1. Introduction

GHRP is committed to protecting the privacy of everyone who visits and interacts with its website. We recognise that personal information is entrusted to us and that it is important for visitors to understand how that information is handled.

This Privacy Policy explains how information is collected, used, stored, protected, and disclosed when you visit or use the GHRP website (the “Website”). It also explains the use of cookies and similar technologies, the purposes for which personal information may be processed, and the rights available to individuals in relation to their personal information.

The Website may be accessed by individuals in different countries. Accordingly, this Privacy Policy is intended to address applicable privacy and data-protection requirements relevant to users in Pakistan and the United Kingdom, including, where applicable, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

GHRP aims to process personal information fairly, transparently, and only for legitimate and clearly identified purposes. Where consent is required by applicable law, GHRP will obtain that consent before carrying out the relevant processing.

2. Information Covered by This Policy

This Privacy Policy applies to personal information collected through the GHRP Website, including information provided directly by visitors and information collected automatically when the Website is accessed.

For the purposes of this Privacy Policy, “personal information” or “personal data” means information that identifies, relates to, or could reasonably be associated with an identifiable individual.

The information collected will depend on how you use the Website and what information you choose to provide.

3. Information GHRP May Collect

3.1 Information Provided Directly

When you contact GHRP, submit an enquiry, complete a form, or otherwise communicate through the Website, you may provide information such as:

• Full name
• Email address
• Telephone number
• Organisation or company name
• Postal or business address
• Details contained in your enquiry or message
• Information relating to the service or information you are requesting
• Any other information you voluntarily provide

You are not generally required to provide personal information simply to browse the Website. However, certain information may be necessary where you choose to contact GHRP or request a particular service.

3.2 Information Collected Automatically

When you visit the Website, certain technical information may be collected automatically. This may include:

• IP address
• Browser type and version
• Device type
• Operating system
• Approximate geographical location derived from technical information
• Date and time of access
• Pages visited
• Website navigation and interaction information
• Referring website or source
• Technical information relating to Website performance and security

This information may be used to maintain the security and functionality of the Website, understand how visitors use it, and improve the overall user experience.

4. How Personal Information Is Used

GHRP may use personal information for legitimate and appropriate purposes, including:

• Responding to enquiries and requests
• Providing information about GHRP and its services
• Operating and maintaining the Website
• Improving the Website, content, functionality, and user experience
• Understanding Website traffic and visitor behaviour
• Monitoring Website performance
• Maintaining Website security
• Detecting and preventing fraud, misuse, or unauthorised activity
• Managing communications with visitors
• Maintaining appropriate business and administrative records
• Complying with legal and regulatory obligations
• Protecting the rights, property, safety, and security of GHRP and Website users

Personal information will not be used for purposes that are incompatible with the purpose for which it was collected unless such use is permitted or required by applicable law.

5. Lawful Basis for Processing – UK Users

Where the UK GDPR applies, GHRP will process personal data on an appropriate lawful basis.

Depending on the circumstances, the lawful basis may include:

Consent

Where the law requires consent, GHRP will ask for consent before carrying out the relevant processing.

Consent should be freely given, specific, informed, and capable of being withdrawn.

Contract

Processing may be necessary to take steps at an individual’s request or to perform a contract.

Legal Obligation

Personal information may be processed where necessary to comply with a legal or regulatory obligation.

Legitimate Interests

GHRP may process personal information where necessary for legitimate interests, provided that those interests are not overridden by the individual’s rights and interests.

Where legitimate interests are relied upon, GHRP will consider the circumstances and impact of the processing before relying on this basis.

6. Cookies and Similar Technologies

The GHRP Website uses cookies and similar technologies to support Website functionality and enhance the user experience.

A cookie is a small text file placed on a user’s device when a website is accessed. Cookies can allow a website to remember information, recognise a returning device, maintain certain preferences, understand Website usage, and improve performance.

Cookies may be first-party cookies, placed by GHRP, or third-party cookies, placed by service providers whose technologies are used on the Website.

6.1 Types of Cookies

GHRP may use the following categories of cookies:

Strictly Necessary Cookies

These cookies are necessary for essential Website functions, security, navigation, or services specifically requested by the visitor. Where applicable, these cookies may operate without consent because they are necessary for the Website or service to function.

Functional or Preference Cookies

These cookies may remember choices and preferences and help provide a more convenient and personalised experience.

Analytics Cookies

These cookies may help GHRP understand how visitors use the Website, including which pages are visited and how visitors interact with the Website. The information can be used to improve Website performance and content.

Marketing or Advertising Cookies

Where used, these cookies may be used to measure marketing activity, provide relevant advertising, or understand interactions with promotional content.

6.2 Cookie Consent

For visitors in the United Kingdom, GHRP will comply with applicable requirements governing cookies and similar technologies.

Non-essential cookies will not be placed or accessed before the appropriate consent has been obtained, unless an applicable legal exception applies. Users will be provided with clear information about the cookies being used and their purposes.

Continuing to browse the Website will not, by itself, be treated as consent where applicable law requires an affirmative consent action.

Visitors should be given the ability to accept or reject non-essential cookies and, where applicable, manage their individual cookie preferences. The ability to refuse non-essential cookies should be as straightforward as the ability to accept them.

