Privacy Policy

I am one counsellor working on my own. I am not an emergency service and I cannot always answer straight away, so if you need to talk to someone tonight, please use one of these rather than waiting on me.

• Samaritans — free, any time of the day or night, on 116 123.
• Breathing Space — free on 0800 83 85 87. Open 6pm to 2am Monday to Thursday, and from 6pm Friday right through to 6am Monday.
• NHS 24 — call 111 and choose the mental health option for urgent health advice.
• 999, if you or someone else is in immediate danger.

If you have already sent me a message, or you are about to, that is still worth doing — I will read it and I will come back to you. But please do not wait on my reply if you need someone tonight. Phoning one of the numbers above is not giving up on counselling and it is not an overreaction — it is just getting through the next few hours, which is the only thing that matters right now.

If you only read one part of this page, read this one. Everything below simply explains it in more detail.

• I am a one-person practice. I decide what happens to your information and I am the person responsible for it. The only people and services involved are the ones I name below — my supervisor, my web host, the contact form service, Google, Facebook if you message me there, and Zoom if we meet online.
• What you tell me in counselling stays between us, with a small number of honest exceptions — mainly where someone is at serious risk of harm, or where the law requires me to share something. Those exceptions are set out in full below, and I would rather you knew about them now than discovered them at a hard moment.
• Telling me you have thoughts of suicide does not by itself mean I will phone anyone. There is a fuller explanation of that below, because it is the thing people most often worry about.
• I do not record our sessions — not in person, not by video, not by phone. Online sessions take place on Zoom, which carries the call but makes no recording of it. Zoom does keep a record that a meeting happened, and that record is held in the United States. If you would rather not use Zoom, we can meet in person or talk by phone instead.
• Like every registered counsellor, I take my work to clinical supervision. My supervisor is bound by the same confidentiality I am, and I do not use your name.
• I also provide clinical supervision to other counsellors. If I am your supervisor rather than your counsellor, there is a short passage below about what I hold and why.
• I keep counselling records for seven years after your last session. If you were under 18 when we worked together, I keep them until your 25th birthday. Then I destroy them securely.
• This website does not use analytics, advertising trackers, social media pixels or a chat widget, and it sets no tracking cookies. Two things on the site itself do reach Google: the lettering is loaded from Google Fonts, and my homepage shows a Google map. Both mean Google sees your device's IP address, and neither tells Google anything about why you came. (Google is involved in one further way — the separate email address I use for data protection questions is a Gmail one. All three are explained below.) There is no mailing list, and I will never add you to one.
• If you send me a message through the contact form, it passes through an outside company before it reaches me. That company does not publish where it is based, so I cannot tell you which country your message travels through, and because I cannot show that it stays in the UK, I treat it as leaving the UK. If you would rather it did not go that way, please phone or email me instead — that is a perfectly normal thing to do and I would not think anything of it.
• If you are 16 or 17, there is a section further down written for you. In Scotland these decisions are yours, not your parents'.
• You can ask me for a copy of what I hold about you, ask me to correct it, and object to things I am doing with it. You can also complain — to me, and to the UK's data protection regulator.

I am Louise Knox, trading as L Knox Counselling. In data protection law I am what is called the "data controller" for your information. That means I decide what is collected and what happens to it, and I am the one accountable for looking after it.

• Website: lknoxcounselling.co.uk (my email address uses the .com version of the same name — both are mine)
• Address: Studio 203, Old Embroidery Mill, Abbey Mill Business Centre, Seedhill, Paisley, Renfrewshire PA1 1TJ
• Phone: 07411 740 415
• Email: info@lknoxcounselling.com
• Email for data protection questions, requests and complaints: privacypolicylkcounselling@gmail.com — a separate address I keep for this purpose, which is a Gmail account, so Google handles messages sent to it. You never have to use it: anything you would send there is just as welcome at info@lknoxcounselling.com.

