Policy Statement
Connect Counselling is committed to protecting the privacy and security of personal data. The company complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 (DUAA), and relevant professional codes of practice.
Connect Counselling is a sole trader operated exclusively by the Anya Bernhoeft, with no employees, associates, contractors, or volunteers. This policy sets out how personal data is collected, used, stored, and shared, and explains the rights of individuals whose data is processed.
1. Purpose
The purpose of this policy is to:
· Ensure personal data is handled lawfully, fairly, and transparently.
· Protect the rights of clients and other individuals whose personal data is processed.
· Provide a clear framework for data protection compliance within a single-practitioner organisation.
2. Scope
This policy applies to:
· All personal data processed by Connect Counselling in any format (electronic or paper).
· All data processed by the owner in the delivery and administration of services.
· All locations where services are delivered, including private premises, schools, clients’ homes, and community settings.
3. Types and Format of Data We Collect and Process
Personal data is collected and processed in both written and electronic formats, including:
· Written records with signatures – consent forms, contracts, assessments, and paper-based notes.
· Electronic records – referrals, assessment documents, therapy notes, reports, correspondence, and administrative records.
Types of data processed include:
· Personal identifiers – name, date of birth, address, and contact details.
· Special category data – health and medical information, therapy notes, and assessment information.
· Referral and background information – provided by clients, parents/carers, or professionals.
4. Lawful Bases for Processing
Personal data is processed under the following lawful bases:
· Article 6(1)(b) – Performance of a contract (to deliver therapeutic services).
· Article 6(1)(c) – Compliance with a legal obligation (e.g. safeguarding duties).
· Article 6(1)(f) – Legitimate interests (service delivery, administration, and quality monitoring).
· Article 9(2)(h) – Processing of special category data for the provision of health care or treatment.
· Article 6(1)(f) / DUAA Recognised Legitimate Interests – Under the Data (Use and Access) Act 2025, certain processing activities may rely on a “recognised legitimate interest” without requiring a full Legitimate Interests Assessment (LIA). This includes processing for safeguarding, prevention of crime, and other specified purposes relevant to the delivery of therapeutic services.
5. How We Store and Protect Data (Technical and Organisational Measures)
Connect Counselling takes appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, or disclosure.
· Digital records
· Stored on a secure, encrypted laptop and/or secure case management system.
· The laptop is protected by password security.
· All electronic files are password-protected and accessible only by the Owner.
· Paper records
· Stored in locked cabinets with access restricted to the Owner only.
· Data is retained in accordance with statutory and professional requirements (typically 7 years after last contact, or until the client reaches age 25 for children’s records).
6. International Data Transfers
Personal data is stored and processed within the United Kingdom only. Where data is transferred to or accessed from the European Union, this is conducted in accordance with the updated international transfer framework under Chapter 5 of the UK GDPR, as amended by the DUAA 2025.
Connect Counselling does not transfer or store personal data outside the UK or EU.
7. Sharing of Data
Personal data is shared only where necessary for the provision of services, safeguarding, legal compliance, or with explicit consent.
Data may be shared with statutory agencies (e.g. social care or police) where required for safeguarding or legal purposes.
Connect Counselling does not sell personal data or use it for marketing purposes.
7b. Third Party Data Processors
Connect Counselling uses a small number of trusted third-party services to operate its business. These providers may process personal data on our behalf as data processors. We only use processors that provide sufficient guarantees to implement appropriate technical and organisational measures in line with UK GDPR requirements.
The following third-party processors are currently used:
· Microsoft (Microsoft 365 / Outlook) – Used for email communication, which may contain personal data such as names, contact details, and appointment information. Microsoft acts as a data processor and is bound by a Data Processing Agreement with appropriate safeguards. Microsoft’s privacy information is available at microsoft.com/en-gb/privacy.
· Website Hosting Provider – Connect Counselling website is hosted by GoDaddy. GoDaddy may process limited personal data such as IP addresses and website usage data through server logs and any contact forms submitted via the website. GoDaddy’s privacy information is available at godaddy.com/legal/agreements/privacy-policy.
All third-party processors are required to keep personal data confidential and secure, and to use it only for the specific purposes for which it is shared. Connect Counselling remains the data controller and retains responsibility for ensuring personal data is handled appropriately at all times.
· Microsoft Teams – Used for remote video therapy sessions and virtual meetings. Microsoft Teams may process personal data including names, email addresses, and the content of video calls. As part of Microsoft 365, Teams is subject to Microsoft’s Data Processing Agreement and standard contractual clauses for any international data transfers. Microsoft’s privacy information is available at microsoft.com/en-gb/privacy.
· Zoom Video Communications – Used for remote video therapy sessions where required. Zoom may process personal data including names, email addresses, and video/audio call data. Zoom operates under a Data Processing Agreement and provides UK GDPR-compliant safeguards. Where Zoom processes data outside the UK, it does so under standard contractual clauses. Zoom’s privacy information is available at zoom.com/en/privacy.
8. Rights of Data Subjects
Individuals have the right to:
· Be informed about how their data is used.
· Access their personal data.
· Request correction of inaccurate data.
· Request deletion of data where applicable.
· Restrict or object to processing in certain circumstances.
· Data portability (where applicable).
· Lodge a data protection complaint directly with Connect Counselling (see Section 10 – Data Protection Complaints Procedure). Under the DUAA 2025, individuals are now required to raise complaints with the data controller in the first instance before escalating to the ICO.
Requests should be made in writing to the Data Protection Contact (see Section 11).
9. Data Protection Complaints Procedure
From 19 June 2026, the Data (Use and Access) Act 2025 introduced a statutory requirement for all data controllers to have a formal data protection complaints procedure. Individuals must raise concerns with Connect Counselling directly before escalating to the Information Commissioner’s Office (ICO). Connect Counselling is committed to handling all complaints fairly, promptly, and transparently.
How to raise a complaint:
· Complaints should be submitted in writing (by email or post) to the Data Protection Contact detailed in Section 11.
· Connect Counselling will acknowledge all complaints within 30 days of receipt.
· A full response will be provided without undue delay following investigation of the complaint.
· All complaints will be recorded and retained as part of Connect Counselling accountability documentation.
· If an individual is not satisfied with the outcome of their complaint, they have the right to escalate to the ICO: ico.org.uk / 0303 123 1113.
10. Data Breach Procedure
Any suspected data breach will be managed immediately by the Owner.
The Owner will assess the breach and, where required, notify the Information Commissioner’s Office (ICO) within 72 hours and affected individuals without undue delay.
11. Data Protection Contact
Name: Anya Bernhoeft
Role: Connect Counselling - Single Point of Contact for Data Protection
Email: anya@connect-counselling.uk
Phone: 07440467761
12. Review & Monitoring
This policy will be reviewed annually or sooner if required by changes in legislation, professional guidance, or best practice.
Approved by: Anya Bernhoeft – Connect Counselling
Date: June 2026
Review date: June 2027
Version: 2.0
Connect Counselling