Privacy Policy

Last updated: 2 August 2026

Kendall Counselling respects your privacy and is committed to protecting your personal information. This privacy policy explains how we collect, use, store and protect your personal information when you visit https://kendallcounselling.com, contact us or use our counselling or supervision services.

This policy is intended to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

Kendall Counselling is the data controller responsible for the personal information described in this policy.

Data controller: Sharon Kendall, trading as Kendall Counselling
Address: 28 Broom Street, Great Cornard, Sudbury, Suffolk, CO10 0JT
Website: https://kendallcounselling.com
Privacy enquiries: Please use the contact form at https://kendallcounselling.com/?page_id=49 or write to the address above.

2. The personal information we collect

Depending on how you interact with us, we may collect:

your name, email address, telephone number and postal address;
information you include in an enquiry, including your preferred contact method and time;
whether you are interested in online or in-person sessions and the type of session requested;
appointment, attendance, payment and administrative information;
counselling, assessment and session records;
information about your physical or mental health, relationships, sex life, sexual orientation, racial or ethnic origin, religious or philosophical beliefs, or other sensitive matters that you choose to disclose;
safeguarding, risk and emergency-contact information where relevant;
correspondence, complaints and records of requests concerning your personal information;
technical information such as your IP address, browser type, device information, referring pages, pages visited and cookie choices; and
information required for accounting, insurance, professional supervision, legal or regulatory purposes.

Information about health and some of the other matters listed above is classed as special category personal data and receives additional protection under data protection law.

Please avoid including unnecessary sensitive or highly detailed information in the website contact form. An outline of your enquiry and your contact preferences will usually be sufficient for an initial response.

3. How we collect your information

We collect personal information:

directly from you through the website contact form, by telephone, email, post, video call or in person;
during assessment, counselling, couples work, group work or supervision;
when you make a payment, book or change an appointment, or otherwise correspond with us;
automatically when you use the website, through server logs, cookies and similar technologies; and
from another person or organisation where necessary and lawful, for example a parent or guardian, referrer, healthcare professional, emergency contact, insurer, court or public authority.

Where somebody provides us with information about another person, we will handle it in accordance with this policy and provide appropriate privacy information where required.

4. How and why we use your information

We may use your personal information to:

respond to enquiries and discuss whether our services are suitable;
arrange and provide counselling, supervision and related services;
manage appointments, fees, invoices and payments;
maintain appropriate clinical and administrative records;
communicate with you about your sessions or our service;
protect your or another person’s vital interests and manage safeguarding concerns;
obtain confidential professional supervision and maintain professional standards;
establish, exercise or defend legal claims and respond to lawful requests;
comply with legal, tax, accounting, insurance and regulatory obligations;
handle complaints and data-protection requests;
maintain the security, operation and performance of the website; and
understand general website use where you have consented to non-essential cookies or similar technologies.

We do not sell your personal information.

5. Our lawful bases

Under the UK GDPR, we rely on one or more of the following lawful bases:

Contract: processing is necessary to take steps at your request before entering into a contract or to provide the service agreed with you.
Legal obligation: processing is necessary to comply with a legal duty, including tax, accounting, safeguarding or data-protection obligations.
Legitimate interests: processing is necessary for the legitimate operation, administration, security and protection of the practice, provided those interests are not overridden by your rights and interests.
Consent: where we ask for and receive your consent, for example for optional non-essential cookies or a particular use of your information. You may withdraw consent at any time, although this will not affect processing already carried out lawfully.
Vital interests: in exceptional circumstances, processing may be necessary to protect somebody’s life.

Where we process special category data, we also rely on an appropriate condition under Article 9 of the UK GDPR. Depending on the circumstances, this may include:

your explicit consent;
processing necessary for the provision or management of health or social care, where the applicable legal and confidentiality requirements are met;
processing necessary to establish, exercise or defend legal claims;
processing necessary for reasons of substantial public interest, where authorised by law, including relevant safeguarding purposes; or
processing necessary to protect vital interests where the person is physically or legally incapable of giving consent.

We will identify and document the applicable lawful basis and special-category condition for the processing we carry out.

6. Confidentiality and when information may be shared

Counselling is confidential and Kendall Counselling works in accordance with the British Association for Counselling and Psychotherapy (BACP) Ethical Framework. However, confidentiality is not absolute. Information may be shared where:

you have asked or consented to the disclosure;
confidential professional supervision is required; information will be minimised or anonymised where reasonably possible;
there is a serious concern about your safety or another person’s safety;
there is a safeguarding concern involving a child or an adult at risk;
disclosure is required or permitted by law, a court order or a relevant public authority;
it is necessary to establish, exercise or defend a legal claim; or
a trusted service provider processes information on our behalf under appropriate contractual and confidentiality obligations.

Recipients may include professional supervisors, emergency services, safeguarding bodies, healthcare professionals, legal or insurance advisers, accountants, payment providers, IT and website providers, email or communications providers, and courts, regulators or public authorities. We share only what is reasonably necessary in the circumstances.

We will not ordinarily disclose the identity of one member of a couple or group to another person outside the service without an appropriate basis. The limits of confidentiality for couples, group work and supervision will be explained as part of the service agreement.

7. Website forms and third-party services

The website uses WPForms to collect enquiries. Information submitted through the form is transmitted to and stored within the website and/or sent to the practice by email, according to the website configuration. Do not use the form for an emergency or for information that is more detailed than necessary for an initial enquiry.

The site may also use the following third-party services:

Google reCAPTCHA to help detect spam and abuse on forms;
Google Maps to display the practice location and provide directions;
Google Fonts to display website typefaces;
website hosting, security, backup and email services needed to operate the site; and
links to Facebook and Instagram. If you follow these links, those services will process information under their own privacy policies.

Third-party content may receive technical information such as your IP address and browser details. Some content may place or access cookies or similar technologies, subject to the site’s consent settings and the provider’s practices.

8. Cookies and similar technologies

Cookies are small files or similar technologies placed on or accessed from your device. The website may use:

strictly necessary cookies, required for security, forms, basic website functions and remembering privacy choices; and
optional cookies or technologies, which may be used for embedded third-party content, functionality or measurement.

Where consent is legally required, optional cookies or similar technologies should not be used until you make a positive choice. You can refuse or withdraw consent using the website’s cookie controls, where available, and can also control cookies through your browser settings. Blocking some technologies may affect website features, including maps or forms.

The exact cookies used can change when the website or its plugins are updated. The site’s cookie notice or consent tool should provide current details of any cookies in use, their providers, purposes and durations.

9. International transfers

Some technology providers may process personal information outside the United Kingdom. Where this happens, we will use an appropriate safeguard required by data protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism. You may ask us for further information about the relevant safeguards.

10. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, insurance, safeguarding and professional requirements.

As a general guide:

enquiries that do not lead to a service are normally retained for up to 12 months after the last contact;
counselling, supervision and associated administrative records are normally retained for up to 7 years after the service ends, unless a longer or shorter period is justified;
records relating to a child or young person may need to be kept for a longer period, taking account of their age, professional guidance and limitation periods;
financial and tax records are normally retained for 6 years after the end of the relevant financial year;
complaints, safeguarding records and legal matters may be retained for as long as necessary to manage risk, meet legal duties or deal with a claim; and
website security logs, backups and cookie records are retained according to the operational settings of the relevant system and are periodically deleted or overwritten.

When information is no longer required, it will be securely deleted, destroyed or anonymised.

11. How we protect your information

We use reasonable technical and organisational measures to protect personal information against accidental loss, misuse, unauthorised access, alteration or disclosure. These measures may include access controls, passwords, device security, encryption where appropriate, secure disposal, confidentiality arrangements, backups, software updates and limiting information to those who need it.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will assess it and notify the Information Commissioner’s Office and affected individuals where the law requires us to do so.

12. Your data-protection rights

Depending on the circumstances, you may have the right to:

be informed about how your personal information is used;
request access to your personal information;
ask us to correct inaccurate or incomplete information;
ask us to erase your information;
ask us to restrict how your information is used;
object to processing based on legitimate interests;
receive certain information in a portable format;
withdraw consent at any time where processing relies on consent; and
complain about how we use your information.

These rights are not absolute and exemptions may apply, including where information relates to another person, is subject to confidentiality considerations, or must be retained for legal reasons.

To exercise a right, please contact us using the details in section 1. We may need to confirm your identity before acting on a request. There is normally no fee, although a reasonable fee may be charged or a request refused where the law permits, for example if it is manifestly unfounded or excessive.

13. Complaints

If you are concerned about how we have handled your personal information, please contact us first so that we can investigate and respond.

You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

14. Children and young people

Where services are provided to a child or young person, we will explain privacy and confidentiality in an age-appropriate way. We will consider the young person’s understanding and rights, parental responsibility, the service agreement, safeguarding duties and applicable law when deciding how information may be used or shared.

The website is not intended to invite children to submit detailed sensitive information without appropriate support. If a child is in immediate danger or needs urgent help, they should call 999 or seek help from a trusted adult or appropriate emergency service.

15. Automated decision-making and marketing

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects. We do not send electronic direct marketing unless we have a lawful basis to do so, and any marketing message will provide a straightforward way to opt out.

16. Links to other websites

The website may contain links to other websites. Kendall Counselling is not responsible for the privacy practices of those sites. You should read the privacy information provided by any external site you visit.

17. Changes to this policy

We may update this policy when our services, technology or legal obligations change. The latest version will be published on this website and the date at the top will be updated. Material changes may also be brought to the attention of current clients where appropriate.