​​

1. General

   1. We are Grieve Then Achieve Ltd of company number 13533089, and our registered address is at Office N, Floor 6, St Clare House, Princes Street, Ipswich, Suffolk, England, IP1 1LH. We take the privacy of your information very seriously and this Privacy Notice is designed to tell you about our practices regarding the collection, use and disclosure of personal data which may be obtained via our website or other means including online forms, email, or phone.

   2. In this notice “you” refers to any individual whose personal data we hold or process (but it does not relate to personal data relating to our employees or staff).

   3. In general, we provide coaching, counselling and psychotherapy services. If we do provide such services to you, please note a separate “Privacy Notice for Clients” will apply and will be provided to you. We do not process personal data on a large scale, but we will hold and process personal data in order to supply our services and this privacy notice explains how we do so.

   4. This notice is governed by the EU General Data Protection Regulation (the “GDPR”), UK GDPR, Data Protection Act 2018 and any other applicable data or privacy legislation.  I process personal data about you in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

   5. Data controller: Kate Nudds / Grieve Then Achieve Ltd

   6. ICO registration number: ZB286538

​

1. Categories of Personal Data and Legal Basis

   1. Below we have set out the categories of data we collect and how we process the data (for information about legal basis, please see below):

      1. we will hold contact information for our users who have registered with us, such as name, email address and telephone number (for authentication) (“Contact Information”) which we will use to provide our services and communicate with you;]

   2. We process Contact Information on the basis of the performance of our contract with our client, on the basis of our legitimate interest in providing our services to our clients and users or in certain circumstances as may be necessary for compliance with a legal obligation to which we are subject.

   3. Generally, we will collect information directly from you. If we obtain your personal data from any other third party your privacy rights under this notice are not affected and you are still able to exercise the rights contained within this notice.

​

1. You do not have to supply any personal data to us however in practice we may be unable to provide our services to you without personal data (for instance we will need contact information in order to communicate with you). You may withdraw our authority to process your personal data (or request that we restrict our processing) at any time but there are circumstances in which we may need to continue to process personal data (please see below).

​

1. Data retention

   1. Our current data retention policy is to delete or destroy (to the extent we are able to) personal data in accordance with the following retention periods:

Information relating to our website users

We will hold information for registered and non-registered users for 12 months from the date on which we collect the data, or, if later, from the date on which you cease to be a registered user.

1. The retention periods stated in this notice can be prolonged or shortened as may be required.

2. We review the personal data (and the categories of personal data) we hold on a regular basis to ensure the data we are holding is still relevant to our business and is accurate. If we discover that certain data we are holding is no longer necessary or accurate, we will take reasonable steps to correct or securely delete this data as may be required.

3. If you wish to request that data we hold about you is amended or deleted, please see section 7 below, which explains your privacy rights.

 

4. Information relating to our clients

We will hold information on our clients for 7 years from the date our professional relationship ends, in line with our insurer's requirements. The data we collect includes: name, date of birth, address, telephone number, and email address.

We hold this information to enable us to fulfil our professional obligations to you and to communicate with you during the course of our work together.

Your details are stored in password-protected digital files and retained for 7 years in line with our insurer's requirements. After this period, your data will be securely deleted or destroyed

​​

1. Sharing your information

   1. We do not disclose any information you provide to any third parties other than as follows:

      1. From time to time we will transfer personal data to our sub-processors

      2. we may be required to disclose certain data to regulators or other lawful authorities;

      3. if we are under a duty to disclose or share your personal data in order to comply with any legal obligation (for example for the purposes of prevention of fraud or other crime);

      4. in order to enforce any terms and conditions or agreements for our services that may apply

      5. e) we share relevant financial and contact data (such as names, invoice details, and transaction records) with our appointed accountant and accounting software provider, for the purposes of bookkeeping, tax compliance, and financial reporting;

      6. I may discuss your work in clinical supervision, in an anonymised form wherever possible.

      7. I will share your name and contact details with my clinical executor, so they may contact you in the event of my death or incapacity.

      8. I may share your information with relevant professionals or authorities if I believe that you or another person is at risk of serious harm.

   2. Other than as set out above, we shall not disclose any of your personal data unless you give us permission to do so. If we do supply your personal data to a third party, we will take reasonable steps to ensure that your privacy rights are protected and that third party complies with the terms of this notice.