I am registered with the Information Commissioner's Office, the UK's data protection regulator. My registration reference is ZB074632.

I am a registered member of the British Association for Counselling and Psychotherapy. My BACP membership number is 63792. I have been working as a counsellor for more than thirteen years, and I am also a qualified supervisor, which means I provide clinical supervision to other counsellors alongside my counselling practice. I work to the BACP Ethical Framework for the Counselling Professions, which places me under a professional duty of confidentiality as well as a legal one.

Because I am a one-person practice, I do not have a data protection officer. The law (Article 37 of the UK GDPR) requires one only for public authorities, for organisations whose core activities involve monitoring people regularly and systematically on a large scale, and for organisations whose core activities involve processing health or other special category information on a large scale. A single-handed counselling practice is none of those three. I deal with every question about your information myself.

Almost everything I hold comes directly from you. Here is the whole picture.

You do not have to tell me everything at once. There is no law that obliges you to give me any of this. I do need a name and a way of contacting you to arrange sessions, and I need enough of your story to work with you safely. If you would rather not give me a name and a way of reaching you, I will not be able to arrange sessions — but you are always welcome to phone me first without giving your name, and plenty of people do exactly that. Most people start with only a rough idea of what they want to say, and that is a perfectly good place to begin. You can always say "I would rather not talk about that yet" — that is allowed here, and I will not push. If at some point it turned out that what you need is something I am not trained to offer, I would say so honestly and help you find the right person rather than leave you with nothing.

Information from someone else. Occasionally someone other than you may give me information about you — for example a parent or partner who makes the first contact on your behalf, or a GP or another professional who refers you. If that happens, I will tell you what I have been given and who gave it to me, normally at our first conversation and in any event within a month. I do not buy information about anyone.

I use it for a small number of clear purposes, and nothing else:

• to reply to your enquiry and arrange an initial conversation;
• to arrange and deliver your counselling sessions, whether in person in Paisley, by video call or by phone;
• to keep brief, accurate notes of our work, so that I can hold what matters in mind between sessions and so there is a proper, accountable record of the counselling I provided;
• to take payment and keep my accounts and tax records;
• to discuss my work in clinical supervision, so that the counselling I offer you is safe and good;
• to provide clinical supervision to other counsellors, where I am the supervisor, and to keep brief notes of that work;
• to keep you or someone else safe, in the rare situations described below;
• to deal with an insurance matter, a complaint or a legal claim, if one ever arose;
• to keep my website secure and working.

I do not use your information for marketing, I do not sell it, and — apart from the limited business purposes Zoom reserves in its own terms, which I describe below — I do not share it for anyone else's purposes. I do not use it to build any kind of profile of you. I do not look you up on social media and I do not collect information about you from public sources; if you message my Facebook page, I only see what you send me there.

No automated decisions. I do not make decisions about you using computers alone, and I do not use artificial intelligence to make judgements about you or to write your notes. Every decision that affects you is made by me, as a person, usually in conversation with you.

You do not need to read this section unless you want to. It is here because the law makes me write down my reasons, and I would rather set them out than hide them. The short answer is that I hold your records because I am providing you with counselling and because I have to be able to account for my work — not because you ticked a box.

For anyone who wants the detail, here is each thing I do, the plain reason, and the legal reference in brackets. "The UK GDPR" is the UK's main data protection law.

