Website Privacy Notice

1. About this notice

I am the data controller for the personal data described in this notice. I am responsible for deciding why and how it is used and for handling it in accordance with the UK GDPR, the Data Protection Act 2018 as amended, and other applicable privacy and electronic-communications law.

Questions or requests can be sent to [email protected]. A postal address is available on request.

My website and services are intended for adults aged 18 and over. I do not knowingly collect personal data from children through this website. If I become aware that a child has submitted personal data, I will take reasonable steps to delete it unless retaining or using it is necessary for safeguarding or another legal obligation. I do not offer online services to children. If, exceptionally, I needed to rely on a child’s consent for an online service, I would obtain verifiable authorisation from a person with parental responsibility where the child is under 13, as required by UK data-protection law.

Using the website, contacting me, joining a list or requesting a resource does not by itself create a therapist–client, supervisor–supervisee or other professional relationship. The website is not a crisis or emergency service. If you or someone else is in immediate danger, call 999 or go to the nearest Accident & Emergency department rather than using the website to seek help.

Please tell me if your contact information changes so that the information I hold remains accurate.

2. What I collect, why I use it and my lawful basis

Personal data means information relating to an identified or identifiable person. I may use the following categories of personal data.

Enquiries and communications

This may include your name, email address, telephone number, social-media details and the content of messages you send through a form, email, telephone, text message or another communication channel.

I use this information to respond to you, arrange an initial conversation or appointment, maintain appropriate business records, and establish, exercise or defend legal claims where necessary. My lawful bases are taking steps at your request before entering into a contract and my legitimate interests in responding to enquiries, administering my practice and protecting my legal position.

Priority-list information

This includes your name, contact details, the type of service you are interested in, relevant appointment preferences and any brief information you choose to provide. I use it to manage the priority list and contact you when a suitable appointment becomes available. My lawful bases are taking steps at your request before entering into a contract and my legitimate interests in managing availability fairly and efficiently.

Health and other special-category data

An enquiry or priority-list form may allow you to provide information about your physical or mental health or other sensitive matters. It may also reveal other special-category data, such as racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation.

I will only use this information to respond to your enquiry, understand the service you are seeking or manage your priority-list request. Before you submit it, you will be asked to confirm your explicit consent through a separate, unticked statement that identifies the sensitive information involved and the purpose for which it will be used. For this processing, I rely on your consent under Article 6(1)(a) of the UK GDPR and your explicit consent under Article 9(2)(a). You may make a general enquiry without providing sensitive details.

Mailing-list and free-resource information

This includes your name, email address, subscription preferences and a record of when and how you subscribed. Where a free guide, audio or other resource is offered, the form will clearly explain that you are joining my mailing list and that the resource is provided as a welcome gift.

I use this information to send the requested resource and occasional emails about OCD, anxiety, therapy, supervision, my services and related professional content. My lawful basis is your consent. You can unsubscribe at any time using the link in any marketing email or by contacting me. Withdrawing consent does not affect anything already lawfully done before withdrawal.

Bookings, services and payments

If you proceed to an appointment, I may collect your name, contact details, booking information, service selected, payment status, transaction reference and related correspondence. I use this to arrange and supply the requested service, administer payments and keep accounting records. My lawful bases are taking steps before a contract, performing the contract, complying with legal obligations and my legitimate interests in practice administration and handling claims or complaints.

Card payments are handled by Stripe. PayPal or Zettle may be used if you choose that payment method. I do not receive or store your full payment-card number. The payment provider may process information for its own security, fraud-prevention and legal purposes under its own privacy terms.

Website, device and analytics information

This may include your IP address, browser and device type, time zone, referring page, pages viewed, interaction information, cookie identifiers and technical logs.

I use necessary information to operate and secure the website, diagnose faults and prevent misuse. My lawful basis is my legitimate interests in providing a secure and effective website. I use Google Analytics to understand how visitors use the site and improve it. Google Analytics is used only after you give consent through the cookie banner, and my lawful basis for that processing is consent.

3. How I collect personal data

I collect personal data:

• directly from you when you complete a form, subscribe, book, pay or communicate with me;
• automatically through cookies, similar technologies, server logs and Google Analytics; and
• from service providers involved in a requested booking, payment, email delivery or website interaction.

I do not buy marketing lists or collect personal data about website visitors from public registers for marketing purposes.

4. Cookies and similar technologies

The website uses necessary cookies and similar technologies to function and remain secure. It also uses Google Analytics. The cookie banner lets you accept or reject non-essential technologies and records your choice. Non-essential technologies will not be used unless an applicable exception permits their use or you have given the required consent.

You can change your cookie choices through the website’s cookie settings and can also control cookies through your browser. Blocking necessary cookies may affect how parts of the site work. Please see my Cookie Policy for details of the cookies and technologies currently in use.

