At HR Insights Lab, we treat your data the way we treat HR data in practice: with rigour, transparency, and purpose. This Privacy Policy explains what information we collect, why we collect it, how we use it, who we share it with, and what rights you have over it.

This policy applies to all visitors, subscribers, and users of hrinsightslab.com (the “Site”), including the blog, newsletter, downloadable resources, and any associated digital properties. It is written to meet the privacy rules that apply to readers in the European Economic Area (EEA), the United Kingdom, India, the United States, and Australia.

1. Who we are

HR Insights Lab is a personal blog and newsletter written and operated by Sofia Mahajan, an individual. It is not a registered company. In this policy, “we”, “us”, and “our” mean Sofia Mahajan, operating HR Insights Lab.

For the purposes of the laws that apply to you, we are the “data controller” (EU GDPR and UK GDPR), the “business” (California and other US state privacy laws), and the “data fiduciary” (India’s Digital Personal Data Protection Act, 2023). To contact us about your data, email sofi.mahajan29@gmail.com.

2. Information we collect

We collect only the data necessary to deliver content, improve user experience, measure our marketing, and communicate with our audience. We follow a data minimisation principle: if we do not need it, we do not collect it. We do not ask for, and do not intend to collect, sensitive personal data such as health, financial account, or government identity information.

Information you provide directly

• Newsletter subscription: Your email address when you subscribe to the HR Insights Lab newsletter, plus a record of your consent (the wording you agreed to, the date and time, and the page you signed up on).
• Contact forms: Your name, email address, and any message content you submit through contact or feedback forms.
• Comments: Your name, email address, and comment text when you leave a comment on a blog post.
• Downloadable resources: Your email address (and optionally, your job title or organisation type) when you download templates, checklists, or guides.

Information collected automatically

• Device and browser data: IP address, browser type and version, operating system, screen resolution, and device type.
• Usage data: Pages viewed, time spent on pages, referring URLs, click patterns, scroll depth, and mouse movement on the pages you visit.
• Location data: Approximate geographic location derived from your IP address (country and city level only).
• Online identifiers: Cookie IDs and similar identifiers set by the tools listed in Section 4, which recognise your browser on later visits.
• Email interaction data: If you subscribe to our newsletter, whether an email was delivered, opened, and which links were clicked.
• Form capture: Our contact and marketing platform, HubSpot, can automatically record an email address that you type into a form on the Site and link it to your browsing activity through a cookie.

Information from other sources

We receive aggregated reports from Google Search Console, Google Analytics, Google Ads, Microsoft Advertising, and Meta. These reports describe groups of visitors (for example, search queries, countries, and ad performance). They do not identify you personally.

3. How we use your information and our legal bases

We use your data for defined, legitimate purposes. Every use listed below ties directly to delivering, improving, measuring, or communicating about our content.

If you are outside the EEA and the UK, we process your data on the basis of your consent or as otherwise permitted by the law that applies to you. In India, we rely on your consent and on the limited “legitimate uses” that the Digital Personal Data Protection Act allows. In Australia, we handle personal information in line with the Australian Privacy Principles.

We do not make decisions about you using fully automated processing that has legal or similarly significant effects.

4. Cookies and tracking technologies

Cookies are small text files stored on your device when you visit the Site. Similar technologies, such as tracking tags and pixels, do the same job. We use them to understand how readers interact with our content, to measure our advertising, and to keep basic site functions working.

Types of cookies we use

Main cookies set by our tools

Exact cookie names and lifetimes can change when the providers update their tools. The main ones today are:

Managing your cookie preferences

When you first visit the Site, you will see a cookie consent banner. Where the law requires your consent (for example in the EEA, the UK, and other regions with similar rules), we set analytical and advertising cookies only after you accept them. You can change or withdraw your choice at any time through the cookie settings link in the Site footer.

You can also control cookies through your browser settings. Most browsers let you block or delete cookies. Disabling essential cookies may affect how the Site works. To opt out of Google Analytics across all sites, you can use the Google Analytics opt-out add-on. To manage interest-based ads, you can use optout.aboutads.info (US), youronlinechoices.com (EU and UK), and the ad settings in your Google, Microsoft, and Meta accounts.

5. Third-party services

We use a limited number of third-party services to run the Site and our marketing. Each has its own privacy policy, and we encourage you to read them.

6. Data sharing and disclosure

We do not sell your personal data for money, and we do not share your email address with third-party marketers. We do not upload subscriber email lists to advertising platforms without your consent.

The advertising tools in Section 5 (Google, Microsoft, and Meta) receive cookie IDs and page-view data from the Site when you accept advertising cookies. Some US state laws describe this as “sharing” personal information for targeted advertising, or as a “sale”. You can turn it off at any time through the cookie settings link in the footer.

We may share limited data in the following circumstances:

• Service providers: With third-party providers who process data on our behalf (hosting, email delivery, analytics, advertising measurement) under their data processing terms.
• Legal requirements: If required by law, regulation, legal process, or an enforceable government request.
• Protection of rights: To protect the rights, property, or safety of HR Insights Lab, our users, or the public as required or permitted by law.
• Business transfers: If the Site is sold or transferred, your data may be transferred with it. We will tell you before your data becomes subject to a different privacy policy.