• Replying to your enquiry, before we have agreed to work together. I cannot answer you unless I read what you have sent and keep hold of your details long enough to reply. (In law: my legitimate interests, Article 6(1)(f) UK GDPR.)
• Holding any health information you choose to put in an enquiry. Working out whether I am able to offer you counselling is part of providing health care, and I owe you a duty of confidence from the moment you first contact me. (In law: Article 9(2)(h) UK GDPR with paragraph 2 of Part 1 of Schedule 1 of the Data Protection Act 2018, relying on the duty-of-confidence limb in section 11(1)(b).) If you would rather not give me any health information at this stage, a first name and a contact number is plenty.
• Arranging and delivering your sessions, and keeping your record during our work. Our agreement with each other, which the law calls a contract. (In law: Article 6(1)(b) UK GDPR.)
• Holding what you tell me about your mental and physical health. Because I am providing you with health care, and because as a registered counsellor I am under a duty to keep what you tell me confidential. (In law: Article 9(2)(h) UK GDPR with paragraph 2 of Part 1 of Schedule 1 of the Data Protection Act 2018. I am not a "health professional" as that Act defines the term in section 204, so I rely on the duty-of-confidence limb in section 11(1)(b) rather than the health-professional limb.)
• Keeping your records after our work ends, taking my work to supervision, and being able to answer a complaint, claim or insurance question. Practising safely, ethically and accountably, weighed against your privacy. (In law: my legitimate interests, Article 6(1)(f) UK GDPR. The health information in those records is held under Article 9(2)(h), with paragraph 2 of Part 1 of Schedule 1, for record-keeping and supervision, and under Article 9(2)(f) — establishing, exercising or defending a legal claim — if a complaint, claim or insurance matter is actually made. Article 9(2)(f) stands on its own and needs no further condition.)
• Providing clinical supervision to another counsellor and keeping my notes of it. Our agreement with each other, and my professional obligations as a supervisor. (In law: Article 6(1)(b) UK GDPR for arranging and delivering the supervision itself, and Article 6(1)(f) — my legitimate interests — for keeping a record of the supervision I have provided.)
• Keeping accounts and tax records. HMRC requires it of me as a self-employed person. (In law: a legal obligation, Article 6(1)(c) UK GDPR.)
• The server logs my web host keeps. Keeping the website secure and working. (In law: my legitimate interests, Article 6(1)(f) UK GDPR.)
• Sharing information to protect a child, a young person or an adult who cannot protect themselves. Safeguarding someone who is vulnerable, which the law now recognises as a reason in its own right. (In law: Article 6(1)(ea) and paragraph 6 of Annex 1 to the UK GDPR, added by the Data (Use and Access) Act 2025 — "vulnerable individual" is defined in paragraph 7 as anyone under 18, or an adult who is "at risk"; paragraph 8 explains that an adult is at risk if they have needs for care and support, are experiencing or at risk of neglect or physical, mental or emotional harm, and as a result of those needs are unable to protect themselves.) Where what I pass on includes health information, an Article 6 reason is not enough on its own and I need an Article 9 condition as well. Where someone's life or safety is at immediate risk and they cannot consent for themselves, that condition is Article 9(2)(c) — vital interests. Where a court orders the disclosure, or it is needed for legal proceedings, it is Article 9(2)(f). Outside those two situations — a referral about someone who is able to decide for themselves, say, or a disclosure I would have to make to the police under the Terrorism Act 2000 — the conditions that would otherwise cover me are in Part 2 of Schedule 1 of the Data Protection Act 2018. Most of those conditions are only open to a controller who has an appropriate policy document in place, and I have one. I adopted it on 13 September 2026. It is the short written statement the law asks for — how I meet the data protection principles when I handle information of this kind, and how long I keep it — and I review it once a year to check it still describes what I actually do. You are welcome to ask me for a copy of it at any time, and I will send you one. Holding it opens the door to the safeguarding condition in paragraph 18 of Part 2 — the safeguarding of children and of individuals at risk — but holding it does not by itself make anything I share lawful. The document is a precondition; the conditions in paragraph 18 still have to be met on the day. Those conditions are these: that what I share is necessary for protecting someone from neglect or physical, mental or emotional harm, or for protecting their physical, mental or emotional wellbeing; that the person is under 18, or is 18 or over and "at risk", which for this purpose means I have reasonable cause to suspect that they have needs for care and support, are experiencing or at risk of that neglect or harm, and as a result of those needs are unable to protect themselves against it; that I am sharing without consent for one of three permitted reasons — consent cannot be given in the circumstances, or I cannot reasonably be expected to obtain it, or obtaining it would prejudice the very protection I am trying to provide, for instance by warning the person causing the harm or leaving someone in greater danger; and that the sharing is necessary for reasons of substantial public interest. So if I had to make a child protection or adult-at-risk referral, to social work at Renfrewshire Council or to the Principal Reporter for example, and what I passed on included health information, and each of those conditions was met, that sharing would be lawful under Article 9(2)(g) UK GDPR together with the paragraph 18 condition, and I would not be asking for your consent to it. If those conditions were not met, the document would not help me — I would need a different condition, or I could not share at all. One condition works differently again, and it matters here: where the disclosure is made to the police, the condition in paragraph 10 of Part 2 — preventing, investigating or detecting an unlawful act — applies whether or not I have an appropriate policy document, because paragraph 10(2) removes that requirement for a disclosure to a "competent authority", and the chief constable of the Police Service of Scotland is one. So a disclosure I am obliged to make to Police Scotland under the Terrorism Act 2000 is covered, and I would not be asking your permission first. Not needing your permission is not the same as going behind your back: wherever it was safe to do so, I would tell you what I had shared and why.
• Sharing information in a genuine emergency where someone's life is in danger and they cannot speak for themselves. (In law: vital interests, Articles 6(1)(d) and 9(2)(c) UK GDPR.)
• Complying with a court order or a statutory disclosure duty. (In law: a legal obligation, Article 6(1)(c) UK GDPR; and where health information is involved and a court or legal proceedings are in play, Article 9(2)(f).)
• Anything genuinely optional — writing to your GP, speaking to another professional involved in your care, using anonymised material for training. (In law: your explicit consent, Articles 6(1)(a) and 9(2)(a) UK GDPR, asked for separately each time.)

