Legal

    Privacy Policy

    How we collect, use, and protect your personal data.

    Humanity In Business Solutions Ltd

    Effective: October 2026

    Applies to: humanityinbusiness.com

    Who this policy is for

    This Privacy Policy applies to visitors to humanityinbusiness.com and to anyone who contacts HIBS.

    1. Who we are

    Humanity In Business Solutions Ltd ("HIBS", "we", "us", "our") is an independent Governance Architecture practice, incorporated in Bulgaria and operating from Sofia, Bulgaria. We are the data controller for personal data collected through our website and in the course of our work.

    Registered nameHumanity In Business Solutions Ltd
    Operating addressTsar Boris III 225A, Sofia, Bulgaria, 1618
    Data controller contactprivacy@humanityinbusiness.com
    Websitehumanityinbusiness.com

    2. What data we collect on the website

    When you visit humanityinbusiness.com we may collect:

    • Usage and visitor-identification data via the Apollo tracker: pages visited, on-site activity, IP address, and the company associated with your IP address. Set only where you accept analytics cookies. Legal basis: consent.
    • Aggregate, cookieless usage analytics via Vercel: page views and performance metrics, with no cookies, device storage, or persistent identifiers. Legal basis: legitimate interests (no device storage; consent not required under PECR).
    • Contact form submissions: name, email address, company, role, and message content. Legal basis: legitimate interests (responding to enquiries) or pre-contractual steps.
    • Call bookings made through Microsoft Bookings: name, email address, the time you choose and any details you add. Legal basis: legitimate interests (arranging the conversation you requested) or pre-contractual steps.
    • Cookie consent preference: your accept/decline decision, stored locally in your browser. Legal basis: legal obligation (PECR/ePrivacy compliance).

    3. Lawful basis for processing

    We process personal data only where we have a lawful basis to do so under EU GDPR and, where it applies, UK GDPR. The following bases apply to our processing activities:

    Contractual necessityWhen we rely on it: Processing required to deliver a service you have requestedExamples: Delivering an engagement you have agreed with HIBS
    ConsentWhen we rely on it: Processing that requires your explicit agreementExamples: Analytics cookies, marketing communications
    Legitimate interestsWhen we rely on it: Processing necessary for our legitimate business interests where these are not overridden by your rightsExamples: Responding to enquiries, website security, fraud prevention, service improvement
    Legal obligationWhen we rely on it: Processing required to comply with applicable lawExamples: Cookie consent records, regulatory requests

    4. Marketing communications

    We will only send you marketing communications if you have explicitly opted in to receive them. You may withdraw consent at any time by clicking the unsubscribe link in any marketing email or by contacting us at privacy@humanityinbusiness.com.

    5. Third-party data processors

    We share personal data with the following third-party processors where necessary to deliver our services. All processors are subject to data processing agreements and are required to handle personal data in accordance with applicable law.

    Vercel Inc.Location: USAService: Hosting and cookieless, consent-free analytics for the website.Privacy Policy: vercel.com/legal/privacy-policy
    Google LLCLocation: USAService: Google Fonts on the website.Privacy Policy: policies.google.com/privacy
    Apollo.ioLocation: USAService: Visitor identification and engagement analytics on the website, subject to your consent.Privacy Policy: apollo.io/privacy-policy
    Microsoft Ireland Operations LtdLocation: Ireland (EU)Service: Call scheduling through Microsoft Bookings, linked from the Contact page.Privacy Policy: privacy.microsoft.com
    Web3Forms (Web3Creative)Location: IndiaService: Delivery of enquiry form submissions from the website by email. Submissions are held by Web3Forms for up to 30 days.Privacy Policy: web3forms.com/privacy

    Except where stated, the processors listed in this policy are located outside the UK/EEA. Transfers to the USA and India are made under Standard Contractual Clauses or equivalent transfer mechanisms where applicable.

    6. Data retention

    We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. The following retention schedule applies.