5. Marketing communications

I will send marketing emails only where you have actively subscribed or where another lawful electronic-marketing rule clearly applies. Consent is not inferred from making a therapy or supervision enquiry. Each marketing email contains an unsubscribe option.

6. Who I share personal data with

I share personal data only where necessary for the purposes described above. Depending on how you use the website or communicate with me, recipients may include:

• Pykthos and its underlying HighLevel/GoHighLevel and LeadConnector services, used for website forms, customer-relationship management, bookings, workflows and email delivery;
• HostPapa and WordPress, used for domain, business email and the maintained legacy website that redirects to carolyngillan.com;
• Google, including Google Analytics and calendar services;
• Stripe and, where you choose them, PayPal or Zettle, for payment processing;
• providers supporting videoconferencing, mobile communications, messaging and device backups, including Zoom, Apple/iCloud, WhatsApp and TalkMobile;
• my professional advisers, insurer, regulators, courts, law-enforcement bodies or public authorities where disclosure is necessary or required by law.

Service providers receive only the information needed for their role and are subject to appropriate contractual, confidentiality or legal obligations. Some providers may also act as independent controllers for limited purposes such as security, fraud prevention or compliance with their own legal duties. Where a provider acts as an independent controller, its own privacy notice applies to that independent processing, and you should review that notice for information about how it uses your data and how to exercise your rights. I do not sell personal data.

7. International data transfers

Some service providers and their subprocessors may process personal data outside the UK, including in Canada and the United States. Where this involves a restricted transfer, I use a lawful transfer mechanism. This may include UK adequacy regulations where they apply, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

Where contractual safeguards are used, I complete the required data protection test and consider whether additional protections are needed. You may contact me for more information about the safeguard relevant to your data and how to obtain a copy.

8. Data retention

I keep personal data only for as long as it is reasonably needed for the purpose for which it was collected, including legal, professional, insurance and accounting requirements. In general:

• enquiries that do not lead to a professional service are normally retained for up to 12 months after the last contact;
• priority-list information is kept while you remain on the list and for up to 12 months afterwards where needed to administer or evidence the request;
• mailing-list information is kept while you remain subscribed, with a minimal suppression record retained afterwards where necessary to respect your opt-out;
• Google Analytics user-level and event-level data is retained for up to 14 months;
• payment and accounting records are retained for six years from the end of the relevant tax or accounting period; and
• if you become a therapy client or supervisee, information forming part of the professional record is normally retained for eight years after the last session, as explained in the relevant service privacy notice.

I may retain information for longer where this is necessary for a complaint, legal claim, safeguarding matter or legal obligation. When information is no longer required, I securely delete or anonymise it. Residual copies in protected backups may remain for a limited period before being overwritten in accordance with the provider’s backup cycle.

9. Data security

I use proportionate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These include access controls, strong passwords, two-factor authentication where available, secure devices, restricted access and appropriate processor arrangements.

If a personal-data breach occurs, I will assess it, record it and take appropriate steps to contain and address it. Where the breach is likely to result in a risk to people’s rights and freedoms, I will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to an affected person’s rights and freedoms, I will also notify that person without undue delay, unless a legal exception applies.

10. Automated processing

Automated workflows may be used to send a resource you requested, an administrative email or an appointment-related message. Contacts may also be grouped according to an expressed preference or request—for example, the service they are interested in—so that the correct information or workflow is used.

I do not use website data for solely automated decision-making or profiling that produces legal effects or otherwise significantly affects you. Routine email delivery, administrative workflows and grouping contacts according to their stated preferences are not used to make significant decisions about access to therapy, supervision or another professional service.

11. Your data-protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• request access to the personal data I hold about you;
• ask me to correct inaccurate or incomplete information;
• ask me to erase information where there is no continuing lawful reason to keep it;
• ask me to restrict how information is used;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain information in a portable format where the legal conditions apply; and
• withdraw consent at any time where I rely on consent.

These rights are not all absolute. I will explain if a particular right does not apply. I normally respond within one month, although the law permits additional time for a complex request. I do not normally charge a fee, but I may ask for information needed to confirm your identity.

To exercise a right, email [email protected].

12. Data-protection complaints

If you have a concern about how I have used your personal data, you can send a data-protection complaint to [email protected]. Please include enough information for me to understand the concern and, if possible, the outcome you are seeking.

I will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed where appropriate and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office. I would welcome the opportunity to address your concern first, but you do not have to contact me before approaching the ICO. Information is available at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

13. Third-party links

The website may contain links to websites or services operated by other organisations. Their use of personal data is governed by their own privacy information. I am not responsible for their content or privacy practices, so please review the relevant notice before providing personal data.

14. Changes to this notice

I may update this notice when my services, providers or legal obligations change. The current version will be posted on the website with its updated date. Where a change is likely to have a significant effect on people, I will take reasonable steps to bring it to their attention. Previous versions are available on request.