Why I do not ask you to "consent" to my keeping your records. I want to explain this, because consent might look like the friendlier option. Consent has to be a genuine choice that you can take back at any time. But I cannot keep safe, accurate records only for as long as you are happy for me to — I have professional and insurance obligations that outlast our work together. Offering you a choice I could not honour would be misleading; it would look like a say in the matter without actually being one. Being straight with you about my real reason is fairer, and it takes nothing at all away from your rights.

Where something genuinely is your choice, I will ask you properly, in plain words, at the time. You can say no, or change your mind later, and it will make no difference whatsoever to your counselling.

Because I am relying on my legitimate interests for some of the things above, you have a right to object to them. There is a separate section on that below.

This is the part of this page that matters most, so I have written it carefully.

What you bring to counselling stays between us. I do not discuss my clients with friends, family or other clients, I do not confirm to anyone that you are seeing me, and if we passed each other in Paisley I would follow your lead rather than greet you first.

I cannot promise you absolute confidentiality, and I would rather tell you that now than have you find it out at a hard moment. There are a small number of situations where I might need to pass something on. They are rare — in more than thirteen years of practice they have hardly ever come up. Here they are in full.

If someone is at serious risk of harm

If I come to believe that you are at serious risk of harming yourself, or that someone else is at serious risk, I may need to share information with your GP, with emergency services, or with another professional who can help keep you or them safe. I would share only what was needed for that purpose.

I want to be clear about what this does and does not mean, because it matters. Having thoughts of suicide, or telling me you sometimes wish you were not here, does not by itself mean I will phone anyone. Thoughts like that are far more common than people realise, and talking about them here is exactly what this space is for. What I am weighing is something much narrower: whether your life is in immediate danger and you are not able to keep yourself safe. Even then, wherever it is safe to do so, we would talk it through together first and decide what happens next. You would not simply find out afterwards.

If a child or young person may be at risk

If something you tell me makes me concerned about the safety of a child or young person, I may need to pass that concern to social work services at Renfrewshire Council, to the Principal Reporter, or to Police Scotland.