​

1. Security

We will take all reasonable steps to ensure that appropriate technical and organisational measures are carried out in order to safeguard the information we collect from you and protect against unlawful access and accidental loss or damage. These measures may include (as necessary):
(a) the use of secure, encrypted connections (SSL/TLS) for data transmitted via our website;
(b) password-protected access to our systems, with two-factor authentication enabled where available;
(c) restricting access to personal data to those who need it to carry out their role;
(d) the use of reputable third-party providers who maintain their own appropriate security standards (such as PCI-DSS compliant payment processors);
(e) confidentiality obligations placed on any staff, contractors, or third parties who process personal data on our behalf;
(f) regular review of the systems and access permissions in place to protect personal data.

1. We will take reasonable steps to ensure that our employees are aware of their privacy and data security obligations.

 

1. Cookies

   1. Like most websites, we use cookies to help provide you with the best experience whilst using our service. We use the following cookies:

   2. We use cookies to provide you with the best experience on our website. The cookies we use fall into the following categories: essential cookies (required for the site to function), functional cookies (to remember your preferences), analytics cookies (to help us understand how visitors use our site), and, where applicable, advertising/marketing cookies. A full, up-to-date list of the specific cookies used on our site, including their names, providers, and purposes, is available via our cookie consent banner / cookie settings tool, accessible at the bottom of every page on our site.

   3. If you choose not to accept or disable certain cookies, this will not affect your access to the majority of information available on our website however certain online services may not be available.

​

1. Your privacy rights

   1. With respect to your personal data, you have the right to:

      1. request that your personal data will not be processed;

      2. ask for a copy of any personal data that we have about you;

      3. request the correction of any errors in or update of the personal data that we have about you;

      4. request that your personal data will not be used to contact you for direct marketing purposes;

      5. request that your personal data will not be used for profiling purposes;

      6. request that your personal data will not be used to contact you at all;

      7. request that your personal data be transferred or exported to another organisation, or deleted from our records; or

      8. at any time, withdraw any permission you have given us to process your personal data.

   2. All requests or notifications in respect of your above rights may be sent to us in writing at the contact details listed below.

   3. We will endeavour to comply with such requests as soon as reasonably possible but in any event, we will comply within one month of receipt (unless a longer period of time to respond is reasonable by virtue of the complexity or number of your requests).

 

1. Data breaches

   1. If personal data we hold about you is subject to a breach or unauthorised disclosure or access, we will report this to our data protection manager and/or the ICO as is deemed necessary.

   2. If a breach is likely to result in a high risk to your data rights and freedoms, we will notify you as soon as reasonably possible.

​

1. Transferring your information outside the UK or EEA

9.1 We will not transfer your personal data in a systematic way outside of the European Economic Area or UK but there may be circumstances in which certain personal information is transferred outside of the European Economic Area or UK. Some of our third-party service providers (such as our website hosting provider, email marketing platform, or accounting software may store or process data outside the UK or EEA, including in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum (IDTA), or by relying on a UK adequacy regulation where applicable

1. If we transfer your information outside of the European Economic Area or UK, and the third country or international organisation in question has not been deemed by the EU Commission or Secretary of State (as the case may be) to have adequate data protection laws, we will provide appropriate safeguards and we will be responsible for ensuring your privacy rights continue to be protected as outlined in this notice.

 

1. Notification of changes

We will post details of any changes to our privacy notice on our website. Please ensure you check the website regularly for any updates.

 

1. Contact us

If at any time you would like to contact us with your views about our privacy practices, or with any enquiry or complaint relating to your personal information or how it is handled, you can do so by contacting us at kate@grievethenachieve.co.uk.

 

 

1. Complaints

If you have a concern about how your personal data has been handled, for example a request to access or delete your records that was not dealt with to your satisfaction, or a concern about whether your information was shared appropriately or stored securely, please raise it with me directly in the first instance.

​

Please note that this covers concerns about data handling only, not about the therapeutic relationship or professional conduct. 

​

To raise a data protection concern, please contact me at kate@grievethenachieve.co.uk will acknowledge your concern within 30 days and respond as promptly as possible.

If we are unable to resolve any issues you may have or you would like to make a further complaint, you can contact the ICO by visiting http://www.ico.org.uk/ for further assistance.