Privacy and Data Protection Policy

CHRISTIAN BAMBER

Counselling & Psychotherapy

ICO Registration Number: ZC258832

PRIVACY POLICY

Version 1.1 | September 2026

1. Introduction

Your privacy is very important to me and you can be confident that your personal information will be kept safe, secure and will only be used for the purpose it was given to me.

This Privacy Policy explains how I, Christian Bamber, trading as Christian Bamber Counselling & Psychotherapy ('I', 'me', 'my'), collect, use, store and protect your personal information. It applies to all clients, prospective clients and visitors to my website.

I adhere to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the ethical frameworks of the British Association for Counselling and Psychotherapy (BACP) and the National Counselling and Psychotherapy Society (NCPS). I am happy to discuss any aspect of this policy with you — please contact me using the details below.

2. Who I Am (Data Controller)

As the person who determines how and why your personal data is processed, I am the 'data controller' for the purposes of the UK GDPR.

Christian Bamber Christian Bamber Therapy 169 Pasley Street, Stoke, Plymouth, PL2 1DT Email: christianbamber@proton.me Phone: 07871 062995

I am registered with the Information Commissioner's Office (ICO) as a data controller. ICO Registration Number: ZC258832 

3. What Personal Data I Collect

3.1 Clients and prospective clients

I may collect and hold the following information about you:

• Full name, address, telephone number and email address

• Date of birth

• GP name and contact details

• Emergency contact details

• Referral information (if you were referred by a third party)

• Session notes and records of the work we do together

• Details of any previous counselling or mental health treatment (if disclosed)

• Financial information sufficient to administer payments (e.g. records of fees paid)

• Any other personal or sensitive information you choose to share during sessions

3.2 Special Category Data

Information about your physical or mental health is classified as 'special category data' under UK GDPR and is given additional protection. As a counsellor, I routinely process this type of data as part of our therapeutic relationship. I take particular care to handle it with the highest levels of confidentiality and security.

4. Lawful Basis for Processing

The UK GDPR requires me to have a lawful basis for processing your personal data. The basis I rely on depends on the stage of our relationship:

Enquiry stage: When you first contact me to ask about counselling, I process your data on the basis of legitimate interests — to respond to your enquiry and assess whether I can help you.

Active counselling: While you are working with me, I process your personal data on the basis that it is necessary for the performance of our contract (the Counselling Agreement).

After counselling has ended: Once our work together concludes, I retain your records on the basis of legitimate interests (to maintain accurate professional records and to comply with the expectations of my professional bodies, the BACP and NCPS).

Special category data (health information): I process this under Article 9(2)(h) of the UK GDPR — it is necessary for the provision of health or social care treatment, and is carried out under a duty of confidentiality.

5. How I Use Your Information

5.1 At the point of initial contact

When you first get in touch, I will collect basic contact and background information to assess how I may be able to help you. If you decide not to proceed, your personal data will be securely deleted within four weeks of our last contact, unless you request earlier deletion.

5.2 During counselling

While you are a client, I use your personal data to:

• Maintain brief written notes of each session to support the continuity and quality of the therapeutic work

• Contact you to arrange, confirm or reschedule appointments

• Process payment for sessions

• Communicate with your GP or other professionals, but only with your prior written consent

• Discuss your case in clinical supervision (see Section 8 below)

All information you share with me in sessions is treated as strictly confidential. Confidentiality will only be broken in exceptional circumstances, as described in your Counselling Agreement.

5.3 After counselling has ended

Once our work together is complete, I will retain your records for a minimum of seven years from the date of our last session. For clients who were under 18 at the time of counselling, records will be retained until what would have been their 25th birthday, or for seven years after the last session, whichever is the longer.

After this period, all records will be securely destroyed. If you would like me to delete your information sooner, please contact me to discuss this.

