Privacy Notice

Effective date: May 2026

Hope Leigh Marketing Group (“HLMG,” “we,” “us,” or “our”) respects your privacy. This Privacy Notice explains how we collect, use, disclose, and protect personal information when you visit our website, contact us, engage with us for business purposes, or otherwise interact with us.

This Privacy Notice applies to website visitors, prospective clients, current clients, business contacts, vendors, partners, and other individuals who interact with HLMG in a business context. It does not replace the terms of any client agreement, statement of work, data processing agreement, or other written agreement that may apply to services we provide to on or behalf of a client.

1. Who is responsible for your personal information?

For purposes of this Privacy Notice, Hope Leigh Marketing Group is the controller or business responsible for the personal information we collect and use for our own business purposes, such as operating our website, responding to inquiries, managing client relationships, and administering our business.

Where we process personal information on behalf of a client as part of a specific engagement, our role may be different and is generally governed by the applicable client agreement, DPA, SOW, or written instructions from a client.

Privacy contact: info@hopeleighmarketing.com

2. Personal information we collect

The personal information we collect depends on how you interact with us. We may collect the following categories of information:

Category	Examples
Contact and business information	Name, business email address, company, job title, phone number, mailing address, and other contact details.
Inquiry and communications information	Information you submit through our website Contact Us form, email correspondence, meeting notes, call notes, project communications, and related message content.
Client relationship and account information	Information related to proposals, statements of work, contracts, projects, invoices, billing, client contacts, account history, and relationship management.
Website, device, and online activity information	IP address, browser type, device information, pages visited, referring website, timestamps, cookie identifiers, advertising identifiers, conversion events, and similar technical or usage information.
Marketing and event information	Marketing preferences, event attendance, webinar participation, newsletter interactions, and similar business development information.
Testimonial and creative asset information	Where applicable, names, first names, job titles, company affiliation, photos, images, video, likeness, testimonial statements, approvals, consent or release documentation, and related creative assets.

We do not intentionally collect sensitive personal information through our website Contact Us form. Please do not submit sensitive personal information through the Contact Us form or general business inquiry channels.

3. How we collect personal information

Directly from you, such as when you submit a Contact Us form, email us, schedule a meeting, sign a contract, provide feedback, or otherwise communicate with us.
From clients, vendors, business partners, referral sources, or other third parties in connection with business development, client services, or project delivery.
Automatically through our website and related technologies, such as cookies, analytics tools, tags, pixels, server logs, and similar technologies.
From third-party service providers that support our business operations, CRM, website, analytics, advertising, AI-assisted productivity tools, file storage, collaboration, and client services.

4. Contact Us forms and Monday.com

We use Monday.com to support our Contact Us form, customer relationship management, and client management workflows. When you submit information through our website Contact Us form or otherwise communicate with us for business purposes, that information may be processed in Monday.com and related business systems.

The information processed in Monday.com may include your name, business email address, company, job title, phone number, message content, relationship history, project notes, task information, and related administrative details. If client testimonial releases or related approvals are collected in the future, those records may also be stored in Monday.com or Google Drive, depending on the project workflow.

5. Cookies, analytics, tags, and similar technologies

Our website may use cookies, analytics tools, tags, pixels, conversion tracking, and similar technologies to operate the site, understand how visitors use it, improve user experience, measure marketing performance, support advertising or retargeting, and evaluate conversions or campaign effectiveness.

These technologies may collect information such as your IP address, browser type, device information, pages visited, referring website, timestamps, cookie identifiers, advertising identifiers, conversion events, and similar online activity information.

Some cookies are necessary for the website to function. Others, such as analytics cookies, advertising pixels, conversion tracking, and retargeting technologies, are not strictly necessary. Where required by applicable law, we will provide appropriate notice and choices before setting non-essential cookies or similar technologies.

You can control cookies through your browser settings. Depending on where you are located and which technologies are active on our website at the time of your visit, you may also be presented with additional cookie choices or consent options.

