Privacy policy

Under the UK General Data Protection Regulation (UK GDPR), we process personal data under defined lawful bases: responding to enquiries and scheduling discovery calls (consent and legitimate interests); preparing proposals, onboarding, and delivering contracted services (performance of a contract); administering client accounts, billing, and tax compliance (legal obligation and contract); and maintaining professional communications regarding ongoing engagements (legitimate interests).

When you make an enquiry or book appointments through our website, email, WhatsApp, LinkedIn, or Google Calendar, the details you share are used solely to arrange consultations, coordinate schedules, and manage ongoing correspondence. We ensure all communication channels are handled securely and used exclusively for legitimate business purposes.

Where JonesVA provides recruitment resourcing and candidate administration support, we act as a Data Processor on our clients' behalf and strictly under their instructions. Our clients remain the Data Controllers responsible for providing privacy notices and establishing lawful bases for candidate processing. We maintain strict confidentiality and robust data protection over all candidate information.

We may share personal information with trusted third-party service providers and authorised software platforms (such as cloud storage, email hosting, appointment scheduling, and accounting tools) strictly required to operate our business and deliver our services. All providers process data under binding data protection terms. We explicitly do not sell, rent, or trade personal information to any third parties.

Certain software tools we use (including Google Workspace, WhatsApp, and LinkedIn) may process or store data outside the UK. Where international data transfers occur, we ensure appropriate safeguards are implemented in accordance with UK data protection laws, such as UK Adequacy Regulations or the UK International Data Transfer Agreement (IDTA) and standard contractual clauses.

We maintain technical and organisational measures to safeguard your personal data against unauthorised access, alteration, disclosure, or destruction. Backed by over 20 years of executive administrative experience, all client documents, workflows, and commercial information are handled with rigorous professional confidentiality.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was gathered, including the duration of our client engagement and a reasonable subsequent period to satisfy statutory, legal, accounting, and tax reporting requirements (typically up to 6 years following contract completion), after which data is securely deleted.

Our website uses privacy-friendly, functional cookies essential for site performance, navigation, and security. We do not use intrusive third-party marketing or cross-site tracking cookies. You can manage or adjust your cookie preferences through your web browser settings at any time.

Our website may contain links to external third-party platforms, such as LinkedIn. We do not control and are not responsible for the privacy practices, content, or policies of external sites. We encourage you to review the privacy notices of any external websites you visit.

Under UK GDPR, you have the right to request access to your personal data (Subject Access Request), request rectification of inaccurate records, request erasure ('right to be forgotten'), restrict or object to our processing, request data portability, and withdraw previously given consent at any time without affecting prior lawful processing.

If you have concerns regarding how we collect or process your personal information, please contact us directly so we can resolve the matter promptly. You also have the statutory right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), via ico.org.uk or by calling 0303 123 1113.