6. Data Storage and Security

I take the security of your personal data very seriously. I use the following measures to keep your information safe:

• Session notes are stored securely, either in a locked filing cabinet (for paper records) or in an encrypted, password-protected digital format accessible only to me

• Emails containing personal or sensitive information are handled via a secure, end-to-end encrypted email service

• Devices used to access or store your personal data are password-protected and kept up to date with security software

• Any physical documents are kept in a secure, locked location

• I do not store personal data on public cloud services that do not meet UK GDPR standards

In the unlikely event of a data breach that is likely to result in a risk to your rights and freedoms, I will notify the ICO within 72 hours and inform you as soon as practicable.

7. Who I Share Your Information With

I will not sell, rent or share your personal data with any third party for marketing purposes. Your information is treated as strictly confidential. However, there are limited circumstances in which I may need to share information:

7.1 Supervision

As required by the BACP and NCPS ethical frameworks, I receive regular clinical supervision. I may discuss aspects of our work together with my supervisor for the purpose of maintaining safe and ethical practice. My supervisor is bound by the same duty of confidentiality as I am. I will use only the minimum information necessary and will not share your full name without your consent.

7.2 Safeguarding and legal obligations

There are certain situations in which I am legally or ethically required to share information without your consent:

• If I believe you or another person is at serious risk of harm

• If I am ordered to disclose information by a court of law

• If disclosure is required under the Terrorism Act 2000, Proceeds of Crime Act 2002, or other applicable legislation

• If there is a child protection concern under the Children Act 1989

In all such cases, I will try to discuss this with you first unless doing so would put you or others at greater risk.

7.3 Referrals and GP contact

I will only contact your GP or other health or social care professionals with your prior written consent, except in an emergency or where required by law.

7.4 Third-party service providers

I may use third-party services to support my practice (for example, calendar or scheduling tools, payment processors or secure email providers). Where this involves your personal data, I ensure that any such providers are UK GDPR-compliant and that an appropriate data processing agreement is in place.

8. Clinical Supervision

As a member of the BACP and NCPS, I am required to undertake regular clinical supervision. This is an essential part of safe, ethical practice. During supervision, I may refer to client work in general terms. Your supervisor is also bound by professional confidentiality obligations. I take care to preserve your anonymity wherever possible.

9. Your Rights Under UK GDPR

Under the UK GDPR and DPA 2018, you have the following rights in relation to your personal data:

• Right to be informed: to know how your data is being used (this policy fulfils that obligation)

• Right of access: to request a copy of the personal data I hold about you (a Subject Access Request)

• Right to rectification: to ask me to correct any inaccurate or incomplete information

• Right to erasure: to ask me to delete your personal data in certain circumstances

• Right to restriction: to ask me to limit the way I use your data

• Right to data portability: to receive your personal data in a structured, commonly used format

• Right to object: to object to my processing of your data in certain circumstances

To exercise any of these rights, please contact me in writing at christianbamber@proton.me or 169 Pasley Street, Stoke, Plymouth, PL2 1DT. I will respond within one calendar month.

Please note that some of these rights are not absolute — for example, I may need to retain certain records for professional or legal reasons even if you request erasure. I will always explain my reasons if I am unable to comply with a request.

10. Complaints

If you have any concerns about the way I handle your personal data, please contact me in the first instance so I can try to resolve the matter:

Email: christianbamber@proton.me Phone: 07871 062995

If you are not satisfied with my response, or if you believe I am processing your personal data in a way that does not comply with UK data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

ICO website: ico.org.uk/make-a-complaint ICO helpline: 0303 123 1113

11. Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in the law or my practice. The current version will always be available on request. I will notify existing clients of any significant changes.

12. Contact Details

If you have any questions about this Privacy Policy or how I handle your data, please get in touch:

Christian Bamber Christian Bamber Therapy 169 Pasley Street, Stoke, Plymouth, PL2 1DT Email: christianbamber@proton.me Phone: 07871 062995

Christian Bamber Counselling & Psychotherapy | BACP Member | NCPS Member