I want to be accurate about the legal position in Scotland. There is no law that forces a counsellor in private practice to report a child protection concern. England has legislated for a mandatory duty to report child sexual abuse, in the Crime and Policing Act 2026. That duty is not yet in force, and when it comes into force it will apply in England, not in Scotland. What Scotland has instead is a permission rather than a compulsion: section 64 of the Children's Hearings (Scotland) Act 2011 allows anyone who believes a child may need protection, guidance, treatment or control to pass what they know to the Principal Reporter. Alongside that sits a clear national expectation, set out in the National Guidance for Child Protection in Scotland and in the Getting it right for every child approach, that everyone who works with children acts on a concern rather than leaving it. My own professional and ethical duty is the same. So if I made a referral, it would be because I had judged it necessary, not because a statute compelled me.

If an adult at risk of harm may need protection

Sometimes an adult is unable to safeguard their own wellbeing, property, rights or interests, is at risk of being harmed, and is more vulnerable to being harmed than other adults because they are affected by disability, mental disorder, illness, or physical or mental infirmity. Scotland calls that being an "adult at risk of harm", under the Adult Support and Protection (Scotland) Act 2007, and that Act applies from the age of 16.

If I believed that described you, or another adult you told me about, I might pass that concern to Renfrewshire Council, which is under a duty in section 4 of that Act to make inquiries where it knows or believes an adult may be at risk of harm. Again, honestly: the Act's reporting duties fall on councils, the police, health boards and a few other public bodies — not on a counsellor in private practice. If I made a referral, it would be my professional judgement that it was necessary to keep someone safe.

If a court asks to see your notes

This one is rare — it has not been a feature of my practice — but it can happen, so you should hear it from me now rather than later. The short version is this: your notes are not simply available to anyone who asks for them, you would not be kept in the dark, and you would not be on your own.

Counselling notes do not have the special legal protection that talking to a solicitor does. There are two ways they could be asked for. The Procurator Fiscal — Scotland's public prosecutor — may write to me asking for records as part of a criminal investigation. Or a court may order me to hand them over. I could also, very occasionally, be cited as a witness, which means summoned to give evidence.

You are not a bystander in this. Your notes are protected by your right to a private life under Article 8 of the European Convention on Human Rights. The courts have decided that if someone asks a court for your records, you have to be told about it and given the chance to have your say before a judge decides. The Crown Office's own policy on sensitive personal records also says it should consult you, ask for your written consent first, and explain that you are free to refuse. If this ever arose, I would tell you as soon as I was permitted to, I would not hand over more than I was legally required to, and I would encourage you to get independent legal advice.

Where to get that advice depends on the case. If it involves sexual violence, Rape Crisis Scotland (08088 01 03 02) and, for women and girls, the Scottish Women's Rights Centre both give free specialist advice on records requests of exactly this kind. If it does not, a solicitor, your local Citizens Advice Bureau or Victim Support Scotland can point you in the right direction. Whoever you are, and whatever the case is about, you would not have to deal with it on your own, and I would help you find the right door.

(For anyone who wants the legal detail: in the sheriff court, recovery is dealt with under section 301A of the Criminal Procedure (Scotland) Act 1995, which allows either an order granting commission and diligence for the recovery of documents or an order for their production, and can only be applied for once an indictment has been served or the accused has answered the complaint; in the High Court it is done by petition. The case establishing your right to be told and heard is WF, Petitioner [2016] CSOH 27.)

If I learned something about terrorism

This has never come up in counselling and almost certainly never will, but it belongs on the list for completeness. The Terrorism Act 2000 requires everyone in the UK — not just counsellors — to pass on to the police information that might help prevent an act of terrorism or bring someone to justice for one, and places a further duty on people who learn in the course of their work about money or property being used for terrorist purposes. It applies to me exactly as it applies to anyone else, and it would override confidentiality. It is the only item on this list that obliges me to come forward without being asked; a court order or a witness citation also overrides confidentiality, but those are things done to me rather than things I must volunteer. The Act does allow a defence of reasonable excuse for not making a disclosure.

If someone else is paying

Sometimes a partner, a parent, an employer or an employee assistance scheme pays for someone's counselling. Paying does not buy any access to it. If someone else is paying for your sessions, they do not get to know what we discuss, how you are, what I think, or anything you have told me. Depending on what I have agreed with them, they may see an invoice and whether you attended — nothing more, and I will tell you at the start exactly what that is. If they asked me for more than that, the answer would be no, and I would tell you they had asked.

How I would handle any of this

Wherever it is safe and possible to do so, I will talk to you first: what I intend to share, with whom, and why. There are situations where I could not — where telling you first would put you or someone else in more danger, or where the law does not permit it — which is why I say "wherever possible" rather than "always". I will share the minimum necessary, never more, and I will keep a note of what I shared and why.

None of this is meant to live only on a web page. We will talk it through together at our first session, in ordinary conversation, and you can ask me anything about it then or at any point afterwards — including what I would actually do in a situation you are worried about. People often do ask, and it is a good question, not an awkward one.

And if you need someone right now: Samaritans are free on 116 123, any time; Breathing Space is free on 0800 83 85 87; NHS 24 is on 111; and if anyone is in immediate danger, call 999.

Like every registered counsellor, I have regular clinical supervision. This means I meet with an experienced counsellor to reflect on my work — how I am responding, whether I am missing something, whether what I am offering is helping. It is a requirement of BACP membership, and it exists to protect you.

In supervision I talk about the work rather than about you as a person. I do not use your name; if I need to refer to you at all, it is as "a client" or by a first initial. I do not share anything that is not needed for the purpose.

My supervisor is an experienced counsellor and is bound by the same duty of confidentiality I am. My supervisor will keep a brief record of our supervision sessions, as supervisors do; because I do not name you, that record is not about you by name. I keep a record of my own supervision — dates, length and the kind of work discussed — which does not identify any client.

I would not describe supervision as completely anonymous, because that would be an overstatement — a supervisor following a piece of work over many months can sometimes form a picture of who is being described. What I can tell you honestly is that you are not named, that only what is necessary is shared, and that everything said there is confidential.

If I am your supervisor

I am also a qualified supervisor, and I offer clinical supervision to other counsellors. If you are one of my supervisees, what I hold about you is your name and contact details and brief notes of our sessions — when we met and the themes we discussed — which I keep so that I can provide the supervision properly and account for it as a supervisor. Where we discuss your own clients, we do so in anonymised form: I do not ask for their names and I do not record them. The rest of this page — your rights, how I keep information safe, and how to complain — applies to you in the same way as it applies to a counselling client.

The honest answer is: very few people, and I will name them rather than hide behind phrases like "trusted partners".