6. How we use personal information

Respond to inquiries and communicate with you.
Evaluate, propose, deliver, and manage our services.
Manage client relationships, accounts, projects, contracts, billing, and administration.
Operate, maintain, analyze, and improve our website, business operations, and services.
Plan, activate, optimize, measure, and report on client-approved advertising, recruitment marketing, media, analytics, and employer brand services.
Use approved testimonial materials, employee images, names, job titles, or statements in creative assets, campaigns, case studies, or related materials where appropriate consent or authorization has been obtained.
Use AI-assisted tools to support productivity, drafting, analysis, summarization, quality review, and business operations, subject to internal safeguards and applicable client instructions.
Send business communications, marketing communications, or updates where permitted by law or with your consent where required.
Protect our rights, comply with legal obligations, enforce agreements, prevent fraud or misuse, and maintain security.

7. Legal bases for processing, where applicable

Where the General Data Protection Regulation or UK GDPR applies, we rely on one or more of the following legal bases to process personal information:

Performance of a contract or steps taken before entering into a contract.
Our legitimate interests, such as operating and improving our business, responding to inquiries, managing client relationships, providing services, conducting business development, and protecting our rights, provided those interests are not overridden by individual rights and freedoms.
Consent, where required, such as for certain marketing communications or non-essential cookies and similar technologies.
Compliance with legal obligations.

8. Client campaign, landing page, and application data

In many client engagements, HLMG supports recruitment marketing, employer brand, advertising, analytics, media, or campaign services. The specific data processed depends on the client-approved scope and channels used.

HLMG does not typically receive, access, or process candidate application data, client ATS data, or client HRIS data. Campaign traffic is generally routed to client-owned systems, such as a client career site, ATS, CRM, or application platform. If HLMG hosts a page that embeds a client-owned form, HLMG generally does not receive the form submissions unless the client specifically configures the form or workflow to provide HLMG access.

If a project requires HLMG to collect, receive, host, access, or otherwise process candidate, employee, research, focus group, survey, testimonial, or other personal information on behalf of a client, that processing should be addressed in the applicable client agreement, statement of work, data processing agreement, release, consent form, or written client instructions.

9. AI-assisted tools

We use AI-assisted productivity tools, including Gemini as part of Google Workspace and the business version of ChatGPT, to support business operations and service delivery. These tools may assist with tasks such as drafting, summarization, analysis, brainstorming, quality review, research support, and workflow efficiency.

We do not use AI-assisted tools to make solely automated decisions that produce legal or similarly significant effects about individuals. We also instruct our personnel not to input sensitive personal information, confidential client personal information, candidate application data, or other restricted data into AI-assisted tools unless the use is authorized, appropriate safeguards are in place, and the use is consistent with applicable client agreements and internal policies.

Where AI-assisted tools are used as business service providers, those providers may process information submitted to the tool to provide, secure, and support the service in accordance with their applicable business, enterprise, or workspace terms.

10. When we disclose personal information

We may disclose personal information to the following categories of recipients where appropriate for the purposes described in this Privacy Notice:

Service providers and vendors that support our website, CRM, hosting, email, collaboration, file storage, analytics, advertising, reporting, AI-assisted productivity tools, security, billing, and business operations.
Client-approved advertising, analytics, media, measurement, tag management, reporting, landing page, survey, focus group, production, or creative vendors used in connection with a specific engagement.
Subcontractors or consultants who support client services, such as digital media strategists, creative partners, research partners, or production resources.
Clients, where information is provided in connection with a client engagement, campaign, report, deliverable, approval process, or project workflow.
Professional advisors, such as accountants, attorneys, insurers, banks, and auditors.
Government authorities, courts, regulators, or other parties where required by law or necessary to protect our rights, security, or business interests.
Parties involved in a business transaction, such as a merger, acquisition, financing, restructuring, or sale of assets.

We do not sell personal information in the ordinary sense of selling contact lists for money. Some privacy laws define “sale,” “sharing,” or targeted advertising broadly enough to include certain advertising, analytics, retargeting, pixel, or cookie-based activities. Where those laws apply, we will provide required notices and choices.

11. Service providers and subprocessors

The specific service providers and subprocessors used for a client engagement may vary depending on the approved scope of work, media channels, reporting requirements, research activities, landing page needs, and client instructions.

