Privacy Notice

Last updated: August 2026

1. About Oxley HRS

Oxley HRS is a Gibraltar-based Human Resources and Health & Safety consultancy operated by David Oxley trading as Oxley HRS.

For the purposes of applicable data protection legislation, David Oxley trading as Oxley HRS is the data controller in respect of personal information for which Oxley HRS determines the purposes and means of processing.

Business: David Oxley trading as Oxley HRS
Gibraltar Business Licence: BL211213
Email: info@oxleyhrs.com
Website: www.oxleyhr.com

This Privacy Notice explains what personal information we collect, how and why we use it, who we may share it with, how long we retain it and the rights available to you.

2. Information We Collect

The personal information we collect depends upon how you interact with us and the services we provide. It may include:

• your name and contact details;
• your employer, organisation and job title;
• information you provide when contacting us through our website, by email, telephone or other means;
• correspondence and records of communications with you;
• information necessary to provide Human Resources, Health & Safety, payroll, training or other consultancy services;
• billing and administrative information; and
• technical information relating to your use of our website, including information collected through cookies and similar technologies.

In the course of providing professional services, we may also process personal information relating to employees, workers, applicants and other individuals supplied to us by our clients.

Depending upon the nature of the work, this may include special category personal data or other information requiring additional protection.

Please do not provide sensitive or confidential personal information through our general website contact form unless it is necessary for your enquiry.

3. How We Use Personal Information

We may use personal information to:

• respond to enquiries and requests for information;
• communicate with prospective and existing clients;
• provide and administer our professional services;
• manage our relationship with clients;
• provide HR, Health & Safety, payroll and training services where engaged to do so;
• maintain appropriate business and financial records;
• prepare quotations, issue invoices and administer payments;
• manage and improve our website and services;
• maintain the security of our systems and information;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal claims where necessary.

We will not use personal information for purposes which are incompatible with those for which it was originally collected unless permitted or required by law

4. Our Role When Providing Services to Clients

The data protection role of Oxley HRS will depend upon the nature of the particular service being provided.

For some activities, Oxley HRS determines how and why personal information is processed and therefore acts as a data controller.

For other services, we may process personal information on behalf of a client and in accordance with that client's instructions. In those circumstances, the client will generally be the data controller and Oxley HRS will act as a data processor.

Appropriate data protection arrangements will be incorporated into our contractual relationship with clients where required.

5. Our Lawful Bases for Processing

Depending upon the circumstances, we process personal information where:

• processing is necessary to take steps at your request before entering into a contract or to perform a contract;
• processing is necessary for our legitimate business interests or those of a third party, provided those interests do not override your rights and interests;
• processing is necessary to comply with a legal obligation;
• you have provided consent; or
• another lawful basis is available under applicable data protection legislation.

Where processing is based upon consent, you may withdraw your consent at any time.

Where special category personal data is processed, we will ensure that both an appropriate lawful basis and an additional condition permitting the processing of that information apply.

6. Information We Receive About Other People

As an HR and Health & Safety consultancy, we may receive personal information about individuals from our clients or other parties rather than directly from the individual concerned.

This may occur, for example, when we provide:

• HR consultancy and advisory services;
• payroll services;
• workplace investigations;
• grievance or disciplinary support;
• Health & Safety services;
• training; or
• other professional support to an organisation.

Where we receive information in this way, we will process it only for appropriate purposes and in accordance with applicable data protection requirements and our contractual obligations.

7. Sharing Personal Information

We do not sell personal information.

We may share personal information where necessary with organisations that assist us in operating our business and providing our services. These may include:

• website and IT service providers;
• email and communications providers;
• cloud storage and business software providers;
• payroll and accounting systems;
• professional advisers;
• payment and banking providers; and
• public authorities, regulators, courts or law enforcement bodies where disclosure is required or permitted by law.

Where another organisation processes personal information on our behalf, we take appropriate steps to ensure suitable data protection arrangements are in place.

We will not disclose personal information to third parties for their own marketing purposes without an appropriate lawful basis.

8. International Transfers

Some technology and service providers may process or store personal information outside Gibraltar.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with applicable data protection legislation and that any required safeguards or lawful transfer mechanisms are in place.

9. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, regulatory, contractual and professional requirements.

The appropriate retention period will depend upon factors including:

• the nature of the information;
• the purpose for which it is held;
• our relationship with the individual or organisation;
• applicable legal or regulatory requirements; and
• whether the information may be required in connection with a legal claim.

When personal information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.

10. Website Enquiries

Where you submit an enquiry through our website or contact us using the details provided on the website, we will use the information you provide primarily to respond to your enquiry.

If your enquiry develops into a prospective or existing client relationship, we may retain relevant information as part of our business and client records.

We ask that you do not submit unnecessary sensitive personal information through the general website contact form.

11. Cookies and Website Information

Our website uses cookies and similar technologies.

Some cookies are necessary for the website to function correctly. Other cookies, such as analytics cookies, will only be used where permitted and, where consent is required, after you have provided that consent.

You can manage your cookie preferences through the cookie controls provided on the website.

Further information about the cookies we use is available in our Cookie Policy.

12. Security

We take appropriate technical and organisational measures to protect personal information against unauthorised or unlawful processing and against accidental loss, destruction, alteration or disclosure.

Access to personal information is limited to those who require it for legitimate business purposes.

While we take appropriate measures to protect information, transmission of information over the internet cannot be guaranteed to be completely secure.

13. Your Data Protection Rights

Depending upon the circumstances and subject to applicable legal exemptions, you may have the right to:

• be informed about how your personal information is used;
• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• request restriction of processing;
• object to certain processing;
• receive certain personal information in a portable format;
• withdraw consent where processing is based upon consent; and
• exercise rights relating to automated decision-making and profiling.

If you wish to exercise any of these rights, please contact us at info@oxleyhrs.com.

We may need to verify your identity before responding to a request.

There will normally be no charge for exercising your data protection rights, although a reasonable fee may be charged or a request may be refused where permitted by law, for example where a request is manifestly unfounded or excessive.

14. Complaints

If you have any questions or concerns about how we process your personal information, please contact us in the first instance so that we have an opportunity to investigate and respond.

You also have the right to make a complaint to the Gibraltar Regulatory Authority (GRA), Gibraltar's supervisory authority for data protection.

Information about the GRA and how to make a complaint is available from www.gra.gi.

15. Contact Us

For questions about this Privacy Notice, the way Oxley HRS processes personal information or to exercise your data protection rights, please contact:

David Oxley
Oxley HRS
Email: david@oxleyhrs.com

16. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our services, website, business practices or legal requirements.

The current version will be published on this website and the date at the top of this notice will be updated when material changes are made.