Privacy Policy - Meet Magento UK

Last revised: April 2026

This policy reflects the requirements of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the amendments introduced by the Data (Use and Access) Act 2025 (DUAA), which came into force on a phased basis from June 2025, with the principal amendments effective from 5 February 2026.

JH is committed to the respectful use and responsible protection of personal data. This privacy policy explains how information about you is collected, stored, and processed when you use the JH website or engage with our business, and provides details of how you can exercise your data subject rights.

This privacy notice describes to you:

who we are and how to contact us
what personal data we collect and how we use it
the legal bases on which we process your data
the categories of third parties with whom we share your personal data
how we retain your information and keep it secure
your rights and how to exercise them, including our complaints process

1. Who We Are

For the purposes of data protection law, the controller of your personal data is J Huskisson Ltd, a company incorporated and registered in England and Wales under company number 07256070, with registered office at 16 Commerce Square, Lace Market, Nottingham, NG1 1HS (referred to in this policy as "JH", "we", "us", or "our").

We are registered as a data controller with the Information Commissioner's Office (ICO). If you would like more information about this policy, or to exercise your data subject rights, please contact us:

Email: privacy@wearejh.com
Post: JH, 16 Commerce Square, Lace Market, Nottingham, NG1 1HS

2. Data We Collect

The sections below set out the personal data we collect, why we collect it, and the legal basis on which we process it under Article 6 of the UK GDPR as amended by the DUAA.

2.1 Newsletter Subscriptions

This data is collected when you subscribe to the JH newsletter.

Data collected: email address
Storage: third-party marketing services (see Section 3)
Retention: until you withdraw consent or request erasure
Purpose: digital marketing and communications
Legal basis: consent (Article 6(1)(a) UK GDPR)

You may withdraw your consent to receive marketing communications at any time by clicking the unsubscribe link in any email or by contacting us at privacy@wearejh.com.

2.2 Job Applications

This data is collected when you apply for a role at JH.

Data collected: name, email address, biographical information, CV, and any other information you provide
Storage: third-party applicant tracking and HR services
Retention: up to 12 months following the conclusion of the relevant recruitment process, unless a longer period is required by law or you consent to retention for future opportunities
Purpose: recruitment activities and talent management
Legal basis: legitimate interests (Article 6(1)(f) UK GDPR) and, where applicable, legal obligations (Article 6(1)(c))

The DUAA confirms that direct marketing and intra-group administrative data sharing may constitute legitimate interests under Article 6(1)(f). Where we rely on legitimate interests for recruitment-related processing, we have conducted a Legitimate Interests Assessment (LIA) and concluded that our interests are not overridden by your rights and freedoms. You may request a copy of our LIA by contacting us.

2.3 General Enquiries

This data is collected when you contact us by email, phone, or via our website contact form.

Data collected: name, email address, phone number, and any other information you choose to provide
Storage: third-party services (see Section 3)
Retention: for as long as necessary to manage and respond to your enquiry, and for up to 6 years thereafter where relevant to potential legal claims
Purpose: responding to enquiries, sales activities, business development, and general support
Legal basis: legitimate interests (Article 6(1)(f)), contract performance (Article 6(1)(b)), and legal obligations (Article 6(1)(c)) as applicable

2.4 Website Behaviour Tracking

This data is collected when you use the JH website.

Data collected: marketing information, technical information (e.g. IP address, browser type, device), and usage data
Storage: cookies and third-party analytics and marketing services
Retention: in accordance with each service's data retention practices; typically 13–26 months for analytics data
Purpose: website optimisation, digital marketing, and content improvement
Legal basis: consent (Article 6(1)(a) UK GDPR) for non-essential cookies; legitimate interests (Article 6(1)(f)) for strictly necessary cookies and certain analytics

Cookie rule updates under the DUAA: from 5 February 2026, certain low-risk cookies — specifically those used for statistical purposes and to improve website functionality — may be set without requiring prior consent, provided they do not involve the processing of special category data and appropriate safeguards are in place. We will update our cookie banner to reflect these changes. Essential cookies required for the operation of the website do not require consent.

Where we rely on consent for cookies or marketing, you may withdraw that consent at any time by adjusting your cookie preferences or contacting us.

3. Who We Share Data With

We may provide your personal data to the following recipients for the purposes set out in this notice. All third-party processors are required to handle your data in accordance with applicable data protection law and are bound by appropriate data processing agreements.

Service providers

Digital office services: Google Workspace (Gmail, Drive), Slack, Dropbox
Marketing and CRM services: LinkedIn Ads and Marketing Solutions, Google Ads, Meta (Facebook) Custom Audiences, Dotdigital
Analytics services: Google Analytics, Hotjar
Content and tag management: Google Tag Manager, MyFonts
Recruitment and HR services: as applicable
Legal and professional advisors, including solicitors

Other recipients

Any parties where we are legally required or permitted to do so
Any other parties where we have your specific consent to do so

3.1 International Transfers

Although we are based in England, some of our third-party service providers are based or process data outside the UK and European Economic Area (EEA). Where we transfer your personal data internationally, we ensure that appropriate safeguards are in place.