• My clinical supervisor, as described above.
• IONOS, who host this website and run my practice mailbox. They hold the website and my email, which means enquiries and correspondence sit on their systems.
• FormSubmit, if you use the contact form on this site. There is a separate section on this below, because you should know how it works before you decide whether to use it.
• Google, in three limited ways: the lettering on this site (Roboto and Roboto Slab) is loaded from Google Fonts, so Google receives your device's IP address when a page loads; the map on my homepage is provided by Google; and the separate email address I use for data protection enquiries (privacypolicylkcounselling@gmail.com) is a Gmail account, which means Google handles messages sent to it. You never have to use that address — every request and complaint is just as welcome at info@lknoxcounselling.com. I never send session notes by email.
• Meta (Facebook), if you contact me through my Facebook page at facebook.com/lknoxcounselling. Messages sent that way sit on Facebook's systems, outside my control, and Facebook's own privacy policy applies to them as well as this one. Facebook also produces aggregate statistics about people who view or interact with the page; for those statistics Meta and I count as joint controllers under Meta's own page insights terms, and Meta takes primary responsibility for them. I would rather you did not send me anything personal through Facebook — please phone or email instead. If we do start talking there, I will move us to phone or email as soon as I can, and I do not keep Facebook messages as part of your counselling record.
• Zoom, if we work online. Video sessions take place on Zoom, which is run by Zoom Communications, Inc., a company based in San Jose, California. Zoom carries the call itself, so the picture and sound of our session pass through Zoom's systems while we are talking. I do not record sessions, so no audio, no video and no transcript is made, and there is no recording for Zoom or for me to hold. Zoom does keep a record that a meeting took place — my account details, the meeting number, the date, the start and finish times, how long we met, how many people took part, the name shown on screen, the type of device and app used, the internet (IP) address, and technical information about the quality of the connection. If you join using a Zoom account of your own, your account details are held too. Zoom handles that information on my behalf under a written data processing agreement and is not permitted to use it for its own purposes, apart from a limited list of business purposes set out in that agreement. There is more about Zoom, including where the information goes, in the section on information that may leave the UK. If you would rather not use Zoom, we can work by phone or in person instead.
• My professional indemnity insurer and, if it were ever needed, a solicitor — only if a complaint or claim were actually made, and only so far as necessary to deal with it.
• BACP, if a complaint were made about my conduct as a counsellor. BACP's professional conduct process can require me to provide my records and my account of the work. I would tell you if that happened, and share only what the process required.
• A GP, emergency services, social work or the police, but only in the safeguarding and risk situations set out above, or where the law requires it.

That is the list as it stands today. No one else reads your records or your notes. There is one qualification I should make rather than leave you to find it: Zoom, like most large platforms, reserves the right in its agreement with me to use some of the information it generates about meetings for a limited list of its own business purposes. Apart from that, I do not pass your information to anyone for their own purposes. If I ever start using another service that touches your information, I will name it here before it starts.

I want to be straightforward with you about this, because you should be able to make an informed choice.

There are three ways to reach me directly — the form on this site, the phone, and email — and phoning or emailing me is the most private of the three. (You can also text me, or message my Facebook page, though I would rather you did not send anything personal through Facebook — there is more about that above.) If you would rather skip the form entirely, phone me on 07411 740 415 or email me at info@lknoxcounselling.com. Either reaches me just as quickly, plenty of people do it, and I would not think anything of it. If you would like to know why I say that about the form, here it is in full.

When you fill in the contact form on this website, your name, email address, phone number and message are not sent straight to my inbox. They are first passed through a free form service called FormSubmit, which then forwards them on to me. Before your message reaches me, FormSubmit shows you a page of its own, on its own website, where you have to complete an anti-spam check. Only then is your message sent on. That page is FormSubmit's, not mine, and any cookies used on it are theirs. If you find that check difficult to use for any reason, please phone or email me instead — you will not be missing anything by doing so.

Here is the position honestly stated:

• FormSubmit does not publish which company operates it, where it is registered, or where its servers are, so I cannot tell you which country your message travels to. Because I cannot show that it stays in the UK, I treat it as leaving the UK, and everything that follows is written on that basis.
• The UK Government has made no regulations approving transfers to that destination under Article 45A of the UK GDPR — the power that replaced what used to be called an adequacy decision. The "data protection test" those regulations have to satisfy is in Article 45B, and it is for the Secretary of State to apply, not for me.
• I do not have a data protection contract or an International Data Transfer Agreement in place with FormSubmit. I am not going to pretend otherwise. That means there is no safeguard under Article 46 of the UK GDPR that I can point you to or send you a copy of.
• Because I cannot identify the destination country, I also cannot carry out the risk assessment the law expects before a transfer of this kind.
• Because there is no approving regulation and no Article 46 safeguard, what makes this transfer lawful is one of the exceptions in Article 49 of the UK GDPR. The one I rely on is Article 49(1)(b) — the transfer is necessary to take the step you have asked me to take before we agree to work together, because sending the form is the route you chose. You are choosing it with everything on this page in front of you, and the phone and email routes above avoid the transfer altogether.

