Privacy Policy

Effective date: 19 June 2026

This Privacy Policy explains how I, Marian Stapley of Marian Stapley Counselling (“I”, “me”, “my”), collect, use, store and protect your personal information when you use this website or engage with my counselling services.

I am committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Data (Use and Access) Act 2025 (DUAA), and other applicable UK data protection and privacy laws.

This Privacy Policy explains what personal information I collect, why I collect it, how I use it, how long I keep it, when I may share it, and your rights in relation to your personal information.

I may update this Privacy Policy from time to time. Any changes will be posted on this page and, where appropriate, notified to you. Please check this page periodically for the latest version.

Data Controller

For the purposes of UK data protection law, the Data Controller is:

Marian Stapley
Marian Stapley Counselling
10 Barnetts Field
Westergate
Chichester
PO20 3UD

Email: marianstapleycounselling@btinternet.com
Telephone: 07815 628911
ICO Registration Number: ZA317190

Data protection contact: Marian Stapley, using the contact details above.

Information I Collect

I may collect and process the following personal information:

your name;
address;
telephone number;
email address;
information you provide through contact forms, emails or other enquiries;
information you provide when arranging or attending counselling;
information disclosed during counselling sessions;
clinical or counselling notes relating to the services I provide;
appointment and attendance information;
payment and invoicing records; and
website usage information, including information collected through cookies and analytics where applicable.

I may also automatically collect certain technical information when you use my website, including:

IP address;
browser type and version;
operating system;
pages visited;
time spent on pages;
referral sources; and
website interaction data.

I only collect information that is reasonably necessary for the purposes described in this Privacy Policy.

Information Received from Other Sources

I normally collect personal information directly from you.

Where necessary and appropriate, I may also receive limited information from third parties, such as your GP, insurer or Employee Assistance Programme (EAP), where this is necessary to arrange or fund counselling. This may include your name, contact details, referral information and information relevant to arranging or funding the counselling service.

Where I receive information about you from another source, I will handle it in accordance with applicable data protection law and this Privacy Policy.

Special Category Data

Counselling may involve the processing of special category personal data, particularly information concerning your physical or mental health, wellbeing and emotional circumstances.

I only process special category data where it is necessary and where a lawful condition for processing special category data under Article 9 of the UK GDPR applies.

Depending on the circumstances and the nature of the counselling service provided, this may include processing necessary for the provision of health or social care under Article 9(2)(h) of the UK GDPR and the relevant provisions of the DPA 2018, where the applicable statutory conditions and safeguards are met.

Where another Article 9 condition is applicable, I will rely on that condition instead.

I treat information disclosed during counselling as confidential and apply appropriate safeguards to protect it.

Lawful Basis for Processing

I process personal data only where I have a lawful basis to do so under Article 6 of the UK GDPR.

The lawful basis will depend on the purpose for which the information is being processed.

Providing counselling and maintaining records

I process personal data where this is necessary to provide counselling services, manage our professional relationship and maintain appropriate counselling records.

The relevant Article 6 lawful basis may include:

Article 6(1)(b) – processing necessary for the performance of a contract with you or to take steps at your request before entering into a contract; and/or
Article 6(1)(f) – legitimate interests, where appropriate, for the proper and efficient administration of my private practice.

Where special category data is processed, I will also rely on an applicable Article 9 condition, as described above.

Appointments and communication

I process contact and appointment information to arrange appointments, communicate with you about your counselling, respond to enquiries and administer my practice.

The lawful basis may include Article 6(1)(b) (contract) and, where appropriate, Article 6(1)(f) (legitimate interests).

Payments and financial records

I process payment and invoicing information where necessary to provide the services and receive payment.

The lawful bases may include:

Article 6(1)(b) – performance of a contract; and
Article 6(1)(c) – compliance with a legal obligation, including applicable tax and accounting requirements.

Legal obligations and protection of individuals

I may process or disclose personal information where this is necessary to comply with a legal obligation, protect someone’s vital interests, comply with safeguarding requirements, or establish, exercise or defend legal claims.

The applicable lawful basis will depend on the circumstances.

Where special category data is involved, I will rely on an applicable Article 9 condition as required by law.

Website analytics

Where I use non-essential analytics, such as Google Analytics, I will only use them where the required consent has been obtained.

Where consent is the lawful basis, you may withdraw it at any time.

