeguards:
- Adequacy regulations – transfers to countries that the UK Government has determined provide an adequate level of protection for personal data (for example, transfers to the United States under the UK–US Data Bridge, where the recipient is certified).
- International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission’s Standard Contractual Clauses – contractual terms approved by the UK Government that give personal data the same protection it has in the UK.
- Additional safeguards – where appropriate, we apply supplementary measures such as encryption and data minimisation.
You may contact our DPO for further information on the specific safeguards applied to any transfer of your personal data outside the UK, including a copy of the relevant safeguard where applicable.
11. Data Retention
We keep your personal data only for as long as necessary to fulfil the purposes we collected it for, including legal, accounting, and reporting requirements. Our standard retention periods are:
| Data Category | Retention Period |
|---|---|
| Account and contractual data | Up to 6 years after the end of our relationship, in line with legal and accounting requirements |
| Marketing data | Until you withdraw consent or unsubscribe |
| Enquiry records (no ongoing relationship) | Up to 2 years from last contact |
| Usage and technical data | Usually no longer than 2 years, unless needed for security or compliance |
When personal data is no longer required, we securely delete or anonymise it.
12. Your Rights
Under UK data protection law, you have the following rights:
- Access – request a copy of the personal data we hold about you.
- Rectification – ask us to correct inaccurate or incomplete data.
- Erasure – ask us to delete your data (the “right to be forgotten”), in certain circumstances.
- Restriction – ask us to limit how we use your data, in certain circumstances.
- Data portability – receive the data you provided to us in a structured, commonly used, machine-readable format.
- Objection – object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent – at any time, where consent is the legal basis. This does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, contact our Data Protection Officer at habib@handkbusiness.co.uk or by post at the address in Section 2. We will respond within one month. We will not charge a fee unless your request is manifestly unfounded or excessive, and we may need to verify your identity before acting on your request.
If you are unhappy with how we have handled your data or responded to your request, you have the right to complain to the Information Commissioner’s Office (ICO):
- Website: www.ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.
13. Cookies and Tracking Technologies
We use cookies and similar technologies on our website. Cookies are small text files placed on your device that help websites function and provide information to site owners. We use the following categories:
- Essential cookies – required for the website to operate (for example, security and cookie-consent settings). These do not require consent.
- Functional cookies – remember your preferences and choices to improve your experience. Set only with your consent.
- Analytics cookies – help us understand how visitors use our website, including through Google Analytics. Set only with your consent. Information collected is aggregated and used to improve the website.
- Marketing cookies – used to personalise content and measure the effectiveness of our marketing. Set only with your consent.
Google Analytics is provided by Google LLC. Google may also process this information for its own purposes as described in its privacy policy, available at https://policies.google.com/privacy.
When you first visit our website, our cookie consent banner allows you to accept or reject non-essential cookies. You can change your preferences at any time through the cookie settings link on our website or through your browser settings. Blocking some cookies may affect how the website functions.
Full details of the specific cookies we use, their purposes, their duration, and any third-party providers are set out in our Cookies Policy, available on our website.
14. Security
We use appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, alteration, and disclosure. These include access controls, encryption where appropriate, staff awareness, and contractual obligations on our service providers. While no system can be guaranteed as completely secure, we regularly review and enhance our safeguards. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the ICO as required by law.
15. Children’s Privacy
Our website and services are not directed at children under 13, and we do not knowingly collect personal data from children. If you believe we have collected personal data from a child, please contact us and we will delete it.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Changes will be posted on this page with a revised “Last updated” date. Where changes are significant, we will notify you by email or by a prominent notice on our website.
17. Contact Us
For any privacy-related questions or to exercise your rights, please contact:
H&K Business Associates Ltd
Data Protection Officer: MD Ahasan Habib
Unit 2B, 420 Eastern Avenue, Gants Hill, IG2 6NQ, United Kingdom
Email: habib@handkbusiness.co.uk (or info@handkbusiness.co.uk for general enquiries)
10. Security
We use appropriate technical and organisational measures to protect your personal data. While no system is completely secure, we regularly review and enhance our safeguards.
11. Children’s Privacy
Our services are not directed at children under 13. We do not knowingly collect personal data from children. If you believe we have collected such data, contact us and we will delete it.
11. Children’s Privacy
Our services are not directed at children under 13. We do not knowingly collect personal data from children. If you believe we have collected such data, contact us and we will delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with the revised “Last updated” date. Where required, we will notify you by email or website notice.
13. Contact Us
For privacy-related questions, please contact us:
H&K Business Associates Ltd
Unit 2B, 420 Eastern Avenue, Gants Hill, IG2 6NQ, United Kingdom
Email: info@handkbusiness.co.uk