Privacy Policy
Windmill Counselling | Emma Utley Owner contact - windmillcounselling@hotmail.com ICO registration: ZA628871 Last updated: 11th August 2026
Your privacy matters to me. This policy explains what personal information I collect when you visit windmill-counselling.co.uk or engage my counselling services, how I use it, and what rights you have.
I am the data controller for the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
What personal data I collect
I may collect the following:
Contact details: name, address, email address, and phone number
Health and wellbeing information shared during sessions or intake
GP details
Session notes (coded with your initials and date of first session)
Communications: emails, text messages, and voicemails
Health and wellbeing information is special category data under UK GDPR. I treat it with additional care and collect it only where necessary to provide my counselling service.
Why I collect it and the legal basis
I process your personal data under the following lawful bases:
Performance of a contract (Article 6(1)(b)): to register you as a client and deliver the counselling service we have agreed.
Legal obligation (Article 6(1)(c)): where the law requires me to retain or share information.
Legitimate interests (Article 6(1)(f)): to manage my practice, respond to enquiries, and keep appropriate records.
For special category (health) data, I rely on Article 9(2)(h) of the UK GDPR: processing necessary for the provision of health or social care treatment by a professional subject to a duty of confidentiality.
How I use your data
I use your personal data only to provide my counselling service and to communicate with you about it. I will not share your details with any other person or organisation without your knowledge and consent, except where required by law.
If there is a safeguarding concern, or a perceived risk of harm to you or another person, I may share relevant information with appropriate third parties. I will always aim to discuss this with you first unless doing so would put someone at risk.
Third parties who process your data
Microsoft processes emails sent to or from my Hotmail account and is subject to its own privacy policies. I recommend that you do not share sensitive personal information by email.
I may also use Kiku to store client records securely. A data processing agreement is in place with this provider. They are also GDPR compliant.
How long I keep your data
Type of data
Retention period
Session notes
7 years from your last session, then securely shredded or deleted
Contact details
7 years from your last session, stored separately from your notes
Emails, texts, and voicemails
Up to 7 days after your sessions end, then deleted
I may retain data beyond these periods in the event of a complaint or dispute.
How I keep your data secure
All electronic devices that hold personal data are password protected and stored securely. I take reasonable steps to prevent loss, theft, unauthorised access, disclosure, copying, or modification of your information.
Your rights
Under UK data protection law, you have the right to:
Access: request a copy of the personal data I hold about you.
Rectification: ask me to correct inaccurate or incomplete data.
Erasure: ask me to delete your data in certain circumstances, unless I have a legal obligation to retain it.
Portability: request that I transfer data I hold about you to another organisation.
Restriction: ask me to limit how I use your personal data.
Object: challenge certain types of processing, including direct marketing.
Automated decision-making: request a review if you believe automated processing has been applied incorrectly.
Be informed: receive clear information about how I collect, use, and store your data. This policy fulfils that right.
To exercise any of these rights, please contact me at windmillcounselling@hotmail.com. I may need to verify your identity before I can respond.
How to raise a complaint
If you have a concern about how I handle your personal data, please contact me directly at windmillcounselling@hotmail.com.
Here is what will happen:
I will acknowledge your complaint within 30 days of receiving it.
I will investigate the matter and keep you informed throughout.
I will let you know the outcome without unnecessary delay.
If you are unhappy with my response, or if you would prefer to go straight to the regulator, you have the right to make a complaint to the Information Commissioner's Office (ICO):
Website: www.ico.org.uk
Telephone: 0303 123 1113
Cookies
Please see my separate cookie policy for information on how this website uses cookies.
Changes to this policy
I reserve the right to update this policy at any time. The date at the top of this page will always reflect when it was last reviewed. Your continued use of this website after any changes constitutes acceptance of the updated policy.
Acceptance
By engaging my counselling services, you confirm that you have read and understood this policy and that you consent to your personal information being collected, stored, and used as described here.