Legitimate Interests

Where I rely on Article 6(1)(f), my legitimate interests may include:

operating and administering my private practice;
managing appointments and my diary;
communicating with existing clients;
maintaining the security of my website, systems and records;
preventing misuse of my systems;
maintaining appropriate business and professional records; and
protecting my legal rights.

Where I rely on legitimate interests, I consider whether the processing is necessary and whether my interests are overridden by your interests or fundamental rights and freedoms.

You have the right to object to processing based on legitimate interests. Where you object, I will consider your objection in accordance with UK data protection law.

How I Use Your Information

I may use your personal information to:

provide counselling services;
arrange and manage appointments;
maintain appropriate counselling and clinical records;
communicate with you;
respond to enquiries;
process payments and maintain financial records;
meet legal, regulatory, professional and insurance requirements;
maintain the security of my website, systems and records;
deal with complaints;
establish, exercise or defend legal claims where necessary; and
operate and administer my private practice.

I will not use your personal information for unrelated purposes unless I have a lawful basis to do so.

Clinical Notes and Professional Supervision

As part of providing counselling services, I keep appropriate counselling or clinical notes relating to our work together.

These records are stored securely and accessed only where necessary for the provision of counselling services, professional obligations, legal requirements or other lawful purposes.

I undertake professional supervision in accordance with the professional standards applicable to my practice.

Where information about clients is discussed in supervision, I will anonymise or minimise identifying information wherever reasonably possible.

Where identifiable information needs to be discussed, I will only do so where this is necessary, appropriate and lawful. Professional supervisors are expected to maintain appropriate confidentiality.

Where applicable, I comply with the ethical and professional requirements of the British Association for Counselling and Psychotherapy (BACP) in relation to confidentiality, record keeping, supervision and complaints.

Confidentiality and Disclosure

Information you provide during counselling is treated as confidential.

There are, however, circumstances in which I may need to disclose information where this is necessary and lawful. These may include circumstances where:

I am required by law to disclose information;
there is a serious and imminent or otherwise significant risk of harm to you or another person and disclosure is necessary to protect someone;
there are safeguarding concerns;
disclosure is necessary to comply with a legal or regulatory obligation;
disclosure is necessary to establish, exercise or defend legal claims;
disclosure is necessary in connection with the prevention or detection of serious crime, money laundering or terrorism where applicable; or
information needs to be shared for professional supervision or other professional purposes, with identifying information minimised or anonymised wherever reasonably possible.

I will disclose only information that is necessary and lawful in the circumstances.

Where it is lawful and appropriate to do so, I will discuss the need for disclosure with you before making it. However, there may be circumstances where I cannot tell you in advance because doing so could prejudice the purpose of the disclosure or would otherwise be unlawful or inappropriate.

Who I May Share Your Information With

I will only share your personal information where there is a lawful basis to do so and where sharing is necessary and proportionate.

Depending on the circumstances, this may include:

your GP or other healthcare professional, where appropriate and lawful;
your insurer or Employee Assistance Programme (EAP), where they are involved in arranging or funding your counselling;
my professional supervisor, where necessary for supervision and subject to appropriate confidentiality;
professional advisers, such as accountants, insurers or lawyers, where necessary and lawful;
website, email, hosting, booking, payment and other service providers who process information on my behalf; and
public authorities or law-enforcement bodies where I am legally required or permitted to disclose information.

Where another organisation processes personal data on my behalf, I will take appropriate steps to ensure that the processing is carried out in accordance with UK data protection law.

Data Storage and Security

I take the security of your personal information seriously.

I use appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, destruction, misuse or disclosure.

Depending on the circumstances, these measures may include:

access controls;
secure passwords;
encryption where appropriate;
secure email and online systems;
software and security updates;
appropriate device security;
secure storage of paper records;
restricted access to counselling records; and
secure disposal or destruction of records when they are no longer required.

No transmission or storage system can be guaranteed to be completely secure. However, I take reasonable and appropriate steps to protect your information.

International Transfers

Some service providers I use, such as email, website hosting, cloud storage, analytics or other technology providers, may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, I will ensure that the transfer is carried out in accordance with UK data protection law and that an appropriate transfer mechanism or safeguard is in place where required.

Depending on the circumstances, this may include a UK adequacy regulation, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

Where a provider is certified under a recognised UK extension to an approved international data-transfer framework, I may rely on that framework where permitted by law.