Common categories may include advertising platforms, analytics providers, tag management tools, reporting tools, file storage and collaboration platforms, CRM and project management systems, AI-assisted productivity tools, landing page or website hosting providers, survey or focus group tools, creative production providers, and specialized subcontractors.

12. Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Notice, including to provide services, manage client relationships, maintain business records, comply with legal, accounting, contractual, reporting, or regulatory obligations, resolve disputes, and enforce agreements.

Retention periods may vary depending on the type of information, the purpose for which it was collected, project or client requirements, legal obligations, and whether the information may be relevant to potential claims, audits, or business records. When personal information is no longer needed, we will delete, de-identify, or archive it in accordance with our retention practices and applicable obligations.

13. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, disclosure, alteration, or destruction. No system or method of transmission is completely secure, and we cannot guarantee absolute security.

14. International transfers

HLMG is based in the United States, and the service providers we use may process personal information in the United States and other countries. These countries may have data protection laws that differ from those in your location.

Where required, we rely on appropriate transfer mechanisms, which may include participation in or reliance on the EU-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, Standard Contractual Clauses, the UK International Data Transfer Addendum, vendor data processing terms, or other lawful mechanisms available under applicable law.

13. Your privacy rights

Depending on where you live and the laws that apply, you may have the right to request access to, correction of, deletion of, restriction of, objection to, or portability of your personal information. You may also have the right to withdraw consent where processing is based on consent, opt out of certain marketing communications, or lodge a complaint with a supervisory authority.

To make a privacy request, contact us at info@hopeleighmarketing.com. We may need to verify your identity before responding. These rights are not absolute and may be subject to legal exceptions.

14. International transfers

HLMG is based in the United States, and personal information may be processed in the United States and other countries where we or our service providers operate. These countries may have data protection laws that differ from those in your location.

Where required, we rely on appropriate transfer mechanisms, such as contractual protections, standard contractual clauses, data processing agreements, adequacy decisions, the EU-U.S. Data Privacy Framework where applicable to participating providers, or other lawful mechanisms recognized under applicable data protection laws.

15. Your privacy choices and rights

Depending on where you live and the laws that apply, you may have rights to request access to, correction of, deletion of, restriction of, or portability of your personal information. You may also have the right to object to certain processing or withdraw consent where processing is based on consent.

To exercise privacy rights or ask questions about this Privacy Notice, contact us at info@hopeleighmarketing.com. We may need to verify your identity before responding to certain requests. These rights are not absolute and may be subject to legal exceptions.

16. California privacy note

HLMG does not currently meet the applicability thresholds for the California Consumer Privacy Act, as amended by the California Privacy Rights Act. If that changes, or if a specific California privacy obligation applies to our activities, we will update this Privacy Notice and provide any required rights, notices, and choices.

Even where a specific state privacy law does not apply, we aim to respond reasonably to privacy-related questions and requests consistent with our legal, contractual, and operational obligations.

Our website, communications, or client campaigns may link to third-party websites, platforms, job postings, career sites, social media pages, or application systems. We are not responsible for the privacy practices of third parties. Please review their privacy notices before providing personal information.

17. Third-party links and platforms

We do not use solely automated decision-making that produces legal or similarly significant effects about individuals through our website or standard business operations. Client advertising platforms and analytics tools may use automated systems for ad delivery, optimization, measurement, or reporting, subject to the client-approved campaign scope and the platform’s terms.

18. Automated decision-making

19. Marketing communications

We may send business or marketing communications to clients, prospective clients, and business contacts where permitted by law. You may opt out of marketing communications by following the unsubscribe instructions in the communication or contacting us. We may still send transactional, administrative, contractual, or service-related communications.

20. Children’s privacy

Our website and services are intended for business audiences and are not directed to children. We do not knowingly collect personal information from children through our website.

21. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. The updated version will be identified by an updated effective date. Material changes will be communicated as required by applicable law.

22. Contact us

If you have questions about this Privacy Notice or how we handle personal information, contact us at:

Hope Leigh Marketing Group

Email: info@hopeleighmarketing.com

Subject line suggestion: Privacy Request