Privacy Policy

Effective Date: October 2026

Trading Name: Trellis Workplace (James Lee Smith trading as Trellis Workplace)

Website: www.trellisworkplace.co.uk

Contact Email: james@trellisworkplace.co.uk

1. Important Information & Who We Are

Trellis Workplace is an independent HR consultancy and dispute resolution practice operated by James Lee Smith as a sole trader in the United Kingdom.

We respect your privacy and are committed to protecting your personal data. This privacy policy informs you about how we look after your personal data when you visit our website, contact us, or engage our services as a client, participant, or witness in workplace investigations and advisory services.

Data Controller Status

Depending on the nature of our engagement:

Data Controller: For general website enquiries, marketing communications, and direct clients who engage our advisory services directly, James Lee Smith (trading as Trellis Workplace) is the Data Controller.

Data Processor: When engaged by an employer or client organisation to conduct an independent workplace investigation, grievance review, or mediation, Trellis Workplace typically acts as a Data Processor on behalf of that organisation (the Data Controller), handling personal data strictly in accordance with their written instructions and agreed terms.

2. The Data We Collect About You

Personal data means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data, including:

Identity & Contact Data: Name, job title, company name, email address, telephone number, and postal address.

Workplace Case & Investigation Data: Information provided during independent investigations, grievances, or mediations, including interview transcripts, meeting notes, witness statements, employment details, and correspondence related to workplace complaints.

Special Category Data: On occasion, workplace investigations or dispute resolution cases may involve sensitive personal data (e.g., health information, disability details, or trade union membership). This data is handled with heightened confidentiality and strictly where permitted by UK data protection law (such as for employment obligations or explicit consent).

Technical & Usage Data: IP address, browser type, time zone setting, and basic analytics on how you interact with our website.

3. How We Collect Your Personal Data

We collect data through:

Direct Interactions: When you fill out a contact form on our website, email us, request a consultation, or communicate with us directly.

Client & Case Instructions: When an employer, client, or individual engages us to conduct an investigation, mediation, or advisory work, they may provide us with relevant background documentation and contact details for involved parties.

Third Parties: Witnesses, representatives, or referring organisations during the course of an investigation or dispute resolution process.

4. How We Use Your Personal Data & Legal Basis

We will only use your personal data when the law allows us to. Most commonly, we use your data under the following legal bases:

Purpose / Activity

Type of Data

Legal Basis for Processing

Responding to enquiries submitted via our website or email.

Identity, Contact

Legitimate Interests (to respond to your query and discuss potential services).

Delivering HR, investigation, and dispute resolution services under a contract.

Identity, Contact, Case Data

Performance of a Contract or Legitimate Interests (fulfilling commercial instructions).

Conducting independent workplace investigations on behalf of a client organization.

Case Data, Special Category Data

Substantial Public Interest (employment law compliance) / Legal Obligations / Consent where required.

Managing business administration, accounting, and UK tax obligations.

Identity, Contact, Financial

Legal Obligation (HMRC record-keeping) / Legitimate Interests.

5. Data Security & Confidentiality

Given the highly sensitive nature of employee relations casework and workplace investigations, data security is paramount:

All electronic files, notes, and investigation materials are stored securely using encrypted cloud storage and password-protected systems.

Access to case information is strictly restricted to James Lee Smith as the lead practitioner.

We enforce strict professional confidentiality across all client, participant, and witness interactions.

6. How Long We Keep Your Data

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements:

General Enquiries: Retained for up to 12 months after our last communication if no service engagement follows.

Client & Case Files (Investigations/Mediation): Investigation reports, notes, and related case materials are retained for up to 6 years following the conclusion of an engagement (to satisfy potential employment tribunal or legal claim limitation periods), after which they are securely deleted or destroyed.

Accounting Records: Retained for 6 years following the end of the relevant UK tax year in accordance with HMRC requirements.

7. Disclosures of Your Data

We do not sell, rent, or trade your personal data. We may share your personal data with trusted third parties only where necessary:

Client Organisations: Written investigation reports and summary findings are provided strictly to the commissioning client organization (Data Controller).

Professional & IT Service Providers: Secure cloud storage providers, accounting software platforms (e.g., FreeAgent), and professional advisors (lawyers or insurers) who process data on our behalf under confidentiality agreements.

Legal & Regulatory Authorities: If required by law, court order, or regulatory body (such as HMRC or data protection authorities).

8. Your Legal Rights

Under UK data protection laws, you have rights in relation to your personal data, including the right to:

Request Access to your personal data (a "Subject Access Request").

Request Correction of incomplete or inaccurate data we hold about you.

Request Erasure of your personal data where there is no good reason for us continuing to process it.

Object to or Restrict Processing of your personal data under certain conditions.

Withdraw Consent at any time where we rely on consent to process your data.

(Note: In the context of workplace investigations where Trellis Workplace acts as a Data Processor for an employer, Subject Access Requests regarding case materials may be directed to the employer as the Data Controller.)

If you wish to exercise any of these rights, please contact us at james@trellisworkspace.co.uk

9. Complaints & Regulatory Contact

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.