Data Retention

I will only retain personal information for as long as it is reasonably necessary for the purposes for which it was collected, taking account of legal, professional, regulatory, insurance and business requirements.

My retention periods may vary depending on the type of information and the circumstances.

Generally:

counselling and clinical records are normally retained for seven years from the end of counselling, unless a longer period is required or justified by applicable legal, professional, regulatory or insurance requirements;
financial and accounting records are normally retained for six years, or longer where required by law;
supervision records are retained in accordance with applicable professional requirements and, where possible, information relating to clients is anonymised; and
website analytics information is retained in accordance with the settings and retention periods applicable to the analytics service being used.

I periodically review the information I hold and securely delete or destroy personal information when it is no longer required.

Cookies

My website uses cookies and similar technologies.

These may include:

strictly necessary cookies;
functionality cookies; and
performance or analytics cookies.

Where consent is required for non-essential cookies, I will obtain your consent before setting or using them.

Non-essential analytics cookies, including Google Analytics where used, are currently configured so that they do not operate unless you have provided the required consent.

You can withdraw or change your cookie choices through the cookie settings provided on the website.

A separate Cookie Policy explains the cookies and similar technologies used on the website, their purposes, providers and applicable retention periods.

Your Data Protection Rights

Depending on the circumstances and the lawful basis on which your information is processed, you may have rights under UK data protection law, including the right to:

ask for access to your personal information;
ask for inaccurate or incomplete information to be corrected;
ask for your information to be erased in certain circumstances;
ask for processing to be restricted in certain circumstances;
object to certain processing, including processing based on legitimate interests;
request data portability where the legal requirements for this right are met;
withdraw consent where processing is based on consent; and
complain about how your personal information is being handled.

Some rights are subject to exceptions and limitations. For example, I may need to retain certain information to comply with legal or professional obligations, or an exemption may apply to particular counselling or health information.

I may need to verify your identity before responding to a request.

I will respond to a valid data protection rights request without undue delay and, in any event, normally within one month of receiving it. Where permitted by law, this period may be extended by up to a further two months where a request is complex or there are multiple requests. If an extension applies, I will tell you within the initial response period.

Subject Access Requests

You have the right to ask for a copy of the personal information I hold about you, subject to applicable legal exemptions.

I will normally provide this information free of charge.

I may charge a reasonable fee, or refuse to act on a request, where permitted by law, for example where a request is manifestly unfounded or excessive, or where additional copies are requested.

I may need to verify your identity before providing personal information.

Data Protection Complaints Procedure

If you have concerns about how I have handled your personal information, you can make a data protection complaint to me.

You can make a complaint:

by email at marianstapleycounselling@btinternet.com;
by telephone on 07815 628911; or
in writing to Marian Stapley Counselling, 10 Barnetts Field, Westergate, Chichester, PO20 3UD.

If you require reasonable assistance to make a complaint, please let me know.

I will acknowledge your data protection complaint within 30 days of receiving it.

I will then take appropriate steps to investigate the complaint, keep you informed about progress where appropriate, and provide you with the outcome without undue delay.

If your complaint also concerns another aspect of my counselling service, I may deal with that part of the complaint under my separate professional complaints procedure.

If you remain dissatisfied after I have responded to your data protection complaint, you have the right to complain to the Information Commissioner’s Office (ICO).

Complaining to the ICO

You have the right to complain to the Information Commissioner’s Office if you believe that your personal information has been handled in breach of data protection law.

The ICO can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Further information about making a complaint is available on the ICO website:

Information Commissioner’s Office – Make a complaint

Automated Decision-Making and Profiling

I do not currently use your personal information for solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning you.

If this changes, I will update this Privacy Policy and ensure that any such processing complies with applicable data protection law.

Children’s Data

My counselling services are provided to adults.

I do not knowingly collect children’s personal information through this website for the purpose of providing counselling services.

If I become aware that I have inadvertently collected personal information relating to a child, I will take appropriate steps in accordance with applicable data protection law.

Personal Data Breaches

I have appropriate procedures for identifying, managing and responding to personal data breaches.

Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, I will comply with my legal obligations, including notifying the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach, where notification is required.

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, I will also notify those individuals where required by law.

Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes to my services, technology, legal requirements or data-processing practices.

The latest version will be published on this website and will show the effective date.

Contact

If you have any questions about this Privacy Policy or how your personal information is handled, please contact: