Privacy policy

Third Level Foundation CIC

Effective date: 02/09/2026
Policy owner: Sheena Crossan
Data Protection Contact: Sheena Crossan / info@thirdlevelfoundation.org / 07794 415410
ICO registration number: C2022172

1. Introduction

Third Level Foundation CIC respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect personal information when you contact us, enquire about counselling, attend counselling sessions, communicate with us, or otherwise use our services.

We hold information in both electronic and paper-based records. We take appropriate steps to protect both forms of record and to ensure that personal information is handled in accordance with applicable data protection law.

This policy is intended to explain our approach under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), together with any subsequent legislation or regulatory requirements that apply to our processing of personal data.

The policy should be read alongside our confidentiality arrangements, terms of counselling, and any information provided to you at the start of counselling.

2. Who is responsible for your information?

The data controller responsible for your personal information is:

Third Level Foundation CIC
07794 415410
info@thirdlevelfoundation.org
https://thirdlevelfoundation.org

For data protection enquiries, please contact:
Sheena Crossan / info@thirdlevelfoundation.org / 07794 415410

A data controller is the person or organisation that determines why and how personal information is processed.

Where another organisation processes information on our behalf, such as an electronic record system, email provider, cloud storage provider, or online appointment system, we remain responsible for ensuring that appropriate safeguards are in place.

3. What personal information do we collect?

Depending on the circumstances, we may collect and process:

Identification and contact information

• Your name
• Date of birth, where relevant
• Address
• Telephone number
• Email address
• Emergency contact details, where appropriate
• Preferred method of communication

Information relating to counselling

We may keep information relating to your counselling, including:

• Initial enquiry information
• Assessment information
• Information you provide during counselling
• Counselling notes and records
• Information about your presenting concerns
• Information concerning your physical or mental health
• Risk assessments
• Information concerning safeguarding
• Information about previous or current treatment where relevant
• Information about medication where relevant
• Information about other professionals involved in your care
• Details of appointments and attendance
• Correspondence relating to your counselling
• Information concerning the ending of counselling

Because counselling may involve information concerning your physical or mental health, some of the information we process may constitute special category personal data under the UK GDPR. Health data receives additional protection under data protection law.

Other information

Where relevant, we may also process:

• Payment and invoicing information
• Information required for accounting purposes
• Information concerning complaints
• Information required for insurance purposes
• Information concerning legal or regulatory matters
• Information provided by another professional or organisation
• Information concerning criminal offences where this is relevant and lawful to process

We aim to collect only information that is adequate, relevant, and necessary for the purposes for which it is being processed.

4. How do we collect information?

We may collect information:

• Directly from you during an enquiry or assessment
• During counselling sessions
• Through forms that you complete
• By telephone
• By email
• Through our website
• Through an online booking system
• Through online counselling platforms
• From your GP or another healthcare professional, where appropriate and lawful
• From another organisation that has referred you
• From a parent, guardian or other person where appropriate
• From another professional involved in your care
• From publicly available sources where this is necessary and lawful

Where information is obtained from someone other than you, we will normally provide you with appropriate privacy information, unless an exemption applies.

5. Why do we use your information?

We process personal information for purposes including:

• Responding to enquiries
• Assessing whether counselling is appropriate
• Arranging and providing counselling
• Maintaining appropriate counselling records
• Managing appointments
• Communicating with you
• Managing payments and accounts
• Maintaining professional and clinical records
• Supporting continuity and safety of care
• Managing risks and safeguarding concerns
• Obtaining professional supervision
• Complying with professional requirements
• Managing complaints
• Meeting legal and regulatory obligations
• Establishing, exercising or defending legal claims
• Protecting the rights, safety and wellbeing of clients or other individuals
• Maintaining the security of our premises, systems and information
• Improving our service
• Meeting insurance requirements
• Responding to lawful requests from courts, regulators or public authorities

We will not routinely use your counselling information for unrelated purposes.

If we intend to use information for a new purpose that is materially different from the purpose for which it was collected, we will consider whether that use is lawful and whether we need to provide additional information to you.

6. Our lawful bases for processing

Under the UK GDPR, we must have a lawful basis for processing personal data. Depending on the particular processing activity, we may rely on one or more of the following:

Performance of a contract

Where necessary, we may process personal information to provide counselling services that you have requested or to take steps at your request before entering into an agreement.

Legitimate interests

We may process information where this is necessary for our legitimate interests, provided that those interests are not overridden by your interests, rights, or freedoms.

Examples may include:

• Managing appointments
• Maintaining appropriate business records
• Managing our professional practice
• Maintaining information security
• Responding to complaints
• Establishing or defending legal claims
• Managing professional insurance

Where we rely on legitimate interests, we will consider the necessity and proportionality of the processing and the impact on your rights.

Legal obligation

We may process information where necessary to comply with a legal obligation. Examples may include certain accounting, tax, regulatory, court, or legal requirements.

Consent

In circumstances where consent is the appropriate lawful basis, we will ask for your consent.

Where consent is relied upon, you may withdraw it at any time. Withdrawal of consent does not affect processing that took place lawfully before consent was withdrawn.

Importantly, we will not assume that all counselling processing is based on consent merely because you have chosen to attend counselling. We will identify the appropriate lawful basis for each relevant processing activity.

7. Special category information

Counselling records may contain special category information, particularly information concerning your physical or mental health.

The UK GDPR requires a separate Article 9 condition in addition to an Article 6 lawful basis when special category information is processed.

Depending on the circumstances and our professional arrangements, we may rely on an applicable Article 9 condition including:

• Processing necessary for the provision or management of health or social care, where the relevant legal requirements and professional obligations apply; and/or
• The substantial public interest condition relating to counselling under Schedule 1 of the Data Protection Act 2018; and/or
• Another Article 9 condition where it is appropriate and lawful for the particular processing activity.

Where we rely on a Schedule 1 condition that requires an Appropriate Policy Document, we maintain such a document setting out our procedures for complying with the data protection principles and our retention and deletion arrangements. The ICO confirms that the counselling condition is one of the Schedule 1 substantial-public-interest conditions, and that relevant conditions can require an Appropriate Policy Document.

We will document the lawful basis and relevant special category conditions for our processing.

8. Confidentiality

Counselling depends upon an appropriate degree of confidentiality.

We will normally treat the information you provide in counselling as confidential and will not disclose it to third parties without your knowledge and, where appropriate, your consent.

However, confidentiality is not absolute.

There may be circumstances where information needs to be disclosed without your consent, for example where:

• There is a serious and imminent risk of harm to you or another person
• There is a safeguarding concern involving a child or adult at risk
• Disclosure is required by law
• A court or other lawful authority requires disclosure
• Disclosure is necessary to prevent or detect serious unlawful activity
• Disclosure is necessary to protect the vital interests of an individual
• There is another lawful basis requiring or permitting disclosure

We will consider carefully whether disclosure is necessary, proportionate, and lawful.

Where practicable and appropriate, we will discuss a proposed disclosure with you before making it. There may be circumstances in which it is not appropriate or lawful to tell you in advance.

9. Professional supervision

Counsellors may need to discuss their work with a professional supervisor.

Where supervision is used, information will be handled confidentially and with appropriate safeguards.

We will aim to avoid identifying you unnecessarily and disclose only information that is relevant to the supervision process.

Where identifiable information needs to be discussed, this will be limited to what is necessary and appropriate.

10. Sharing information with other professionals

We may, where appropriate and lawful, share information with:

• Your GP
• Other healthcare professionals
• Mental health professionals
• Social care professionals
• Schools, colleges or universities where relevant
• Referring organisations
• Safeguarding organisations
• Emergency services
• Courts or legal representatives
• Insurers
• Professional regulators
• Professional supervisors

We will normally seek your consent before sharing information with another professional where consent is appropriate.

However, consent may not be required where there is another lawful basis for sharing, including circumstances involving safeguarding, serious risk of harm, legal obligations or other lawful requirements.

11. Paper records

Some counselling information may be held in paper form.

Paper records may include:

• Initial assessment forms
• Consent or agreement forms
• Counselling notes
• Risk assessments
• Correspondence
• Referral information
• Other documents relating to counselling

Paper records will be stored securely. Where reasonably practicable:

• Paper files will be kept in locked storage
• Access will be restricted to people who are authorised to access them
• Files will not be left unattended in publicly accessible areas
• Files will not be left visible to visitors or other clients
• Paper records will not be taken away from the practice unnecessarily
• Where files need to be transported, appropriate security measures will be used
• Records will be securely destroyed when they are no longer required

Where paper records form part of a structured filing system, they can fall within the scope of UK GDPR requirements.

12. Electronic records

Electronic information will be protected using appropriate technical and organisational security measures.

