Privacy Policy

Last updated: 29 October 2026

This privacy policy explains how WorkHub Collective ("WorkHub Collective", "we", "us" or "our") collects, uses, shares and protects your personal data when you visit workhubcollective.co.uk (the "website"), get in touch with us, or sign up as a business looking for support or as a virtual assistant (VA).

We are committed to protecting your personal data and handling it in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

WorkHub Collective is the trading name of WORKHUB COLLECTIVE LTD, a company registered in England and Wales under company number 17193342, with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.

We are the controller of the personal data described in this policy. This means we decide how and why your personal data is used.

Contact us about privacy:

• Email: admin@workhubcollective.co.uk
• Post: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ

We only collect the personal data we need. Depending on how you deal with us, this may include the following.

a) Enquiries and contact forms
When you send us an enquiry or book a call, we collect your name, email address, phone number, company name, job title and any details you choose to include in your message.

b) Sign-up forms for businesses ("founders" and clients)
When you sign up to find a VA, we collect your name, business name, contact details, the services and hours you need, and other information about your requirements.

c) Sign-up forms and applications from VAs
When you sign up or apply to work with us as a VA, we may collect:

• your name, contact details and location
• your CV, skills, experience, qualifications, availability and preferred rates
• references, and the results of any skills tests or interviews
• identity and right-to-work documents, where we need them
• payment details, if we work with you

d) WhatsApp, email and phone communications
When you contact us by WhatsApp, email or phone, we keep the content of our conversations along with your name, phone number or email address, and any files you send us. WhatsApp is provided by WhatsApp Ireland Limited / Meta, and their own privacy policy also applies to your use of WhatsApp.

e) Clients' and their customers' information
When our VAs provide services to a client (for example, managing a CRM, an inbox or a diary), they may handle personal data belonging to that client's own customers. For that data, the client is usually the controller and we act as a processor on their instructions, under a written agreement. This policy covers the data we control. Please see the relevant client's privacy notice for how they use your data.

f) Website usage, cookies and analytics
When you visit our website, we and our service providers may collect technical information, such as your IP address, browser type, device, the pages you visit and how you arrived at the site. Some of this is collected using cookies (see section 10).

We don't knowingly collect special category data (for example, health information) unless you choose to give it to us or it's needed for a specific reason, such as making reasonable adjustments during recruitment. If we do, we'll only use it where the law allows. Our website and services are not intended for children under 18.

The law requires us to have a lawful basis for each way we use your personal data. We rely on the following.

Where we rely on legitimate interests, we have weighed our interests against your rights and freedoms. You can ask us for more details about this.

If you don't give us information we need (for example, to set up a contract), we may not be able to provide our services or work with you.

We don't sell your personal data. We only share it where necessary, with:

• Our VAs and team members. For example, when we introduce a client to a VA, we share the relevant client contact details and requirements with that VA. When we put a VA forward to a client, we share the VA's profile, experience and availability with the client.
• Clients. We share VA profile information with clients and prospective clients so they can choose who to work with.
• Service providers who help us run our business, under contracts that require them to protect your data. These include website hosting and building platforms (such as Lovable and its hosting providers), email and productivity tools (such as Microsoft 365), messaging (WhatsApp), CRM and scheduling tools, payment and accounting providers, and (where we use them) analytics providers.
• Professional advisers such as accountants, lawyers and insurers.
• Authorities and regulators, such as HMRC, the ICO, the police or courts, where the law requires it or to protect our rights.
• A buyer or successor, if our business (or part of it) is sold or restructured, subject to equivalent protections.

Some of our directors, team members and VAs are based outside the UK, including in the Philippines, and some service providers may store or process data in other countries (for example, the United States or the European Economic Area).

The Philippines has not been granted UK "adequacy" status. When we transfer personal data to a country without UK adequacy regulations, we protect it with appropriate safeguards. These include the ICO's International Data Transfer Agreement (IDTA), or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and suitable technical and organisational security measures. Where a country or provider is covered by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), we may rely on those instead.

You can ask us for more information about these safeguards, or a copy of them, using the contact details in section 1.

We only keep personal data for as long as we need it for the purposes it was collected for, including any legal, accounting or reporting requirements. As a guide:

When we no longer need the data, we securely delete or anonymise it.

We use appropriate technical and organisational measures to protect your personal data. These include access controls, password and multi-factor authentication, encryption where available, and giving data only to people who need it. Our team members and VAs have to keep personal data confidential. No method of sending data over the internet is completely secure, but we work hard to protect your information. If there is a data breach that is likely to put your rights at risk, we'll tell you and the ICO where the law requires it.

Under UK data protection law, you have the right to:

• Access your personal data and get a copy of it
• Rectification: have inaccurate or incomplete data corrected
• Erasure: ask us to delete your data in certain circumstances
• Restrict processing: ask us to limit how we use your data in certain circumstances
• Object to processing based on legitimate interests, and to direct marketing at any time
• Data portability: receive data you've given us in a commonly used format, or have it sent to another organisation, where processing is based on consent or contract and is automated
• Withdraw consent at any time, where we rely on consent. This won't affect processing carried out before you withdrew it
• Not to be subject to decisions based solely on automated processing that have legal or similarly significant effects. We don't make decisions like this

To use any of these rights, email admin@workhubcollective.co.uk. We may need to confirm your identity first. We'll respond within one month, which can be extended by up to two further months for complex requests. There is usually no fee.

If you have concerns about how we use your personal data, please contact us first and we'll do our best to put things right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Cookies are small text files stored on your device when you visit a website.

• Strictly necessary cookies are needed for the website to work (for example, to keep you signed in or remember your cookie choices). We don't need your consent for these.
• Analytics and other non-essential cookies help us understand how people use the website so we can improve it. We'll only set these if you agree to them through a cookie banner, and you can change your choices at any time.

If you'd like details of the cookies currently used on our website, including who provides them, what they're for and how long they last, please contact us at admin@workhubcollective.co.uk.

You can also block or delete cookies in your browser settings, although parts of the website may then not work properly.

Our website may link to other websites and services, such as Trustpilot, WhatsApp or booking tools. We're not responsible for their privacy practices, so please read their privacy policies.

We may update this policy from time to time. The latest version will always be on this page, with the "Last updated" date at the top. If we make significant changes, we'll let you know where appropriate.

If you have any questions about this policy or how we handle your personal data, please contact us:

WorkHub Collective (WORKHUB COLLECTIVE LTD, company no. 17193342)
Email: admin@workhubcollective.co.uk
Address: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