7. Email marketing

We email you only if you have subscribed, by entering your address and ticking the consent box on our form. Each email identifies us as the sender and contains a working unsubscribe link. When you unsubscribe, we stop sending marketing emails promptly, and within the time that the law requires where you live.

We keep your address on a suppression list after you unsubscribe so that we do not email you again by mistake. You can ask us to delete it at any time (see Section 9).

These rules follow the US CAN-SPAM Act, the UK Privacy and Electronic Communications Regulations, the EU ePrivacy rules, and the Australian Spam Act 2003.

8. Data retention

We keep your personal data only for as long as necessary for the purposes in this policy.

• Newsletter subscribers: Your email address and consent record are kept while you are subscribed. After you unsubscribe, your address stays on our suppression list until you ask us to delete it.
• Contact form submissions: Kept for up to 12 months, then deleted unless an ongoing conversation needs longer.
• Comments: Kept indefinitely as part of the published content, unless you ask us to delete them.
• Google Analytics data: Kept for up to 14 months. Individual-level data is not kept beyond this period.
• HubSpot browsing records: Kept with your contact record until you ask us to delete it.
• Microsoft Clarity data: Kept in line with Microsoft Clarity’s standard retention periods.
• Advertising audiences: Kept only for the period we set in each advertising platform, which we keep as short as practical.
• Server logs: Kept for up to 90 days for security and debugging.

9. Your rights

Depending on where you live, you have rights over your personal data. We honour these rights for all readers, wherever you are, as far as technically possible.

For all readers

• Access: Ask for a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Ask us to delete your personal data, subject to legal retention requirements.
• Unsubscribe and withdraw consent: Opt out of newsletter emails at any time using the unsubscribe link in every email, and withdraw cookie consent through the footer cookie settings link.

Additional rights under GDPR (EEA, UK, Switzerland)

• Restriction of processing: Ask us to limit how we use your data.
• Data portability: Receive your data in a structured, commonly used, machine-readable format.
• Objection: Object to processing that relies on legitimate interest.
• Withdraw consent: Where processing relies on consent, withdraw it at any time. Withdrawal does not affect processing done before you withdrew.
• Complaint: Complain to your data protection authority. In the UK this is the Information Commissioner’s Office. EU authorities are listed on the European Data Protection Board website.

Additional rights under India’s Digital Personal Data Protection Act, 2023

• Access: Ask for a summary of the personal data we process and the parties we share it with.
• Correction, completion, updating, and erasure: Ask us to fix or erase your data.
• Grievance redressal: Raise a complaint with us first. Our grievance contact is Sofia Mahajan at sofi.mahajan29@gmail.com. If we do not resolve it, you may approach the Data Protection Board of India.
• Nominate: Nominate another person to exercise your rights if you die or become unable to do so.

Additional rights under US state privacy laws (including CCPA and CPRA in California)

• Right to know: Ask which categories and specific pieces of personal information we collected, and why.
• Right to delete and to correct: Ask us to delete or correct your personal information.
• Right to opt out of sale and sharing: Turn off advertising cookies through the footer cookie settings link.
• Non-discrimination: We will not treat you differently for exercising your rights.
• Authorised agent and appeal: You may use an authorised agent to make a request. If we refuse a request, you may appeal by replying to our decision, and you may contact your state attorney general.

In the last 12 months, we collected these categories of personal information: identifiers (email address, IP address, cookie IDs), internet and network activity (pages viewed, clicks), and approximate location. We collected them from you and your browser, and we use them for the purposes in Section 3.

Additional rights under the Australian Privacy Act 1988

• Access and correction: Ask for access to, or correction of, the personal information we hold about you.
• Complaint: Complain to us first. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

How to make a request

Email sofi.mahajan29@gmail.com. We may ask you to confirm your email address so we know the request is yours. We reply within 30 days, or within the shorter or longer time your local law requires.

10. International data transfers

Your data may be transferred to, stored in, and processed in the United States, India, and other countries where our service providers operate. These countries may have different data protection laws from your own.

Where we transfer data outside your country, we rely on safeguards such as the Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, and providers that take part in recognised frameworks such as the EU–US Data Privacy Framework. For Australian readers, we take reasonable steps to make sure overseas providers handle your information in line with the Australian Privacy Principles.

11. Security

We protect your data with reasonable technical and organisational measures, including access controls, secure connections, and the security features of the tools listed in Section 5. No online service is completely secure. If a data breach affects your rights, we will tell you and the relevant authorities as the law requires.

12. Children’s privacy

HR Insights Lab is a professional publication designed for HR practitioners, Talent Acquisition specialists, and HR leaders. The Site is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will delete it promptly. If you believe a child has given us data, email sofi.mahajan29@gmail.com.

13. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, tools, or legal requirements. When we make a material change, we will update the “Last updated” date at the top of this page and, where the law requires, tell newsletter subscribers by email or ask for your consent again.

Our Site may link to other websites. We do not control them and are not responsible for their privacy practices.

14. Contact us and complaints

If you have questions about this Privacy Policy, want to use your data rights, or have concerns about how your information is handled, reach out to us:

You also have the right to complain to your local data protection authority, as described in Section 9.

This privacy policy was drafted with the same standard we apply to all HR Insights Lab content: precise, transparent, and practitioner-focused. No legalese for the sake of legalese.