Privacy Notice
Kirsty Holgate Counselling

CD06 Privacy Notice v1.0 
Last updated: June 2026
 
Your privacy is important to me. This Privacy Notice explains how I collect, use, store and protect your personal information when you contact me or use my counselling services.
I am committed to handling your information responsibly, confidentially and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the BACP Ethical Framework for the Counselling Professions.
 
Who I am
Kirsty Holgate Counselling
Email: hello@kirstyholgatecounselling.co.uk
Phone: 07716 780363
Practice Address:
Eastbourne
 
I am the Data Controller for the personal information you provide.
 
What information I collect
Depending on the support you are seeking, I may collect:

• Your name

• Contact details

• Date of birth

• Emergency contact details

• GP details

• Information you provide during your initial enquiry

• Assessment information

• Information discussed during counselling sessions

• Session notes

• Appointment history

• Payment information

• Email and other correspondence between us

• Information about your use of my website (such as cookies and website analytics where applicable)

Because counselling often involves discussing sensitive matters, I may also collect special category information, including information about:

• Physical and mental health

• Racial or ethnic origin

• Religious or philosophical beliefs

• Sexual orientation

• Sex life

• Political opinions

I only collect information that is relevant to providing safe, ethical and effective counselling.
 
Why I collect your information
I use your information to:

• Respond to your enquiry

• Arrange appointments

• Provide counselling

• Maintain confidential client records

• Manage payments and administration

• Meet my professional, ethical and legal responsibilities

• Respond to complaints or concerns where necessary

• Protect you or others where safeguarding or legal obligations apply

 
My lawful bases for processing your information Under UK GDPR I rely on the following lawful bases:
Contract
To provide counselling services and fulfil the counselling agreement between us.
Legal obligation
Where I am required to comply with legal or regulatory duties, including tax requirements and certain safeguarding or court obligations.
Legitimate interests
To respond to enquiries, investigate complaints, maintain appropriate records and protect my professional practice where necessary. I only use information that is relevant and proportionate and take appropriate steps to protect your privacy.
 
Confidentiality
Everything you share in counselling is treated as confidential.
There are rare occasions where I may need to share information without your consent, including where:

• there is a serious risk of harm to you or another person;

• safeguarding concerns require action;

• disclosure is required by law or court order;

• disclosure is necessary to prevent or detect serious crime.

Where appropriate and safe to do so, I will discuss this with you first.
 
Supervision
As part of safe and ethical practice, I undertake regular clinical supervision.
Client work may be discussed anonymously with my supervisor to support safe and effective practice. Identifying information is removed wherever possible.
 
How I store your information
I take appropriate technical and organisational measures to protect your personal information.
Information may be stored securely using password-protected electronic systems and, where applicable, locked paper files.
I only use reputable service providers who help me operate my practice securely.
 
How long I keep your information
I keep personal information only for as long as necessary and in accordance with professional and legal requirements.
My retention periods are:

• Client records (including assessment forms, counselling agreements, session notes and correspondence): retained for 7 years after counselling ends, then securely destroyed.

• Initial enquiries that do not proceed to counselling: retained for up to 12 months, then securely deleted.

• Financial records and invoices: retained for at least 6 years in line with HMRC requirements.

When records reach the end of their retention period they are securely deleted or confidentially destroyed.
 
Who I may share information with
I do not sell or share your personal information for marketing purposes.
Where necessary, I may share information with:

• organisations involved in safeguarding;

• professional or legal advisers;

• regulatory authorities where required;

• organisations where disclosure is required by law.

I also use trusted service providers (data processors) to operate my practice, including website hosting, business email, secure file storage, online counselling platforms and business banking.
 
Your rights
Under UK GDPR you have the right to:

• request access to your personal information;

• request correction of inaccurate information;

• request erasure in certain circumstances;

• request restriction of processing;

• object to processing where applicable;

• request data portability where applicable;

• withdraw consent where consent is the lawful basis.

If you wish to exercise any of these rights, please contact me using the details above.
 
Cookies
My website may use cookies and similar technologies to help it function properly and to understand how visitors use the site. Further information is available in my website Cookie Policy.
 
Complaints
If you have any concerns about how I use your personal information, please contact me in the first instance using the details above.
If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO).
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk