Your personal data controller is Helen Penny Hypnotherapy; ICO registration number ZB161951.
1. The controller processes personal data for the purpose of contract performance (service performance).
2. The legal basis for the processing of personal data is the performance of the contract.
3. Personal data shall be processed for the duration of the contract, and after its termination for the period resulting from the binding legal regulations or until the expiry of the limitation period for claims. (Under current regulations this means that your data will be held until at least 7 years from your last appointment with me.)
4. The recipient of personal data shall be Helen Penny pursuant to relevant General Data Protection Regulations. (Your records will be redacted to ensure that no personal identifying details are included on your session notes.)
5. Any person whose data is processed shall, to the extent permitted by law, have the right of access to and rectification or erasure of personal data, as well as the right to restrict and object to the processing of their data. (If you would like to request a copy of all data relating to you which is held by me, I will provide this within 30 days of your request.)
6. You are entitled to lodge a complaint with the supervisory authority (Data Protection Authority).
Please feel free to contact me at firstname.lastname@example.org with any queries regarding this policy.