Under the DUAA, the test for international transfers has been updated: we are required to ensure that the standard of protection in the destination country is "not materially lower" than the standard in the UK. In practice, transfers will be made:

to countries covered by a UK adequacy decision (including the EU/EEA, which remains subject to a UK adequacy decision renewed in December 2025 until 27 December 2031);
under the International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, where no adequacy decision applies; or
on another lawful basis as permitted by UK GDPR.

4. How We Keep Data Secure

JH has technical and organisational measures in place to protect your personal data against loss, unauthorised access, disclosure, alteration, and destruction. Access to personal data is restricted to authorised employees and third-party processors who require it to perform their functions.

Our security measures include:

staff training and enforcement of data security practices
role-based access controls and restriction of access to personal data
use of secure technologies including SSL/TLS encryption and encrypted storage
anonymisation and aggregation of data where appropriate
regular reviews of our information collection, storage, and processing practices
incident response and data breach procedures in accordance with ICO guidance

We will notify the ICO of any personal data breach that is likely to result in a risk to your rights and freedoms within 72 hours of becoming aware of it, and will notify affected individuals where the risk is likely to be high, in accordance with our legal obligations under the UK GDPR.

5. Your Information Rights

Data protection law provides you with the following rights in relation to your personal data. These rights are not absolute and are subject to conditions and exemptions set out in applicable law.

Right to be informed — to receive clear and transparent information about how your personal data is collected and used (this privacy policy fulfils this obligation)
Right of access — to request a copy of the personal data we hold about you (a data subject access request, or DSAR)
Right to rectification — to have inaccurate or incomplete personal data corrected
Right to erasure — to request deletion of your personal data in certain circumstances
Right to restriction of processing — to request that we limit how we use your personal data in certain circumstances
Right to object — to object to processing based on legitimate interests or for direct marketing purposes
Right to data portability — to receive your personal data in a commonly used, machine-readable format where processing is based on consent or contract
Rights in relation to automated decision-making — not to be subject to decisions made solely by automated means that have a significant effect on you, unless certain conditions are met (see Section 5.1 below)

5.1 Automated Decision-Making

The DUAA has updated the rules on automated decision-making under UK GDPR. We do not currently use fully automated decision-making processes that produce legal or similarly significant effects on individuals. If this changes, we will update this policy and notify you where required.

5.2 Data Subject Access Requests (DSARs)

Following changes introduced by the DUAA (in force from 2025), we are required to conduct a "reasonable and proportionate" search in response to your DSAR, taking into account factors including the nature and scope of your request and our size and resources as an organisation. We will respond to your request within one calendar month of receipt.

We may ask you to clarify the scope of your request to help us respond effectively. We may "stop the clock" (pause the response deadline) while we await further information from you, in accordance with the DUAA.

5.3 How to Exercise Your Rights

To exercise any of your rights, or if you have any concerns about how your personal data is being handled, please contact us:

Email: privacy@wearejh.com
Post: JH, 16 Commerce Square, Lace Market, Nottingham, NG1 1HS

We will respond without undue delay and in any event within one calendar month. We may extend this period by a further two months where requests are complex or numerous, in which case we will notify you within the first month.

6. Data Protection Complaints

Under changes introduced by the DUAA (coming into force 19 June 2026), individuals will have a statutory right to complain directly to a controller about how their personal data is being processed. In anticipation of this, we are committed to handling all data protection concerns promptly and fairly.

If you have a concern about how we handle your personal data, please contact us in the first instance at privacy@wearejh.com. We will acknowledge your complaint within 30 days and provide a full response without undue delay.

If you are not satisfied with our response, or if you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

7. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in the law, our data practices, or the services we provide. The current version will always be available at wearejh.com. Where we make material changes, we will take reasonable steps to notify individuals whose data we hold, where appropriate.

This policy was last revised in April 2026 to reflect the amendments to UK data protection law introduced by the Data (Use and Access) Act 2025, which came into force on a phased basis from June 2025, with the principal provisions effective from 5 February 2026. Further changes relating to the statutory complaints right are expected to come into force on 19 June 2026, at which point this policy will be updated accordingly.

8. Definitions

"Controller" means the natural or legal person who determines the purposes and means of processing personal data.
"DUAA" means the Data (Use and Access) Act 2025.
"DPA 2018" means the Data Protection Act 2018.
"ICO" means the Information Commissioner's Office, the UK's independent data protection regulator.
"Personal data" means any information relating to an identified or identifiable living individual.
"Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
"UK GDPR" means the UK General Data Protection Regulation, as retained in UK law by the European Union (Withdrawal) Act 2018 and amended by the DUAA.

PrivacyPolicy