Privacy Policy - Luke Beale Counselling

1. Who I am

My website address is: https://lukebealecounselling.co.uk. I am a sole trader, trading as Luke Beale Counselling, and I am registered with the Information Commissioners Office (ICO).

Contact information for me can be found in section 10 below.

Luke Beale Counselling understands that your privacy is important to you and that you care about how your personal data is used. I respect and value the privacy of all of my clients and will only collect and use personal data in ways that are described here, and in a way that is consistent with my obligations and your rights under the law.

2. What does this notice cover?

This Privacy Information explains how I use your personal data, particularly data that is collected via the website: how it is collected, how it is held, and how it is processed. It also explains your rights under the law relating to your personal data.

3. What is personal data?

Personal data is defined by the General Data Protection Regulation as any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

The personal data that I use is set out in section 5, below.

4. What are my rights?

Under the GDPR, you have the following rights, which I will always work to uphold:

The right to be informed about my collection and use of your personal data. This Privacy Notice should tell you everything you need to know, but you can always contact me to find out more or to ask any questions using the details in section 10.
The right to access the personal data I hold about you. Section 9 will tell you how to do this.
The right to have your personal data rectified if any of your personal data held by me is inaccurate or incomplete. Please contact me using the details in section 10 to find out more.
The right to be forgotten, i.e. the right to ask me to delete or otherwise dispose of any of your personal data that I have. Please contact me using the details in section 10 to find out more.
The right to restrict (i.e. prevent) the processing of your personal data.
The right to object to me using your personal data for a particular purpose or purposes.
The right to withdraw consent. This means that, if I am relying on your consent as the legal basis for using your personal data, you are free to withdraw consent at any time.
The right to data portability. This means that, if you have provided personal data to me directly, I am using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask me for a copy of that personal data to re-use with another service or business in many cases.
Rights relating to automated decision-making and profiling I do not use your personal data in this way.

For more information about my use of your personal data or exercising your rights as outlined above, please contact me using the details provided in section 10.

It is important that your personal data is kept accurate and up-to-date. If any of the personal data I hold about you changes, please keep me informed as long as I have that data.

Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.

If you have any cause for complaint about my use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

5. What personal data I collect via the website and why do I collect it

5.1 Comments

When visitors leave comments on the site I collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here.

After approval of your comment, your profile picture is visible to the public in the context of your comment.

5.2 Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

5.3 Contact forms

If you send me information via the contact form I may collect your name, email and any other information you choose to give me. However, I do not store any of the following via the contact form: cookies, geolocation tracking info, your IP address, browser or operating system info. For the purposes of the Data Protection Legislation, I am the data controller responsible for such personal data.

5.4 Cookies

To improve your experience on my site I may use ‘cookies’. Cookies are an industry standard and most websites use them. A cookie is a small text file that our website may place on your computer as a tool to remember your preferences. You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note, that if you do this you may not be able to use the full functionality of this website.

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

5.5 Functionality and performance cookies

These cookies give you extra functionality, such as being asked to remember your preferences. They also let me monitor how my website is performing so that I can make regular improvements. Information about the Google Analytics cookies can be found here.

5.6 Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

6. Where do you send my data?

I will store some of your personal data within the European Economic Area (the EEA). The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein. This means that your personal data will be fully protected under the Data Protection Legislation, the GDPR, and/or to equivalent standards by law. Where I transfer your data to a third party based in the US, the data may be protected if they are part of the EU-US Privacy Shield. This requires that third party to provide data protection to the standards similar to those in Europe. More information is available from the European Commission.

Please contact me using the details below in section 10 to obtain further information about the particular data protection mechanisms used by me when transferring your personal data to a third country. Personal data security is essential to me, and to protect personal data, I take the following measures:

Limiting access to your personal data to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality;
Procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data) including notifying you and/or the Information Commissioner’s Office where I am legally required to do so.

7. Who do I share your data with?

Visitor comments may be checked through an automated spam detection service.

I will only store or transfer certain personal data in the UK. This means that it will be fully protected under the GDPR.

I may sometimes contract with the following third parties for data storage purposes:

Google and Tutanota (an encrypted email service compliant with GDPR) for email, contact information, and calendar services. Google have data storage facilities inside and outside the EEA. Where your Personal Data is transferred to the US it is protected by the Privacy Shield agreement between the EU and US.
BACP.co.uk provide a service specifically designed for counsellors and as such have specific policies in place to protect the kind of Personal Data that a counselling practice will collect and store.

If any of your personal data is transferred to a third party, as described above, I will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, my obligations, and the third party’s obligations under the law, as described above in section 6 above.

If any personal data is transferred outside the EEA (the EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein), I will take suitable steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK and under the Data Protection Legislation, as explained above in section 6.

In some limited circumstances, I may be legally required to share certain personal data, which might include yours, if I am involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

As per our counselling agreement if I feel that you or someone else is at risk of serious harm, I may have to tell someone else, for example your GP. I would involve you in that discussion if at all possible.

8. How long do I retain your data?

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

If I do collect any personal data (i.e. if you contact me via the contact form), it will be processed and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. I will comply with my obligations and safeguard your rights under the Data Protection Legislation at all times. For more details on security see Part 7.

If you contact me via the contact form and I obtain your personal details, I may use them to respond to your message.

Any and all emails containing your personal data will be deleted no later than 7 years after the subject matter of your email has been resolved. And no other personal data will be retained.

I will not share any of your personal data with third parties apart from those exceptional circumstances set out in Part 8, below, and for storage on an email server.

9. What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data I hold about you, including any data you have provided to me. You can also request that I erase any personal data I hold about you. This does not include any data I am obliged to keep for administrative, legal, or security purposes.

If you want to know what personal data I have about you, you can ask me for details of that personal data and for a copy of it (where any such personal data is held). This is known as a ‘subject access request’.

All subject access requests should be made in writing and sent to the email or postal addresses shown in Part 10.

There is not normally any charge for a subject access request. If your request is manifestly unfounded or excessive (for example, if you make repetitive requests) a fee may be charged to cover my administrative costs in responding.

I will respond to your subject access request within 30 days and, in any case, not more than one month of receiving it. Normally, I aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date I receive your request. You will be kept fully informed of my progress.

10. My contact details

To contact me about anything to do with your personal data and data protection, including to make a subject access request, please use the following details:

E: contact@lukebealecounselling.co.uk

T: 07516217683