Depending on the systems used, these may include:

• Strong passwords
• Multi-factor authentication
• Encryption
• Secure cloud services
• Access controls
• Device security
• Anti-malware protection
• Operating-system and software updates
• Secure backups
• Restricted administrator access
• Screen locking
• Secure deletion
• Regular review of access permissions

Access to counselling information will be limited to those who have a genuine need to access it.

Where a personal device is used for work purposes, appropriate security measures must be applied.

13. Email and electronic communication

Email is not always completely secure.

When communicating with you by email, we may use your email address to:

• Respond to enquiries
• Arrange appointments
• Send relevant documents
• Communicate about counselling
• Respond to requests concerning your personal information

We will take reasonable precautions to protect information sent electronically.

Where particularly sensitive information is being sent, we will consider whether a more secure method is appropriate.

Clients should also consider the security of their own email accounts and devices.

If you ask us to communicate by electronic method that carries particular privacy risks, we may explain those risks to you.

14. Telephone and messaging

We may use telephone calls, voicemail, SMS, or other messaging systems for appointment administration and communication.

We will seek to minimise the amount of sensitive information communicated through these channels.

Where a messaging service is used, we will consider its security and whether it is appropriate for the type of information being communicated.

15. Online counselling

Where counselling is provided online, we may use Zoom. The platform may process personal information as part of providing its service.

We will take reasonable steps to select providers that provide appropriate security and data protection safeguards.

Online counselling sessions should normally take place in a private environment where conversations cannot be overheard.

Clients should also take reasonable steps to secure their own devices, internet connections, and surroundings.

16. Website and online forms

If we operate a website, it may collect information such as:

• Information submitted through contact forms
• Technical information
• IP address
• Browser information
• Information concerning how the website is used
• Cookie information

Where cookies or similar technologies are used, further information will be provided through our cookie notice where required.

17. Payments and financial information

Where you pay for counselling, we may process information necessary to:

• Record payments
• Issue invoices
• Maintain accounting records
• Manage refunds
• Meet tax and accounting requirements
• Deal with payment disputes

Where payments are processed by a third-party payment provider, that provider may process your personal information in accordance with its own privacy information.

We will not retain full payment card details unless there is a lawful and necessary reason to do so.

18. Information about other people

You may provide us with information about another person, such as emergency contact, family member, or professional.

You should only provide information about another person where appropriate.

Where necessary, we may need to provide that person with privacy information explaining how their information is being used, unless an applicable exemption applies.

19. Children and young people

Where we provide counselling to children or young people, we will take additional care with personal information and will consider:

• The child's age and level of understanding
• Their rights and expectations of privacy
• Parental responsibility
• Consent and/or agreement
• Safeguarding responsibilities
• The particular circumstances of the counselling
• Any applicable professional guidance

Confidentiality arrangements for children and young people will be explained at the beginning of counselling in an age-appropriate manner.

20. Safeguarding

We take safeguarding seriously.

Where we believe that a child, young person or adult may be at risk of serious harm, we may need to share relevant information with an appropriate safeguarding organisation or emergency service.

We will only share information that is necessary and proportionate to the safeguarding concern.

Where practicable and safe, we will discuss this with you beforehand. However, this may not always be possible where doing so could increase risk or prejudice in a safeguarding process.

21. Criminal offence information

Counselling may occasionally involve information concerning alleged or actual criminal offences. Such information is subject to additional legal protections.

We will only process or disclose criminal offence information where we have an appropriate lawful basis and any additional condition required by applicable data protection law.

22. Data minimisation

We will aim to collect and retain only information that is necessary for the purposes for which it is being processed.

We will not routinely collect information simply because it may be interesting or potentially useful in the future.

Where information is no longer necessary, it will be securely deleted or destroyed, subject to our retention requirements.

23. Accuracy

We will take reasonable steps to ensure that personal information is accurate and, where appropriate, kept up to date.

If you believe information we hold about you is inaccurate or incomplete, you can ask us to correct it.

Counselling notes may contain professional observations or historical accounts that cannot simply be altered because you disagree with them. In such circumstances, we may add an appropriate correction, clarification, or statement of disagreement rather than deleting the original record.

24. How long do we keep your information?

We will not keep personal information for longer than is necessary for the purposes for which it is processed, unless there is a lawful reason to retain it for longer.

Our retention periods are based on factors including:

• The type of information
• The purpose for which it is held
• Professional requirements
• Legal requirements
• Insurance requirements
• The possibility of complaints or legal claims
• The age and circumstances of the client
• Whether the information is needed to establish or defend a legal claim

Our current retention schedule is:

The retention period should be reviewed and confirmed against the service's professional-body requirements, insurer requirements, and the circumstances of the particular practice.

The UK GDPR does not impose one universal retention period for counselling records. Organisations should be able to justify how long they retain information and should periodically review whether it is still needed.

At the end of the applicable retention period, records will be securely destroyed, deleted, or anonymised as appropriate.

25. Secure disposal

Paper records will be disposed of using a secure method, such as confidential shredding.

Electronic records will be securely deleted where appropriate, including systems and devices where practicable.

Where a third party is used for confidential destruction, we will take reasonable steps to ensure that the provider is appropriately trustworthy and secure.

26. Who may have access to your information?

Access to personal information will be limited to people who need it for legitimate purposes.

Depending on the circumstances, this may include:

• Your counsellor
• An appropriate professional supervisor
• Administrative staff
• Accountants
• IT or data-management providers
• Secure electronic-record providers
• Appointment-booking providers
• Payment providers
• Professional or legal advisers
• Insurers
• Regulators or public authorities where legally permitted or required

Where another organisation processes personal information on our behalf, we will take appropriate steps to ensure that suitable contractual and security arrangements are in place.

27. International transfers

We aim to use service providers that process personal information within the UK or jurisdictions where appropriate legal safeguards are available.

If personal information is transferred outside the UK, we will ensure that the transfer is made in accordance with applicable UK data protection law.

This may include relying on:

• UK adequacy regulations
• Appropriate safeguards
• Standard contractual arrangements
• Another lawful transfer mechanism

Where required, further information about international transfers and the safeguards used will be provided.

28. Data security

We recognise that counselling information is highly sensitive and requires appropriate protection.

We use appropriate technical and organisational measures to protect information against:

• Unauthorised access
• Unauthorised disclosure
• Accidental loss
• Destruction
• Damage
• Alteration
• Unauthorised use

Security measures are reviewed periodically and updated where appropriate.

No method of transmitting or storing information can be guaranteed to be completely secure. However, we will take reasonable and proportionate measures to reduce the risks.

29. Personal data breaches

A personal data breach may include:

• Loss or theft of a paper file
• Sending information to the wrong person
• Unauthorised access to electronic records
• Hacking
• Loss of an unencrypted device
• Accidental disclosure
• Destruction or corruption of records

If we become aware of a personal data breach, we will assess it promptly and take appropriate action.

Where required by law, we will notify the Information Commissioner's Office and/or affected individuals.

We will document breaches and the actions taken in accordance with our data protection procedures.

30. Your data protection rights

Subject to certain legal exceptions and limitations, you may have rights under data protection law including:

• The right to be informed about how your information is used
• The right to request access to your personal information
• The right to request correction of inaccurate information
• The right to request deletion in certain circumstances
• The right to request restriction of processing in certain circumstances
• The right to object to certain processing
• The right to data portability in certain circumstances
• Rights relating to automated decision-making and profiling where applicable

Not all rights apply in every circumstance.

For example, the right to deletion is not absolute and may not apply where we have a legitimate or legal reason to retain information. Similarly, the right to object depends upon the lawful basis and purpose of processing.

31. Subject access requests

You can ask for a copy of the personal information we hold about you. This is known as a Subject Access Request (SAR).

Requests should be sent to:
Sheena Crossan / info@thirdlevelfoundation.org

We may need to verify your identity before providing information.

We will normally respond within the applicable statutory timeframe.

There are circumstances where information may be withheld or redacted, including where disclosure would involve another person's information or where a specific legal exemption applies.

Counselling records can sometimes raise particular issues concerning third-party confidentiality and professional information. We will assess requests carefully and in accordance with applicable law.

32. Correcting your information

If you believe the information we hold is inaccurate, you can contact us and ask us to correct it.

Please explain what you believe is incorrect and, where possible, provide the correct information.

We will consider your request and take appropriate action.

33. Requesting restriction or deletion

You may ask us to restrict or delete your information where the relevant legal conditions apply.

We will assess each request individually.

We may need to continue retaining or processing some information where this is necessary for legal, regulatory, professional, safeguarding, accounting, or other legitimate purposes.

34. Complaints

If you have concerns about how we have handled your personal information, please contact us first:

Third Level Foundation CIC
Sheena Crossan / info@thirdlevelfoundation.org

We will investigate your concern and try to resolve it.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO). The ICO can be contacted through its website or helpline.

ICO website: https://ico.org.uk/

You are not required to complain to us before contacting the ICO.

35. Automated decision-making

We do not ordinarily use counselling information to make decisions about you solely by automated means.

