Privacy notice.

1. Who I am

CTRL+K is a private counselling and psycho-education practice based in the UK. The data controller is Stevie Kilmister, owner and operator of CTRL+K. CTRL+K is registered with the Information Commissioner’s Office (ICO), registration number ZC133602. If you have any questions about this notice, contact me at hello@ctrlk.co or on 07399 321 254.

2. What information I collect

When you visit this website

• This website doesn’t use cookies for tracking or advertising.
• It is hosted by Cloudflare, which processes technical information such as your IP address and browser type to deliver the site and protect it from abuse. Cloudflare may set a strictly necessary security cookie for this purpose.
• I use Cloudflare Web Analytics to see anonymous, combined statistics, such as how many people visited a page. It doesn’t use cookies and doesn’t track individuals.
• The fonts are hosted on this website itself, so no information is sent to font providers.

When you get in touch

• Your name and contact details, and anything you choose to include, when you call, email, text or WhatsApp me.
• The quick contact form on this site doesn’t store anything. It opens your own email app or WhatsApp with a message ready for you to send.
• If you message me on WhatsApp, WhatsApp (operated by Meta) processes that message under its own terms. Messages are end-to-end encrypted. I use WhatsApp for arranging sessions only, so please don’t send anything sensitive that way.

If you become a client

• Contact details (name, phone number, email, address)
• Emergency contact details (with your consent)
• Session notes and relevant personal information shared in therapy
• Administrative data for booking, billing and communication

3. How I use your information

• To provide counselling services
• To manage bookings and communication
• To comply with legal and professional obligations
• To respond to your enquiries
• To understand, anonymously, how the website is used

CTRL+K does not use your data for automated decision-making, profiling, or marketing without your explicit consent.

4. Legal basis for processing

Under the UK GDPR, I rely on the following legal bases:

• Consent: when you voluntarily share your information
• Contract: to provide therapy or training services
• Legal obligation: to comply with tax, supervision or regulatory requirements
• Legitimate interests: for example, maintaining business records, keeping the website secure, or improving services

5. How your information is stored

• Electronic records are kept in encrypted, password-protected systems.
• Paper notes (if used) are locked in a secure filing system.
• Only the data controller has access to confidential client material.

I retain client records for 7 years (or 7 years after the client turns 18, if under 18) in line with guidance from professional bodies and insurers. After this, data is securely deleted or destroyed.

6. Sharing your information

Your information will never be sold or shared for commercial purposes. It may only be shared:

• With your explicit consent (for example, to contact your GP)
• If required by law (for example, safeguarding, or a risk of serious harm)
• For professional supervision (discussed anonymously)
• With accountants or insurers, only for administrative or legal purposes (no confidential information will be shared)
• With service providers who help run the practice and this website, such as Cloudflare for website hosting, under appropriate data protection terms

7. Your rights

Under UK data protection law, you have rights including:

• To access your data
• To correct or update inaccurate data
• To ask for data to be erased (in certain cases)
• To restrict or object to processing
• To data portability (for electronic records)

You can also lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Third-party links

This website may include links to other websites, such as booking platforms or resources. I am not responsible for their privacy policies or content, so please check their policies directly.

9. Changes to this notice

I may update this privacy notice from time to time. The latest version will always be available on this page.