Where we rely on legitimate interests, those interests may include delivering requested professional services, maintaining appropriate professional records, safeguarding, running and protecting our business, communicating with professional contacts, improving services and establishing or defending legal rights.

When the information concerns a child, we give particular weight to the child's interests, rights, welfare and reasonable expectations.

7. SPECIAL-CATEGORY PERSONAL INFORMATION

Special-category information includes information about matters such as:

• health;

• disability and some SEND information;

• racial or ethnic origin;

• religious or philosophical beliefs;

• sexual orientation;

• genetic information; and

• certain biometric information.

We only process special-category information where it is relevant and where we have both:

• a lawful basis under Article 6 of UK GDPR; and

• an appropriate additional condition under Article 9 UK GDPR and, where required, the Data Protection Act 2018.

For ordinary service provision, this may include explicit consent, where appropriate.

Where explicit consent is used, it will be specific and can normally be withdrawn.

Where information must be processed for a safeguarding purpose and seeking consent would be inappropriate, unsafe or impracticable, we may rely upon the relevant substantial-public-interest safeguarding provisions of data-protection law.

We may also process information where necessary to establish, exercise or defend legal claims or where another lawful condition applies.

We minimise the amount of special-category information we collect and restrict access to it appropriately.

8. CHILDREN AND YOUNG PEOPLE

We provide some services directly to young people, including participants aged 14–17.

Children and young people have their own privacy and data-protection rights.

Where possible, we will explain:

• what information we are collecting;

• why we need it;

• what we will do with it;

• who it might be shared with;

• how long we may keep it; and

• what rights the young person has

in language appropriate to their age and level of understanding.

A parent's agreement to purchase a service does not mean that the parent automatically owns or has unrestricted access to everything the young person tells us.

We recognise the importance of giving young people an appropriate degree of privacy so that they can participate honestly and meaningfully.

Where a parent or carer requests access to information relating to a young person, we will consider the young person's age, maturity, understanding, wishes, best interests, confidentiality and applicable data-protection law before disclosing information.

Where a young person is sufficiently competent to understand and exercise their data-protection rights, we may deal with them directly.

9. PARENTS AND CARERS

Where you purchase a service for a young person, we will use your personal information to:

• administer the booking;

• communicate with you;

• take payment;

• arrange sessions;

• obtain appropriate consent and background information;

• provide any parent/carer element included within the programme; and

• deal with safeguarding or administrative matters where necessary.

Being the purchaser does not automatically give a parent or carer access to all session content or records relating to a young person. Where a parent debrief forms part of a programme, we will explain its purpose and boundaries at the beginning of the work.

For participants aged 18 or over, the participant is an adult. A parent, carer or other purchaser has no automatic right to information about their sessions, records or personal information unless the participant has authorised disclosure or another lawful basis for sharing applies.

10. SAFEGUARDING AND CONFIDENTIALITY

Information shared in private sessions will normally be treated confidentially.

However, confidentiality is not absolute.

Where we reasonably believe that a child, young person or another individual may be at risk of harm, abuse, neglect or exploitation, we may need to record and share relevant information with an appropriate person or organisation.

Depending upon the circumstances this may include:

• a parent or carer;

• a school's Designated Safeguarding Lead;

• a local authority safeguarding service;

• healthcare or emergency services;

• the police; or

• another appropriate safeguarding body.

Where possible and safe to do so, we will explain the proposed disclosure to the person concerned.

We only share information that is reasonably necessary for the safeguarding purpose.

Our Safeguarding & Child Protection Policy provides further information about our safeguarding approach.

11. SCHOOLS AND OTHER ORGANISATIONS

We may provide services commissioned by schools, colleges, universities, charities, businesses or other organisations.

Depending upon the arrangement, Incharge Wellbeing Ltd may act as:

• an independent data controller;

• a processor acting on the organisation's documented instructions; or

• in some cases, a joint controller.

The legal role depends upon who determines why and how personal information is processed, rather than simply what the parties call themselves.

Where required, appropriate data-processing or data-sharing terms will be agreed with the commissioning organisation.

Where we act only as a processor, we will handle personal information according to the commissioning organisation's lawful instructions and the relevant data-processing agreement.

Certain activities, such as independent professional record keeping or safeguarding decisions, may nevertheless require us to act as an independent controller.

