Your privacy matters to me.

Who I am and how to contact me

Andrew Metcalf is the sole trader operating as Piece by Piece HR & Recruitment Consultancy. I work primarily from East Riding of Yorkshire and support clients throughout the UK. For privacy matters, email [email protected] or telephone 07764 746952.

Postal correspondence: Andrew Metcalf trading as Piece by Piece HR & Recruitment Consultancy, c/o Spotlight Hair & Beauty, 723 Abbeydale Road, Sheffield S7 2BE, UK. This is a correspondence address, not a public consultancy office.

I am generally the data controller for my own business enquiries, client administration and candidate recruitment activities. For some HR assignments I may process an employer’s information on their documented instructions, in which case the responsibilities and arrangements are agreed separately. See business information for further details.

Information I collect

Depending on how you interact with my business, I may collect:

• Enquiry and business contact details: your name, organisation, work email, telephone number, business size, service interests, message and correspondence.
• Client and project information: business contacts, proposed scope, contractual information, meeting notes, invoices and project communications.
• Recruitment information: where you contact me as a candidate or I undertake an agreed recruitment assignment, the information explained in my separate Candidate Privacy Notice.
• Technical website data: essential information that website hosting and security services may process, such as IP address, browser/device details, timestamps, requested pages and anti-abuse signals.

Please do not include medical details, employee names, disciplinary allegations, identity documents, DBS information or CVs in the general website enquiry form. We can arrange an appropriate channel if sensitive case material is needed.

Purposes and lawful bases

I use personal information for the following purposes, with the relevant lawful basis under the UK GDPR assessed for each activity:

Where a separate lawful basis or an additional condition is required for health or other special-category information, or for criminal-offence information, I assess that before processing it. I do not treat a routine enquiry-form checkbox as blanket consent for unrelated uses.

Where the information comes from

Most enquiry information comes directly from you. I may also receive relevant business contact details from your organisation, a professional introduction or publicly available professional sources. For HR assignments, information may come from the commissioning employer and authorised participants; a separate engagement may require its own privacy information and data processing agreement.

Email delivery, hosting and other recipients

I use Zoho Mail for my business email and Cloudflare to host and protect this website. Website enquiries may be prepared as messages in your own email application; if the site's automated submission function is enabled, a form email-delivery provider (configured in this site's code as Resend) and Cloudflare’s Turnstile anti-abuse service may also process the information necessary to deliver and secure the enquiry. Your form screen indicates whether it sends automatically or opens an email draft.

Information may also be shared, when necessary and authorised, with professional advisers, accounting providers, relevant client representatives, secure technology providers or public authorities where the law requires it. I do not sell personal data or publish enquiries. Any client or candidate sharing is limited to the relevant purpose and lawful arrangements.

Some providers may use systems or support teams outside the UK. Where personal information is transferred internationally, the applicable legal basis, adequacy regulations or suitable safeguards must be established for that transfer. Details relevant to a particular engagement can be requested via the contact email above.

Postal correspondence: Mail sent to my Sheffield correspondence address may be received by a person authorised to accept and forward business post. I ask correspondents not to send sensitive employment, health, investigation or candidate material there without first agreeing secure handling directly with me.

How long I keep information

I keep information only for as long as it is reasonably needed for the stated purpose, taking account of outstanding enquiries, contractual obligations, tax and accounting rules, legal limitation periods, and potential disputes. My working retention approach is:

• Unsuccessful or inactive business enquiries: normally review for deletion within 12 months of the last meaningful contact, unless there is a documented reason to keep them longer.
• Client contracts, advice and project records: normally up to six years after the engagement ends, subject to case-specific obligations or a documented longer or shorter period.
• Tax and financial records: for the period required under applicable HMRC rules, with records ordinarily kept for at least five years after the relevant Self Assessment submission deadline.
• Candidate information: see the separate Candidate Privacy Notice, which explains role-related retention and optional future-opportunity arrangements.
• Security logs: retained according to the operational requirements and retention settings of the relevant provider.

Relevant records may need to be preserved longer where a complaint, claim, investigation or legal requirement makes that necessary. These periods should be reflected in practical deletion and archive procedures as services begin operating.

How I protect information

I use business email and hosting services with access controls and account security features. Information is shared only where necessary for the work and appropriate confidentiality and access arrangements are agreed for sensitive HR cases. No internet transmission or technical system can be guaranteed completely risk-free.

For confidential employee files or recruitment material, please contact me first so we can agree a suitable secure means of sharing, rather than sending sensitive files through the general form.

Your rights

Depending on the circumstances and lawful basis, you may have rights to access your personal data, correct inaccuracies, request erasure, restrict processing, object to certain processing, and receive certain information in a portable format. Where processing is based on consent, you can withdraw it without affecting prior lawful processing.

To exercise a right, email [email protected]. I may ask for information needed to verify your identity. I will respond within the legal time limits, generally without undue delay and within one calendar month, subject to applicable rules and extensions.

Questions, concerns and complaints

If you have a concern about how I use your information, please email [email protected]. You can also use my Data Protection Complaints Procedure. I will acknowledge a data protection complaint within 30 days and investigate and respond without undue delay.

You may raise a complaint with the Information Commissioner’s Office (ICO), which is the UK data protection regulator.

Website cookies and changes to this notice

This website does not include advertising pixels or Google Analytics in the supplied site code. Some essential network-security technologies may be used by the website host or form anti-spam service. Read the Cookie Notice for the current position.

I will review this notice when services, systems, third parties or legal requirements change. The date below shows when this version was prepared.