Privacy Notice
Last updated: 12 June 2026
This privacy notice explains how Elm Counselling collects, uses, stores and protects personal information when you use this website, make an enquiry, or work with Elm Counselling.
Elm Counselling is the data controller for the personal information it collects and uses. This means Elm Counselling decides why and how personal information is processed.
Information we collect
Depending on how you contact or work with Elm Counselling, we may collect:
- your name and contact details;
- information you choose to include in an enquiry or message;
- appointment, attendance and administrative information;
- information relevant to counselling work, including brief notes and records;
- billing, payment and accounting information where relevant;
- information needed to deal with data protection requests or complaints;
- basic technical information about website visits, such as security logs, cookie information and analytics information.
How we use your information and our lawful bases
We only use personal information where we have a lawful basis to do so. The main purposes and lawful bases are:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and arranging initial contact | Taking steps before entering into a contract and/or legitimate interests in responding to your enquiry. |
| Providing counselling services and keeping appropriate records | Contract, legitimate interests in providing and managing counselling services, and professional obligations. |
| Managing appointments, administration, payments and accounts | Contract, legitimate interests, and legal obligations relating to tax and accounting. |
| Meeting safeguarding, legal, insurance or professional obligations | Legal obligations, legitimate interests, vital interests, safeguarding interests, and the establishment, exercise or defence of legal claims where applicable. |
| Keeping the website secure and working properly | Legitimate interests in website security, reliability and abuse prevention. |
| Analytics, advertising measurement and understanding website performance | Consent where required for non-essential cookies or tracking, and legitimate interests where the processing is limited to necessary or low-risk website measurement. |
We do not sell your personal information and we do not use it for unrelated marketing.
Special category data and confidentiality
Counselling enquiries and counselling work may involve sensitive information, including information about health, wellbeing, relationships, family life, sexuality, personal circumstances, risk, trauma or other private matters. This may be special category data under UK data protection law.
Where special category data is processed, we need both a lawful basis and a separate special category condition. Depending on the circumstances, the relevant condition may include the provision of confidential counselling care, explicit consent, safeguarding, vital interests, or the establishment, exercise or defence of legal claims.
Counselling is confidential, but confidentiality is not absolute. Information may need to be shared where there is a serious risk of harm, a safeguarding concern, a legal requirement, a court order, or a need to obtain professional supervision, legal advice, insurance support or emergency assistance. We will only share what is necessary in the circumstances.
Professional supervision is part of good counselling practice. Where client work is discussed in supervision, information is shared only as needed and, where possible, without directly identifying the client.
Website enquiries and contact forms
Information submitted through the website contact form is used to respond to your enquiry. Please avoid including unnecessary confidential or highly sensitive details in the first message. Personal details can be discussed directly where appropriate.
Website forms may use security checks, such as Cloudflare Turnstile, to help protect the site from spam and abuse.
Who we share information with
We only share personal information where there is a proper reason to do so. This may include sharing limited information with:
- website, hosting, email, form, security and IT service providers;
- Cloudflare services, including security and bot-protection tools such as Cloudflare Turnstile;
- analytics or advertising measurement providers, such as Google, where those tools are used lawfully;
- payment, accounting, administrative or record-keeping providers where relevant;
- professional supervisors, insurers, legal advisers or professional bodies where needed;
- safeguarding authorities, emergency services, courts, regulators or law enforcement where required or justified.
Service providers are expected to protect personal information and only process it for the relevant service they provide.
International transfers
Some service providers may process personal information outside the UK. Where this happens, we use appropriate safeguards so that personal information remains protected, such as adequacy arrangements, contractual safeguards, or other lawful transfer mechanisms.
How long we keep information
We do not keep personal information for longer than necessary. The usual retention approach is:
- enquiry information that does not lead to counselling work is kept only as long as needed to respond and manage reasonable follow-up;
- adult client records are usually kept for seven years after counselling ends, unless a longer period is needed for legal, insurance, safeguarding or professional reasons;
- where work involves children or young people, records may need to be kept for longer, usually at least until the client reaches adulthood and for a further period afterwards;
- financial and accounting records are usually kept for six years after the relevant tax year;
- data protection complaints and rights requests are kept for as long as needed to evidence how the matter was handled;
- website security logs and analytics information are kept only for as long as needed for security, troubleshooting, reporting and website improvement.
Information is securely deleted, anonymised or destroyed when it is no longer required.
Security
We take appropriate steps to protect personal information from loss, misuse, unauthorised access or disclosure. This includes using secure systems, limiting access to information, and keeping records only where there is a proper reason to do so.
This website is hosted using Cloudflare services and may use security features to protect the site, reduce spam and keep forms working safely.
Cookies and website analytics
The website may use cookies or similar technologies that are necessary for security, form protection and basic site functionality.
The site may also use analytics or advertising measurement tools, including Google Ads conversion tracking, to understand how visitors find the website and whether enquiries are submitted. Non-essential analytics, advertising or tracking technologies should only be used where consent has been given, unless a legal exception applies.
You can control cookies through your browser settings. If a cookie banner or consent tool is shown on the website, you can also use it to manage your choices.
Your rights
Under UK data protection law, you may have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete information, where this applies;
- ask us to restrict how information is used, where this applies;
- object to certain uses of your information;
- ask for information to be transferred to another provider, where data portability applies;
- withdraw consent where we are relying on consent;
- complain to the Information Commissioner’s Office.
These rights do not apply in every situation. For example, we may need to keep some information to meet legal, professional, safeguarding or insurance obligations. We may also need to confirm your identity before responding to a request.
In most cases, you will not have to pay a fee to access your personal information. A reasonable fee may only be charged in limited circumstances, such as where a request is manifestly unfounded or excessive, or where further copies are requested.
Data protection complaints
If you have a concern about how Elm Counselling has handled your personal information, please contact us first so that we can investigate and try to resolve the issue.
You can raise a data protection complaint using the contact form on this website. Please include enough information for us to understand what has happened and how you would like us to contact you.
We will acknowledge data protection complaints within 30 days and investigate them without undue delay. We will keep you informed where appropriate and let you know the outcome once our review is complete.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. In most cases, the ICO will expect you to raise the matter with us first.
You can contact the ICO through its website: ico.org.uk/make-a-complaint.
Automated decision-making and AI
We do not use automated decision-making or profiling that produces legal or similarly significant effects for clients or website visitors.
We do not use AI tools to analyse counselling content, create client records or make decisions about clients unless this has been discussed separately and appropriate safeguards are in place.
Links to other websites
This website may contain links to other websites. Elm Counselling is not responsible for the content or privacy practices of other websites. You should read the privacy notice for any website you visit.
Contact
If you have any questions about this privacy notice, or if you want to exercise your data protection rights, please contact Elm Counselling using the contact form on this website.