Where an organisation supplies information about a young person, we will work with that organisation to ensure appropriate privacy information is made available to the young person and, where appropriate, their parent or carer.

12. WEBSITE, BOOKINGS AND PAYMENTS

Our website and online store use third-party technology providers to operate functions such as:

• website hosting;

• forms;

• online bookings;

• e-commerce;

• payment processing;

• email delivery; and

• website analytics.

Our website is currently operated through Squarespace.

Payments may be processed through third-party payment providers such as Stripe, depending upon the payment method used.

These providers process information in accordance with their own privacy obligations and contractual arrangements with us.

We do not normally receive your full card details.

13. COOKIES AND ANALYTICS

Our website may use cookies and similar technologies necessary for the website to function.

We may also use analytics or other non-essential technologies where permitted by law.

Where consent is legally required, non-essential cookies will not be used until the appropriate consent has been obtained.

Further information is available in our Cookie Policy.

14. MARKETING

We may send information about Incharge Wellbeing or Incharge Futures services where permitted under data-protection law and PECR.

For individuals, this will normally be because:

• you have expressly opted in; or

• you have previously purchased or actively enquired about a similar service and the legal requirements of the customer “soft opt-in” are satisfied.

You can unsubscribe from marketing at any time.

Marketing consent is separate from consent to receive our professional services.

For professional contacts at schools, organisations and businesses, we may process business contact information under our legitimate interests where lawful to do so.

We do not use therapy notes, health information, SEND information, safeguarding records, astrology/Human Design information or similarly sensitive personal information to target people with marketing.

We do not profile children for targeted direct marketing.

15. TESTIMONIALS, CASE STUDIES AND PUBLICITY

Providing a service does not give us permission to publish your identity, image, story or private information.

Where we wish to use an identifiable:

• testimonial;

• case study;

• photograph;

• video;

• audio recording; or

• quotation

for publicity, teaching or marketing, we will obtain separate permission.

Where the person concerned is under 18, we will take particular care to obtain appropriate consent and to respect the young person's own wishes.

You may refuse marketing or testimonial consent without affecting the professional service you receive.

16. RESEARCH

Personal information obtained through a professional service is not automatically available for research simply because we already hold it.

Where identifiable client information is proposed for formal research, appropriate additional information, lawful bases, consent and ethical procedures will be considered separately.

Where information has been genuinely anonymised so that an individual is no longer identifiable, it is no longer personal data for the purposes of UK GDPR.

17. AUTOMATED DECISION-MAKING

We do not make decisions about clients or young people based solely on automated processing where those decisions would have legal or similarly significant effects.

We may use software or digital tools to assist with administrative processes or the preparation of agreed personalised materials.

Any significant professional recommendations or interpretations are human-led and are not treated as automatic determinations of what a person should study, pursue professionally or do with their life.

18. WHO WE MAY SHARE INFORMATION WITH

We do not sell personal information.

Where necessary and lawful, information may be shared with:

• technology and software providers that help us operate the business;

• website, booking and payment providers;

• cloud storage and email providers;

• professional advisers such as accountants, lawyers and insurers;

• contractors who genuinely need information to provide services on our behalf;

• schools or commissioning organisations where appropriate to the service and privacy arrangements;

• safeguarding authorities or professionals where necessary;

• courts, law-enforcement bodies, regulators or public authorities where legally required;

• professional supervisors or professional consultants where reasonably necessary for safe and appropriate professional practice, with identifying information minimised wherever reasonably practicable; and

• another person or organisation where you have authorised us to share information.

Where we use a processor to handle personal information on our behalf, we require appropriate contractual and security protections.

We endeavour to share only the minimum information reasonably necessary.

19. INTERNATIONAL TRANSFERS

Some technology and service providers may process or make personal information accessible outside the United Kingdom.

Where we are responsible for making a restricted international transfer, we will ensure that an appropriate transfer mechanism is in place.

Depending upon the destination and provider, this may include:

• UK adequacy regulations;

• appropriate contractual safeguards such as an approved UK international data-transfer mechanism; or

• another lawful exception permitted by UK data-protection legislation.

Where required, we also assess whether the protection available after transfer meets the standard required by UK law.

20. HOW LONG WE KEEP INFORMATION

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected and for any legitimate legal, safeguarding, insurance, tax or professional record-keeping requirements.

Our usual retention approach is: