Data Controller 

Nicky Vallance is the Data Controller responsible for your personal data.

If you have any questions about this policy or how your data is handled, you can contact me at:
nicky@pensievepoolofthoughts.com

What Information Do I Collect?

I aim to keep records to a minimum. The information I may collect includes:

• Your name, address, email address, and telephone number when you enquire about or engage in coaching or counselling services
• Information you provide via my website contact form
• A signed contract or agreement between us

• I keep note-taking to a minimum. Any notes made are brief, factual, and focused only on key themes or risks discussed within the session (for example, noting that risk was discussed without recording detailed personal content).

  These notes are not verbatim records and do not include detailed accounts of sessions.

• Appointment records are maintained in a diary system using limited identifying information (codes).

• Anonymous data for service evaluation and statistical purposes

Some of the information collected during counselling sessions may be considered special category data (for example, information relating to your emotional wellbeing or mental health).

Legal Basis for Processing Your Data

I process your personal data under the following lawful bases:

• Contractual necessity – to provide coaching and counselling services
• Legitimate interests – for the effective running of my practice
• Special category data (Article 9 UK GDPR) – where sensitive personal information is shared within counselling sessions

How Is Your Information Stored and Secured?

Your data is stored securely using both electronic and paper systems:

• Electronic records are stored on password-protected devices
• Devices are secured using a password and/or biometric protection
• Paper records are kept in locked storage
• Identifiable information (such as contact details) is stored separately from session notes, where possible
• All records are accessible only to me

I take appropriate technical and organisational measures to protect your data from loss, misuse, or unauthorised access.

How Do I Use Your Personal Information?

Your personal information is used solely for:

• Providing coaching and counselling services
• Communicating with you regarding appointments and services
• Maintaining appropriate records
• Meeting professional and legal obligations

Your data will not be shared with third parties without your consent unless:

• There is a legal requirement
• There is a safeguarding concern
• There is a risk of serious harm

In such cases, only necessary and relevant information will be shared.

Data Retention

In line with professional guidelines, your records will be kept securely for 7 years after the end of our work together. After this period, all data will be safely and securely destroyed.

Your Rights

Under UK GDPR, you have the right to:

• Request access to the personal data I hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data (where appropriate)
• Restrict or object to processing
• Request transfer of your data (data portability)

To exercise any of these rights, please get in touch with me at:
nicky@pensievepoolofthoughts.com

Data Breaches

In the unlikely event of a data breach, I will assess the risk and take appropriate action. Where required, I will notify the Information Commissioner’s Office and any affected individuals.

Complaints

If you have concerns about how your data is handled, I encourage you to contact me first so I can resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk).

Website & Cookies

My website may use basic cookies or analytics tools to improve user experience and monitor website performance. No personally identifiable information is collected without your consent.

Email Communication

While I take reasonable steps to protect your information, email communication is not completely secure. I recommend limiting the sharing of sensitive personal information via email.

Working with teens (13+)

Appropriate parental or guardian consent.

Professional Standards & Registration

I am registered with the Information Commissioner’s Office (ICO) under registration number: ZA492778.

I hold an up-to-date DBS check.

Review of Policy

This policy is reviewed regularly and may be updated to reflect changes in legal or professional requirements.

I charge £60 for a 60-minute session and £75 for a 90-minute session. A limited number of concessionary rates are available. Please feel free to enquire if this would be helpful for you.

Payment by cash or bank transfer.

Sessions are payable at the time of booking to secure your appointment.

If you need to cancel or reschedule,  at least 24 hours’ notice is required wherever possible. Where possible, I will offer an alternative appointment time within the same week. This will be a rearrangement of your existing session, rather than an additional session.

Cancellations made with less than 24 hours’ notice may be subject to a cancellation fee. I understand that unexpected situations can arise, and this will be considered on a case-by-case basis.

Late Attendance

If you arrive late, I will do my best to adjust the session so that you can still receive the full time. However, this will depend on my schedule on the day and cannot be guaranteed. In some cases, the session may still need to end at the originally agreed time, and the full fee will apply.