Privacy Notice
Hia Legal Limited

Effective date: 19 August 2026

This Privacy Notice explains how Hia Legal Limited (“Hia Legal”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal data in connection with our recruitment services and related activities. It also sets out your rights under applicable data protection law, including the UK GDPR and the Data Protection Act 2018.

We are committed to handling personal data responsibly, transparently and in accordance with the highest professional standards expected of a specialist legal recruitment firm.

1. Data Controller
Hia Legal Limited is the data controller for the purposes of UK data protection legislation. We are registered with the Information Commissioner’s Office under registration number ZB526976 (registered 3 March 2023; expires 2 March 2027).

Registered address
C/O Auria, 48 Warwick Street, London W1B 5AW

Trading / correspondence address
5th Floor, 20 Old Bailey, London EC4M 7AN

Data Protection Officer
Mr Matthew Du Caurroy Tribe
Email: [email protected]

General data protection enquiries
Email: [email protected]

2. Who We Are and Whose Data We Process
Hia Legal is a recruitment agency and recruitment business as defined under the Employment Agencies and Employment Businesses Regulations 2003. We process personal data of:

• Prospective and placed candidates for permanent, temporary or contract roles
• Prospective and current client contacts
• Supplier and professional contacts who support our services
• Our employees, consultants and temporary workers

3. Personal Data We Collect
We collect personal data directly from you (via our website, email, telephone or other means) and, where permitted, from publicly available professional sources. The categories of data we may process include:

• Identity and contact details (name, job title, email, telephone, postal address)
• Professional information (CV/résumé, skills, experience, education, qualifications, career history)
• Professional profiles available in the public domain (e.g. LinkedIn)
• Preferences (preferred locations, practice areas, contact preferences)
• References and other information relevant to recruitment
• Technical data generated when you interact with our website (IP address, browser type, pages visited, access times, referral sources)

We only collect data that is relevant and necessary for our legitimate recruitment and business purposes.

4. Our Legitimate Interests
As a specialist legal recruitment firm, the exchange of candidate and client data is fundamental to our core service of matching talent with opportunity. Maintaining an accurate, up-to-date database of candidates and clients enables us to support career progression and meet clients’ resourcing requirements efficiently and effectively. This constitutes our legitimate interest under data protection law.

5. Purposes of Processing and Legal Bases
We process personal data for the following purposes:

• Facilitating recruitment and resourcing activities, including candidate introduction and organisational planning
• Communicating with you regarding suitable opportunities or our services
• Improving our recruitment processes, website and related services (using aggregated or anonymised data where practicable)
• Complying with legal and regulatory obligations
• Managing our commercial relationships and internal administration

Legal bases

• Legitimate interests (as described above)
• Performance of a contract or steps taken at your request prior to entering a contract
• Compliance with legal obligations
• Consent (where required, for example for certain marketing communications or specific introductions)

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6. Consent and Engagement
By submitting a CV, applying for a role via our website, or contacting one of our consultants regarding your career, you provide consent for us to process and retain your personal data for recruitment purposes. We will only introduce you to a client with your prior explicit consent.

Given the long-term nature of legal careers, candidates frequently re-engage with us years after an initial placement. Accordingly, your consent includes our continued retention of your details until you request deletion or suppression.

7. Sharing and Transfers of Personal Data
We do not sell, lease or rent personal data. We share personal data only:

• With your explicit consent (for example, when introducing you to a client)
• Where required by law or regulation
• With trusted service providers who process data on our behalf under appropriate contractual safeguards

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any shortlisting or matching is subject to human oversight.

8. International Transfers
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK data protection law (for example, adequacy decisions or standard contractual clauses).

9. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration. While we take every reasonable step to safeguard data, no method of transmission over the internet is completely secure, and any transmission is at your own risk.

10. Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including our legitimate business interests and legal obligations. Retention decisions take into account:

• The nature and sensitivity of the data
• Its accuracy and currency
• Whether a placement or interview has occurred
• Industry practice and the typical career cycles within the legal sector

We may archive, pseudonymise or delete data when it is no longer required. You may request deletion at any time (subject to any overriding legal requirements).

11. Your Rights
Under UK data protection law you have the following rights (subject to certain exemptions):

• Right of access
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to restriction of processing
• Right to object to processing (including for direct marketing)
• Right to data portability
• Right to withdraw consent

To exercise any of these rights, or if you have questions about our use of your data, please contact us at:

Email: [email protected]
Data Protection Officer: [email protected]
Post: Hia Legal Limited, 5th Floor, 20 Old Bailey, London EC4M 7AN

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

12. Updates to this Notice
We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website. Material changes will be notified where appropriate.

This Privacy Notice was last updated on 19 August 2026.