    Contact form submissionsRetention Period: 12 months from submissionBasis: Legitimate interests (responding to enquiries)
    Visitor-identification data, websiteRetention Period: Per Apollo.io retention practicesBasis: Consent
    Cookie consent recordsRetention Period: 3 years from consent dateBasis: Legal obligation (PECR/ePrivacy compliance)
    Marketing consent recordsRetention Period: 3 years from consent or until withdrawnBasis: Legal obligation (demonstrating lawful processing)

    When data reaches the end of its retention period it is securely deleted from our systems. Where data is stored with third-party processors, deletion requests are passed to those processors in accordance with our data processing agreements.

    7. Data security

    We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

    • Encryption of data in transit (TLS/HTTPS) and at rest where supported by our infrastructure providers.
    • Access controls limiting personnel access to personal data on a need-to-know basis, subject to internal confidentiality obligations.
    • Regular review of third-party processor security postures and data processing agreements.

    No system is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

    8. Data breach notification

    In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

    • Notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 of EU GDPR / UK GDPR.
    • Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 34 of EU GDPR / UK GDPR.
    • Document the breach, its effects, and the remedial action taken, and make this documentation available to the supervisory authority on request.

    If you believe your data has been compromised, contact us immediately at privacy@humanityinbusiness.com.

    9. Children's data

    Our services are designed for business professionals and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that data promptly. If you believe a child has provided us with personal data, please contact us at privacy@humanityinbusiness.com.

    10. Your rights

    Under EU GDPR and, where it applies, UK GDPR you have the following rights in relation to your personal data. To exercise any of these rights contact us at privacy@humanityinbusiness.com. We will respond within one calendar month.

    Right to be informedTo know what personal data we hold about you, why we hold it, and how we use it. This Privacy Policy fulfils this obligation.
    Right of accessTo request a copy of the personal data we hold about you (a Subject Access Request).
    Right to rectificationTo request correction of inaccurate or incomplete personal data.
    Right to erasureTo request deletion of your personal data where there is no compelling reason for us to continue processing it.
    Right to data portabilityTo receive your personal data in a structured, machine-readable format and transfer it to another controller.
    Right to objectTo object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
    Right to restrict processingTo request that we limit how we use your data in certain circumstances.
    Right to withdraw consentTo withdraw consent for analytics or marketing at any time. Withdrawal does not affect the lawfulness of prior processing.

    11. Complaints and supervisory authorities

    If you have a concern about how we handle your personal data, please contact us in the first instance at privacy@humanityinbusiness.com. We will acknowledge your complaint within 5 working days and aim to resolve it within 30 days.

    If you are not satisfied with our response, or if you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with your supervisory authority:

    Bulgaria / EUAuthority: Commission for Personal Data Protection (CPDP)Website: cpdp.bg
    United KingdomAuthority: Information Commissioner's Office (ICO)Website: ico.org.uk
    EU (general)Authority: Your local EU data protection authorityWebsite: edpb.europa.eu

    12. Governing law and jurisdiction

    This Privacy Policy is governed by EU GDPR as applied in Bulgaria and, for users in the United Kingdom, by UK GDPR. For the avoidance of doubt, users located in the European Economic Area benefit from the full protections afforded by EU GDPR regardless of the governing law of any commercial agreement.

    Disputes relating to this Privacy Policy that cannot be resolved through our complaints process may be referred to the competent courts of Bulgaria, without prejudice to your right to lodge a complaint with your local supervisory authority or to bring proceedings in your country of residence where the law allows.

    13. Changes to this policy

    We may update this Privacy Policy from time to time to reflect changes in our data processing activities, applicable law, or our services. The current version of this policy is always available at humanityinbusiness.com/privacy.

    Where changes are material (for example, changes to the categories of data collected, the purposes of processing, or the third-party processors used), we will publish the updated policy on this page before the changes take effect. Non-material changes (such as clarifications or formatting) may be made without prior notice.

    14. Contact us

    For all privacy-related enquiries, Subject Access Requests, or to exercise any of your rights under this policy:

    Emailprivacy@humanityinbusiness.com
    Websitehumanityinbusiness.com
    Response timeAcknowledgement within 5 working days; substantive response within 30 days

    This Privacy Policy was last updated in October 2026 and supersedes all previous versions. It applies to humanityinbusiness.com.