Privacy Policy

Last updated: 14 August 2026

Introduction

The HSRA Group Ltd ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store and protect your information when you visit our website (www.thehsra.co.uk), make an enquiry, book an assessment or purchase a testing kit from us.

This policy is written in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Relationship to Other Legal Documents

This Privacy Policy forms part of a wider set of legal terms governing your use of our website and services. It should be read alongside our Terms, which govern your use of our website and the supply of our services and products. Where you engage our services or purchase a testing kit, both our Terms and this Privacy Policy will apply.

Data Controller

The data controller responsible for your personal data is: The HSRA Group Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Email: info@thehsra.co.uk. Phone: 0208 0506 213. For data protection enquiries, please contact us via our Contact page.

What Personal Data We Collect

Information You Provide Directly

• Name, email address, phone number, company name and postcode (via contact, consultation and booking forms)
• Site and property details relating to the premises you want assessed, including the site address and access information
• Details of the services you require (for example fire, Legionella, health and safety or disability access assessments)
• Billing details when you purchase a testing kit or pay for an assessment (payment card details are processed by our payment provider and are never stored by us)
• Any additional information included in messages or enquiries

Information Collected Automatically

• IP address (anonymised where possible)
• Approximate location used to display the correct cookie consent notice for your region
• Browser type, device type and operating system
• Pages visited and time spent on the website
• Referring URLs and interaction data
• Cookie preferences and consent records

Information From Third Parties

• Publicly available reviews (for example Google Reviews displayed on our website)

How We Use Your Data

We process your personal data for the following purposes:

• Responding to enquiries, consultation requests and quote requests
• Scheduling, carrying out and reporting on risk assessments at your premises
• Fulfilling testing kit orders, arranging delivery and returning laboratory results to you
• Preparing quotations, assessment reports and service information
• Communicating with you about your enquiry, booking or order
• Improving website performance and user experience (analytics)
• Tracking how visitors find our website (with consent)
• Protecting our website from spam and abuse
• Complying with legal and regulatory obligations

Contractual and Service Relationship

Where you request a quotation, book an assessment or purchase a testing kit, we process your data as necessary to take steps at your request before entering into a contract, and to perform that contract. Assessment reports and laboratory results are retained as part of our service records and may be required to demonstrate your compliance history.

Lawful Bases for Processing

• Contract - to provide quotations, assessments, reports and products you have requested
• Consent - for analytics and marketing cookies, and for any marketing communications
• Legitimate interests - to respond to enquiries, protect our website and improve our services
• Legal obligation - to meet accounting, tax and regulatory requirements

Cookies

We use cookies to run the website and understand how it is used. When you first visit, you will see a consent notice appropriate to your region. You can change your preferences at any time using the cookie settings control on the site.

Necessary Cookies

Required for the website to function, including cookie consent storage and spam protection. These do not require consent.

Analytics Cookies

Used with your consent to understand how visitors use the website (for example Google Analytics via Google Tag Manager). IP addresses are anonymised where possible.

Functional Cookies

Remember your preferences, such as your cookie choices and region, to improve your experience on repeat visits.

Third-Party Services

We use a small number of trusted third parties to run our website and deliver our services. These include our website hosting and content delivery providers, our payment processor (Stripe) for testing kit purchases and online payments, Google services (analytics, maps and reviews), our email delivery provider, and UKAS-accredited laboratories that analyse water samples from testing kits. Each provider only receives the data necessary to perform its function.

International Data Transfers

Some of our providers may process data outside the UK. Where this happens, transfers are protected by UK adequacy regulations, the UK International Data Transfer Agreement, or equivalent safeguards.

Data Retention

We retain personal data only for as long as necessary:

• Enquiries and quote requests - up to 2 years
• Assessment reports and related records - retained for the period required to support your compliance history and our legal obligations
• Testing kit orders and laboratory results - retained in line with our contractual and legal obligations
• Cookie consent records - 12 months
• Analytics data - in line with configured retention settings
• Server logs - typically 30 days

Your Rights

Under UK GDPR you have the right to access your personal data, request correction or erasure, restrict or object to processing, request data portability, and withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at info@thehsra.co.uk. We will respond within one month.

Data Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls, and reputable hosting providers. No method of transmission over the internet is completely secure, but we take reasonable steps to protect your information.

Children's Privacy

Our website and services are aimed at businesses and property owners and are not directed at children. We do not knowingly collect personal data from anyone under 16.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page. Where changes are significant, we will take reasonable steps to bring them to your attention.

Complaints

If you have a concern about how we handle your data, please contact us first at info@thehsra.co.uk so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.