If this changes, we will provide appropriate information and ensure that any processing complies with applicable data protection requirements.

36. Marketing

We do not normally use counselling information for direct marketing.

We will not use confidential counselling information to market unrelated services to you.

Where marketing communications are used, they will be sent in accordance with applicable data protection and electronic communications requirements.

You can opt out of marketing communications at any time.

37. Use of anonymised information

We may use appropriately anonymised information for purposes such as:

• Service evaluation
• Training
• Professional development
• Statistical analysis
• Research
• Improving our services

Where information is genuinely anonymised so that you cannot reasonably be identified, it is no longer personal data.

We will take care to ensure that information described as anonymised cannot reasonably be used to identify you.

38. Data protection impact assessments

Where we introduce a new form of processing that is likely to result in a high risk to individuals' rights and freedoms, we will consider whether a Data Protection Impact Assessment (DPIA) is required.

This is particularly relevant where sensitive or special category information is processed in new or substantially changed ways.

The ICO advises organisations to consider DPIAs where processing, including processing of special category data, is likely to be high risk.

39. Records of processing

We will maintain appropriate records of our data processing activities where required.

These records will help us demonstrate:

• What personal information we process
• Why we process it
• The lawful bases relied upon
• The relevant special category conditions
• Who information is shared with
• Retention arrangements
• Security measures
• How individuals' rights are supported

40. Appropriate Policy Document

Where required by the Data Protection Act 2018, we maintain an Appropriate Policy Document covering relevant special category processing.

The document records our procedures for complying with the data protection principles and our policies concerning the retention and deletion of special category information.

The ICO states that an Appropriate Policy Document should set out the relevant Schedule 1 condition, procedures for complying with the data protection principles, and retention and deletion policies.

41. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

We will review the policy at least annually and whenever there is a significant change to:

• Data protection law
• Our services
• Our information systems
• The types of information we process
• How information is shared
• Our retention arrangements
• Our security arrangements

The latest version will be available from: https://thirdlevelfoundation.org

Where a change materially affects how we use your information, we will provide appropriate information before the new processing begins where required.

42. Contact us

If you have questions about this Privacy Policy or how we handle your personal information, please contact:

Third Level Foundation CIC
Sheena Crossan / info@thirdlevelfoundation.org / 07794 415410

Privacy Policy version: 1.0
Effective from: 02/09/2026

Appendix 1 – Summary of our main data processing

The exact lawful basis and special category condition should be documented for each processing activity rather than assuming that one basis applies to everything.

Appendix 2 – Paper File Security Procedure

Paper counselling records must be:

1. Stored in a locked cabinet, room or other secure location when not in use.
2. Accessible only to authorised individuals.
3. Kept away from visitors and other clients.
4. Returned to secure storage immediately after use.
5. Transported securely if they need to leave the usual premises.
6. Never left unattended in a vehicle unless appropriate security measures have been taken.
7. Securely destroyed when the applicable retention period expires.
8. Recorded appropriately if a file is lost, stolen, or otherwise compromised.

Where paper records are removed from the usual storage location, the counsellor should consider whether this is necessary and whether additional security measures are required.

Appendix 3 – Electronic Security Procedure

The service should, as appropriate:

• Use strong, unique passwords.
• Enable multi-factor authentication where available.
• Keep devices protected by a password/PIN or equivalent.
• Enable encryption where available and appropriate.
• Install security and software updates promptly.
• Use reputable, appropriately secured cloud services.
• Restrict access to client information.
• Avoid storing counselling records on personal devices unnecessarily.
• Use secure backups.
• Securely delete information when it is no longer required.
• Avoid using public or unsecured Wi-Fi for sensitive processing where possible.
• Lock screens when devices are unattended.
• Avoid leaving client information visible on screens.
• Review access permissions periodically.
• Ensure former staff or contractors no longer have access to systems.

Appendix 4 – Confidentiality and Disclosure Statement for Clients

Counselling is normally confidential.

Information you provide will not ordinarily be shared outside the counselling service without your knowledge and, where appropriate, your consent.

There are, however, circumstances where confidentiality may need to be limited. These can include situations involving serious risk of harm, safeguarding concerns, legal requirements, court orders, or other circumstances where disclosure is legally permitted or required.

Where possible and appropriate, we will discuss significant disclosures with you beforehand.

The precise action taken will depend upon the circumstances and the relevant legal and professional requirements.

Appendix 5 – Policy Approval

Approved by: Sheena Crossan
Role: Director
Date approved: 02/09/2026
Policy version: 1.0