Data Protection & Privacy Policy

Data Controller

Vicky Dilnot Counselling is the data controller responsible for your personal information. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

What Data We Collect

We collect and process personal data including your name, contact details, date of birth, and special category data (health/mental health information) for the purpose of providing counselling services. This data is processed on the lawful basis of contract and, where applicable, explicit consent for special category health data under Article 9 UK GDPR.

How We Use Your Data

Your data is used solely to deliver and administer your counselling sessions, maintain clinical records, comply with our professional obligations (e.g. safeguarding duties), and — where required — liaise with supervising bodies. We will never sell your data or use it for marketing purposes.

All sessions are carried out applying the strictest confidentiality unless there is a statutory requirement to inform the correct authorities of any information. Confidentiality will be maintained in accordance with the British Association of Counselling and Psychotherapy (BACP) Ethical Framework for Good Practice in Counselling & Psychotherapy (Code of Ethics) – see www.bacp.co.uk for further information.

Data Retention

Counselling records are retained for 5 years following the end of the therapeutic relationship (or 5 years after a minor’s 18th birthday), in line with professional guidance from the BACP. Records are then securely destroyed

Your Rights

You have the right to access, rectify, or erase your personal data; to restrict or object to processing; and to data portability, subject to applicable exemptions. To exercise any of these rights, please contact us using the details below.

Data Protection Complaints

Under the Data (Use and Access) Act 2025 (Section 164A, Data Protection Act 2018, in force 19 June 2026), you have a statutory right to raise a data protection complaint directly with us before escalating to the Information Commissioner’s Office (ICO).

If you have a concern about how we have handled your personal data, please submit your complaint in writing to: vdilnot.counselling@gmail.com

• We will acknowledge your complaint within 30 days of receipt.

• We will investigate and provide a full response without undue delay.

• You will be kept informed throughout the process.

If you remain dissatisfied with our response, you may then escalate your complaint to the ICO at ico.org.uk or by calling 0303 123 1113.

Contact

Data Controller: Victoria Dilnot at Vicky Dilnot Counselling

Email: vdilnot.counselling@gmail.com