Privacy Policy

Last updated: 23.8.2026

Hyfa is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, use, store and protect personal information when you visit or use the Hyfa website at https://hyfa.co.

For the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the organisation responsible for your personal data is:

Hyfa (Un) Limited
15710827
2nd Floor, 10–12 Love Lane, Pinner, Middlesex, HA5 3EF

In this policy, “Hyfa”, “we”, “us” and “our” refer to the organisation responsible for processing your personal information.

1. Information we collect

We may collect personal information that you provide to us when you:

• contact us through our website;
• submit an enquiry or request information;
• complete a workforce or payroll assessment;
• subscribe to communications or updates;
• apply for a role or contact us about employment opportunities;
• register for or request information about Hyfa Foundation programmes;
• download or request resources;
• otherwise communicate with us through the website.

Depending on how you interact with the website, this information may include:

• your name;
• email address;
• telephone number;
• company or organisation name;
• job title or role;
• information relating to your organisation, workforce or payroll operations;
• information provided when completing an assessment;
• information contained in an employment or recruitment application;
• any other information you choose to provide to us.

We may also automatically collect certain technical information when you visit the website, such as your IP address, browser type, device information, operating system, pages visited and information about how you interact with the website.

2. How we use your information

We use personal information where necessary to:

• respond to enquiries and requests;
• provide information, resources or services you have requested;
• administer assessments and provide relevant results or recommendations;
• communicate with you about Hyfa and its services;
• process and manage recruitment enquiries and applications;
• administer Hyfa Foundation programmes and enquiries;
• improve our website, content, products and services;
• understand how visitors use our website;
• maintain website security and prevent fraud, abuse and spam;
• comply with our legal and regulatory obligations; and
• establish, exercise or defend our legal rights where necessary.

We will only use your personal information where we have a lawful basis to do so.

3. Our lawful bases for processing

Depending on the circumstances, we may rely on one or more of the following lawful bases under UK GDPR:

• Consent – where you have given us permission to use your personal information for a specific purpose.
• Contract – where processing is necessary to enter into or perform a contract with you.
• Legitimate interests – where processing is necessary for our legitimate business interests and those interests are not overridden by your rights and interests.
• Legal obligation – where we are required to process information to comply with a legal or regulatory obligation.

Where we rely on consent, you can withdraw your consent at any time.

4. Marketing communications

Where permitted by law, we may contact you with information about Hyfa, our services, resources, events or other relevant updates.

Where your consent is required, we will ask for it before sending marketing communications.

You can unsubscribe from marketing communications at any time by using the unsubscribe option included in the communication or by contacting us using the details below.

5. Assessment information

If you complete a Hyfa assessment, we may collect information about your workforce, payroll processes, compliance arrangements and related business operations.

We use this information to provide and improve the assessment and, where applicable, to provide relevant recommendations or contact you about Hyfa services.

You should not provide information about other individuals unless you are authorised to do so and have an appropriate lawful basis for providing that information to us.

6. Recruitment information

If you contact us about employment opportunities or submit an application, we may process information such as your name, contact details, CV, employment history, qualifications, skills and other information relevant to your application.

We use this information to assess applications, communicate with candidates and manage our recruitment process.

Where appropriate, we may retain recruitment information for a reasonable period after the relevant recruitment process has ended.

7. Cookies and similar technologies

Our website uses cookies and similar technologies.

Some cookies are necessary for the website to operate correctly. Other cookies may help us understand how visitors use the website, improve website performance and measure the effectiveness of our content.

Where required by law, we will ask for your consent before placing non-essential cookies on your device.

You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.

8. Third-party services

We may use trusted third-party service providers to operate and improve the website and provide services to you.

These providers may process personal information on our behalf, for example in relation to:

• website hosting;
• website analytics;
• form submissions;
• email communications;
• recruitment;
• security and spam prevention; and
• other website functionality.

Where a third party processes personal information on our behalf, we take appropriate steps to ensure that the information is processed securely and in accordance with applicable data protection law.

Some third-party services may also collect information independently of Hyfa. Their own privacy policies will apply to their processing of your information.

Our website may also contain links to or embedded content from third-party websites. We are not responsible for the privacy practices or content of those third-party websites.

9. Sharing your information

We do not sell your personal information.

We may share personal information where necessary with:

• service providers who process information on our behalf;
• professional advisers;
• regulators, law enforcement agencies or other authorities where we are legally required to do so;
• third parties where necessary to protect our rights, property or the safety of our users; or
• another organisation where necessary in connection with a business transaction, such as a merger, acquisition or restructuring.

We only share information where there is an appropriate lawful basis for doing so.

10. International transfers

Some of our service providers may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that your information receives an appropriate level of protection, in accordance with UK data protection law.

11. How long we keep your information

We only retain personal information for as long as reasonably necessary for the purposes for which it was collected.

The length of time we retain information will depend on factors including:

• the purpose for which the information was collected;
• our ongoing relationship with you;
• legal, regulatory or accounting requirements;
• our legitimate business needs; and
• the need to establish, exercise or defend legal claims.

When information is no longer required, we will securely delete or anonymise it where appropriate.

12. How we protect your information

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

13. Your data protection rights

Under UK data protection law, you may have the right to:

• request access to the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain processing, including processing based on legitimate interests;
• request the transfer of your information to another organisation in certain circumstances; and
• withdraw consent where we rely on consent as our lawful basis for processing.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe your personal information has been handled unlawfully.

For more information about your rights, visit the Information Commissioner’s Office website.

14. Children’s privacy

The main Hyfa website is intended for businesses, organisations and adults.

The Hyfa Foundation provides financial education for young people aged 16–25. Where the Foundation collects personal information from participants or other individuals, additional information may be provided at the point of collection where appropriate.

We do not knowingly collect personal information from children under the age of 13 through the general website.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or how we process personal information.

Any changes will be published on this page and the “Last updated” date will be amended accordingly.

16. Contact us

If you have questions about this Privacy Policy, want to exercise your data protection rights or have concerns about how we process your personal information, please contact us:

Email: contact@hyfa.co

Address:
Hyfa (Un) Limited
2nd Floor, 10–12 Love Lane, Pinner, Middlesex, HA5 3EF

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO).

Information about the ICO and how to make a complaint is available on the ICO’s website.