6.3 Changing Cookie Preferences

You can change your cookie preferences through the Website’s cookie-management controls, where available.

You may also manage or delete cookies through your browser settings. Please be aware that blocking certain cookies may affect the functionality or performance of some parts of the Website.

7. Third-Party Services

GHRP may use third-party service providers to support the operation, security, analysis, and functionality of the Website.

Depending on the Website’s configuration, these services may include:

• Website hosting providers
• Analytics providers
• Security services
• Email and communication services
• Website performance services
• Embedded content providers
• Other technology providers

Where third-party technologies collect or access information through the Website, GHRP will seek to provide appropriate information and obtain consent where required.

Third-party providers may have their own privacy policies governing information they process. Visitors should review those policies where appropriate.

8. Sharing Personal Information

GHRP does not sell or rent personal information.

Personal information may be disclosed where reasonably necessary for legitimate business or operational purposes, including to:

• Service providers acting on behalf of GHRP
• Website hosting and technology providers
• Professional advisers
• Security and fraud-prevention providers
• Government bodies, regulators, or law-enforcement authorities where legally required
• Other parties where disclosure is necessary to comply with a legal obligation or protect the rights and safety of GHRP, its users, or others

GHRP will seek to ensure that personal information is only shared where there is an appropriate reason and that suitable safeguards are applied where required.

9. International Transfers

Some service providers used by GHRP may operate outside Pakistan or the United Kingdom. As a result, personal information may, in certain circumstances, be transferred to or processed in another country.

Where UK data-protection law applies and a transfer is subject to UK international-transfer requirements, GHRP will use an appropriate lawful transfer mechanism and safeguards as required by applicable law.

10. Data Security

Protecting personal information is taken seriously by GHRP.

Reasonable technical and organisational measures are used to protect information against unauthorised access, accidental loss, destruction, misuse, alteration, or disclosure.

These measures may include appropriate access controls, technical security measures, secure systems, and organisational procedures.

However, no website, electronic transmission, or storage system can be guaranteed to be completely secure. Visitors should therefore understand that information transmitted over the Internet carries some inherent security risks.

11. Data Retention

Personal information will only be retained for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

The appropriate retention period may depend on:

• The nature and purpose of the information
• The reason for which it was collected
• Legal and regulatory requirements
• Business and accounting requirements
• The need to resolve disputes or enforce agreements
• Security and fraud-prevention requirements

When personal information is no longer required, appropriate steps will be taken to securely delete, anonymise, or otherwise dispose of it.

12. Your Privacy Rights

Depending on where you live and the laws that apply to your personal information, you may have certain rights in relation to your personal data.

These may include the right to:

• Request access to personal information held about you
• Request correction of inaccurate or incomplete information
• Request deletion of personal information where applicable
• Object to certain processing
• Request restriction of processing in certain circumstances
• Withdraw consent where processing is based on consent
• Request information about how your personal information is being processed
• Make a complaint to the relevant data-protection authority

For individuals in the United Kingdom, these rights may arise under the UK GDPR and Data Protection Act 2018.

GHRP will consider privacy requests in accordance with the applicable legal requirements. Identity verification may be required before certain requests can be processed.

13. Marketing Communications

GHRP may occasionally communicate with individuals about its services, updates, activities, or other information where permitted by applicable law.

Where consent is required for electronic marketing, appropriate consent will be obtained before such communications are sent.

You may opt out of promotional communications at any time by using the unsubscribe facility provided in the communication or by contacting GHRP directly.

Opting out of marketing communications will not necessarily prevent the receipt of essential administrative or service-related communications.

14. Children’s Privacy

The Website is not intended to knowingly collect personal information from children where such collection requires parental or guardian consent under applicable law.

If GHRP becomes aware that personal information has been collected from a child in circumstances where the collection was not appropriate or authorised, reasonable steps will be taken to address the situation.

15. Links to Other Websites

The GHRP Website may contain links to websites, platforms, or services operated by third parties.

These websites are outside GHRP’s control and may have their own privacy policies and terms of use.

GHRP is not responsible for the privacy practices, security, or content of third-party websites. Visitors are encouraged to review the privacy policy of any third-party website before providing personal information.

16. Changes to This Privacy Policy

GHRP may update this Privacy Policy from time to time to reflect changes in its services, Website functionality, technology, legal requirements, or privacy practices.

When changes are made, the “Last Updated” date at the beginning of this policy will be amended.

Where a significant change affects the way personal information is processed, GHRP will take reasonable steps to provide appropriate notice where required by law.

Visitors are encouraged to review this Privacy Policy periodically.

17. Contacting GHRP About Privacy

If you have any questions about this Privacy Policy, the way GHRP handles personal information, or your privacy rights, please contact:

Email: info@ghrp.co.uk

Privacy enquiries will be reviewed and handled in accordance with applicable law.

18. Complaints

GHRP encourages individuals to contact the organisation first if they have concerns about how their personal information has been handled.

Individuals in the United Kingdom may also have the right to raise a concern with the Information Commissioner’s Office (ICO) where UK data-protection law applies.

Individuals in other jurisdictions may have rights to contact the relevant privacy or data-protection authority applicable to them.