The Counselling Foundation GDPR Privacy Policy
1. Introduction
The Counselling Foundation (“the Foundation”) is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant provisions of the Data (Use and Access) Act 2025.
This policy applies to all individuals whose personal data we process, including counselling clients, training applicants, course attendees, staff, trustees, volunteers, and website users.
2. Data Controller and Data Protection Officer
The Counselling Foundation is the Data Controller for all personal data collected and processed.
We have appointed ITBuilder Ltd as our Data Protection Officer (DPO). The DPO is responsible for monitoring compliance with data protection laws and providing advice on data protection matters.
Data Protection Officer:
ITBuilder Ltd
Email: dataofficer@itbuilder.co.uk
3. How We Collect Personal Data
We collect personal information directly from you when you:
- Enquire about or use our counselling services
- Apply for or attend our training courses
- Submit an enquiry via our website or other communication channels
- Apply for employment or volunteer opportunities
- Engage with us as a supplier or partner
We may also collect personal information from third parties where necessary to provide our services, such as professional bodies, referees, or regulatory agencies.
4. Types of Personal Data We Collect
Depending on your relationship with the Foundation, we may collect:
- Personal identifiers (name, date of birth, address, contact details)
- Employment and education history (for applicants or trainees)
- Counselling records and session notes (for clients)
- Financial details for payments and invoicing
- Special category data such as health information, processed only where relevant and subject to appropriate safeguards
- Technical information including IP addresses, device data, and website usage information
Children’s Data:
Where counselling or support services involve individuals under the age of 18, we collect and process only the information necessary to provide those services. Such processing is conducted with appropriate parental or guardian consent and handled with heightened confidentiality and safeguarding protection.
5. Lawful Basis for Processing
We process personal data under the following lawful bases:
- Contract: To deliver counselling services, training courses, and employment or volunteering arrangements.
- Legal obligation: To comply with regulatory or statutory requirements.
- Legitimate interests: To manage and improve our services, communicate with existing trainees or clients, maintain records, and ensure service quality.
- Consent: For optional marketing communications and in specific cases involving special category data.
Recognised Legitimate Interests:
Where applicable, we may rely on recognised legitimate interests introduced by the Data (Use and Access) Act 2025, for example in circumstances involving safeguarding, preventing crime, or meeting regulatory obligations. We only use this basis where the processing is necessary and proportionate.
6. How We Use Personal Data
We use personal information to:
- Provide counselling and training services
- Process applications, payments, and attendance records
- Respond to enquiries and provide requested information
- Manage staff, volunteer, and trustee records
- Comply with legal, regulatory, and contractual obligations
- Maintain service quality, security, and safeguarding
- Send marketing communications as permitted by law and this policy
7. Marketing Communications
We may contact previous or current training applicants or attendees about future training opportunities under our legitimate interests. Individuals can opt out of these communications at any time.
We will only send marketing communications to new contacts where explicit consent has been provided.
8. Data Retention
Personal data is retained only for as long as necessary to fulfil the purpose it was collected for, including meeting legal, regulatory, and reporting requirements. Typical retention periods include:
- Counselling records: 7 years after last contact
- Training records: 7 years after course completion
- Financial and accounting records: 7 years
- Recruitment records: 12 months after the process concludes
- HR records: 7 years after employment ends
9. Data Sharing and Transfers
We may share personal data with trusted third-party service providers who support our operations, such as IT providers, payment processors, or training partners. These organisations act as data processors and are contractually required to process information securely and only for the purposes we specify.
Personal data is normally processed within the UK. Where transfers outside the UK or EEA are necessary, we apply appropriate safeguards such as Standard Contractual Clauses.
We may also share personal data with law enforcement, safeguarding bodies, regulatory authorities, or legal representatives where required by law, court order, or where necessary to protect the vital interests of an individual. All such disclosures are assessed and recorded to ensure they are lawful, proportionate, and necessary.
10. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. Measures include secure storage systems, access controls, encryption, staff training, and regular reviews of our data protection practices.
In the event of a personal data breach, we follow a documented breach response process. We assess the nature and impact of the breach, take steps to contain and mitigate any risk, and notify affected individuals where required by law. We also report breaches to the Information Commissioner’s Office (ICO) where legally required. All data breaches are recorded in line with regulatory obligations.
11. Data Subject Rights
Individuals have the following rights under UK GDPR:
- Access to their personal data
- Rectification of inaccurate or incomplete information
- Erasure of data where legally permitted
- Restriction or objection to processing
- Portability of data to another provider
- Withdrawal of consent at any time, where consent is the lawful basis for processing
- The right to complain to us about the way we have stored and used your personal data, see our Complaints Policy
- The right to lodge a complaint with the Information Commissioner’s Office (ICO)
Reasonable and Proportionate Searches:
When responding to subject access requests, we may limit searches to what is reasonable and proportionate, as permitted under the Data (Use and Access) Act 2025. We always ensure that individuals receive the information they are legally entitled to while preventing inappropriate disclosure of third-party or privileged information.
ICO Contact Details:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Cookies and Website Usage
Our website uses cookies to enhance user experience and analyse performance. Non-essential cookies, such as analytics and marketing cookies, are only set after user consent is obtained. Users can manage or withdraw their cookie preferences at any time.
We keep our cookie and tracking practices under review to reflect the Data (Use and Access) Act 2025. Where the Act allows the use of certain non-essential cookies without formal consent, we may apply those provisions. Our website and cookie banner will always reflect the current legal position.
13. Policy Updates
We review this policy to ensure it reflects current UK data protection legislation, including the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
Review Frequency: This policy is reviewed at least annually or sooner if significant changes occur.
The latest version will always be available on our website.
14. Contact Us
For questions, concerns, or to exercise your data protection rights, please contact us:
Data Protection
The Counselling Foundation
1 College Yard
Lower Dagnall Street
St Albans, AL3 4PA
Email: IT@counsellingfoundation.org