Privacy Policy

01 — Controller

Who is responsible for your data?

The data controller for this website and all associated services is:

When we refer to "IGNIFY:HR", "we", "us" or "our" in this policy, we mean IGNFY HR d.o.o. If you have any questions about how we process your personal data, please contact us at the address above.

02 — Data We Collect

What personal data do we collect?

We collect personal data when you actively provide it and when it is automatically generated by your use of this website. There is one exception, set out under Colleague contact data below, where someone gives us a colleague's address rather than their own. The categories of data we may collect include:

Contact data: Name, email address, job title, company name: provided when you contact us directly via email.

Communication data: The content of messages you send us, including any attachments, correspondence, and notes from consultations.

Usage data: Technical data automatically collected when you visit our website, including your IP address, browser type and version, operating system, pages visited, time and duration of visits, and referring URLs. This data is collected via Google Analytics.

Cookie data: Data stored by cookies placed on your device. See the Cookies section below for details.

Assessment data: Where you complete HRGIq, our HR Governance Index assessment, the industry you select, your answers to the forty statements, and the scores derived from them. See the Assessment and Benchmarking section below for how this is used.

Colleague contact data: Where someone completing our HRGIq assessment invites a colleague to give their own read of the same function, we receive that colleague's email address from the person inviting them, not from the colleague. We hold it as a business contact record on the legitimate interest basis described below, together with a note of who invited them and when, so that we can always say why we hold it. We do not add anyone to a marketing list on this basis, because they have given us no consent to that. If this is you, you may object at any time and we will erase the record: write to us at the address in the Contact section.

Consent records: Where you tick a consent box on any of our forms, the date and time you gave it, the IP address it was given from, and your browser's user agent. We keep this solely to demonstrate that consent was given, as Article 7(1) of the GDPR requires, and we do not use it to track you.

03 — Legal Basis & Purpose

Why do we process your data and on what legal basis?

Under the General Data Protection Regulation (GDPR), we are required to have a lawful basis for processing your personal data. We process personal data under the following legal bases:

Legitimate interest (Article 6(1)(f) GDPR): We use website analytics to understand how visitors use our site and improve our content. This processing is necessary for our legitimate business interests and does not override your rights and freedoms.

Legitimate interest for business contact (Article 6(1)(f) GDPR): Where you represent an organisation we believe may benefit from our services, we may hold your business contact details (name, role, employer, business email address and telephone number) in our internal client relationship records so that we can contact you about HR governance services. We do this only for people acting in a professional capacity, we do not use these records for profiling, and you may object at any time by writing to milos.marinkovic@ignifyhr.com, after which we delete the record.

Contract performance (Article 6(1)(b) GDPR): When you request a consultation or engage our services, we process your contact data to respond to your inquiry and deliver the services you requested.

Consent (Article 6(1)(a) GDPR): Where we rely on consent (for example, for marketing communications), we will ask for your explicit consent at the point of collection. You may withdraw consent at any time by contacting us at milos.marinkovic@ignifyhr.com.

Legal obligation (Article 6(1)(c) GDPR): In certain cases we may be required to process your data to comply with applicable law.

Our contact form and QiHR registration form also ask you to confirm that you have read this notice, and separately offer an optional tick box consenting to research and promotional material. The optional box is never required in order to contact us or to register interest.

04 — Assessment & Benchmarking

HRGIq: The HR Governance Index

If you complete our HRGIq assessment, we collect the contact details you enter, the industry you select, your answers to the forty statements, and the scores derived from them. We also record the date and time of your consent, the IP address the consent was given from, and your browser's user agent. That record exists solely so we can demonstrate that consent was given, as Article 7(1) of the GDPR requires.

We process your contact details and answers to produce and send your results, because that is what you asked us to do when you registered. We only send you research, guides or promotional material if you separately ticked the optional box agreeing to receive them. That box is never required, and you receive your results and the field guide whether or not you tick it.

Benchmarking. We use completed assessments in aggregate to calculate average scores by industry, so respondents can see how their function compares. No individual response is ever shown to another respondent, and no individual is identifiable in any average. Where fewer than five functions in an industry have completed the assessment, we withhold the industry comparison rather than publish an average thin enough to identify someone. In that case we may instead show an average across all respondents, clearly labelled as such, and where fewer than five functions have completed the assessment in total we show no comparison at all.

Assessment answers are self-reported, are not shared with third parties, and are never published in a form that identifies you or your organisation.

We keep assessment records for 24 months from our last contact with you, after which they are deleted. You can withdraw your consent to marketing at any time by replying to any message you receive from us or by emailing milos.marinkovic@ignifyhr.com, and you can request erasure of your assessment record using the same address.

05 — Cookies & Analytics

How do we use cookies and analytics?

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC. Google Analytics uses cookies and similar tracking technologies to collect and analyse information about how visitors use our website. This data is transmitted to and stored on Google servers, which may be located in the United States or other countries outside the European Economic Area (EEA).

Google Analytics collects data such as pages viewed, session duration, geographic region, device type, and traffic source. This data is used in aggregated, anonymised form to improve our website and services. We have enabled IP anonymisation, meaning Google truncates your IP address before storing it.

Google's privacy policy is available at policies.google.com/privacy. To opt out of Google Analytics tracking across all websites, you may install the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.

Beyond analytics, we do not use advertising cookies, remarketing pixels, or third-party tracking technologies on this website.

06 — Data Sharing

Do we share your data with third parties?

We do not sell, rent, or trade your personal data with any third party for marketing or commercial purposes.

We may share your data with carefully selected service providers who assist us in operating our website and delivering our services, including hosting providers, email service providers, and analytics tools (Google Analytics). These providers act as data processors on our behalf and are contractually bound to process your data only on our instructions and in accordance with GDPR.

We may also disclose personal data where required by applicable law, court order, or regulatory authority.

If personal data is transferred outside the European Economic Area (EEA), such as to Google servers in the United States, we rely on adequacy decisions or standard contractual clauses as appropriate safeguards under GDPR Article 46.

07 — Retention

How long do we keep your data?

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.

Contact and consultation data, including records held in our internal client relationship system, is retained for up to 3 years from the date of last contact, after which it is securely deleted unless a contractual or legal retention obligation applies.

Website analytics data is retained by Google Analytics for 14 months by default, after which it is automatically deleted from Google's servers.

If you would like us to delete your data earlier, please contact us at milos.marinkovic@ignifyhr.com and we will respond within 30 days.

08 — Your Rights

What rights do you have under GDPR?

As a data subject under the GDPR, you have the following rights with respect to your personal data:

To exercise any of these rights, contact us at:

We will respond to all verified requests within 30 days as required by GDPR. You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data lawfully.

09 — Security

How do we protect your data?

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include secure server environments, access controls, and encrypted data transmission (HTTPS).

While we take all reasonable steps to protect your data, no transmission over the internet is completely secure. We cannot guarantee the absolute security of data transmitted to or from our website.

10 — Third-Party Links

Links to other websites

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those external sites. We encourage you to read the privacy policies of any third-party sites you visit.

11 — Changes to This Policy

Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Continued use of this website after changes are posted constitutes your acknowledgement of the updated policy.

12 — Cookie Declaration

Cookies used on this website

The table below lists all cookies currently active on this website, their purpose, and retention period, as declared via Cookiebot.

13 — Contact

Questions and complaints

If you have any questions, concerns, or complaints about this Privacy Policy or the way we handle your personal data, please contact us:

You have the right to lodge a complaint with the relevant data protection supervisory authority in your country of residence if you are not satisfied with our response.