That is how the form works at present, and I would rather set it out plainly than let you find out afterwards. The practical answer is simple: if you would prefer your message not to pass through an outside service, phone me or email me instead. It makes no difference at all to how I reply, and it is always welcome. If you do use the form, keep your message brief — a first name and a way of contacting you is plenty, and anything more personal is better saved for our conversation.

Google

The lettering loaded from Google Fonts, the map on my homepage, and the Gmail account I use for data protection enquiries all involve Google. Where that means information going to Google LLC in the United States, such transfers are covered by the UK Extension to the EU–US Data Privacy Framework — the "UK–US data bridge" — which the UK Government has approved. You can check Google's current certification on the Data Privacy Framework list at dataprivacyframework.gov, and you can ask me for a copy of anything referred to here.

Zoom, if we meet online

Our online sessions take place on Zoom. Zoom is run by Zoom Communications, Inc., a company at 55 Almaden Boulevard, San Jose, California, in the United States. That US company is the one I contract with — Zoom has an office in London, but it is only Zoom's representative here, not the party to my agreement — so information about our sessions does travel to the United States.

Unlike the contact form, I can tell you what covers that transfer, because I checked it on 13 September 2026. Two things cover it, and they work side by side:

• Zoom holds a current certification under the UK Extension to the EU–US Data Privacy Framework — the "UK–US data bridge". That is the arrangement the UK Government has approved as giving personal information an adequate level of protection in the United States, under the Data Protection (Adequacy) (United States of America) Regulations 2023. You can check Zoom's certification for yourself on the Data Privacy Framework list at dataprivacyframework.gov. I re-check that it is still active from time to time; Zoom's next renewal is due in December 2026.
• Zoom's data processing terms also apply the European Standard Contractual Clauses together with the UK Addendum issued by the Information Commissioner. That is a contract rather than a government approval, so the transfer is covered either way, and you can ask me for a copy of those clauses. I mention it because the data bridge is a government arrangement that could be reviewed or withdrawn, and I would rather not describe it to you as permanent when it is not.

What you tell me in a session is health information, which the law treats as needing extra care when it leaves the UK. Both routes above are capable of covering information of that kind, and the Standard Contractual Clauses are the route I would point to for it.

Two honest qualifications. First, I cannot tell you that anything stays in the UK. Zoom's servers are in a number of countries; Zoom stores account and technical information in the United States, and the home region of a Zoom account cannot be switched off. Zoom's data-centre settings, where a plan offers them, change only the route a live call takes and not where the surrounding records are stored. Second, Zoom's Data Privacy Framework certification is a self-certification made to the US Department of Commerce and verified by Zoom itself. It is not an approval by the Information Commissioner, and there is no such thing as a service being "GDPR certified".

Zoom publishes its own privacy statement at zoom.com, and its published standard is to keep the technical record of a meeting for 15 months from the date it is collected, and profile information for as long as an account stays open. Zoom's data protection officer can be contacted at privacy@zoom.us, and Zoom's representative in the UK is ZVC UK Ltd, Part Level 6, Mid City Place, 71 High Holborn, London WC1V 6EA. If you would rather not use Zoom at all, please just tell me and we will meet in person or talk by phone.

My host and email provider

My website and my practice mailbox are with IONOS. Apart from the contact form, the Google services described above, Zoom if we meet online, and Facebook if you message me there, your information stays with me and with the people and services named in the section above.

I do not record our sessions. Not in person, not by video, not by phone — there is no recording, no transcript and no automatic note-taker in the room. I also ask that you do not record our sessions without talking to me about it first; if there is a reason you would find a recording helpful, tell me and we will think about it together rather than it happening unspoken.

If we work online, we use Zoom. Practically, that means I send you a link before the session and you open it on a phone, tablet or computer, either in the Zoom app or in a web browser. You do not need a Zoom account of your own, and the name shown on screen is yours to choose — it does not have to be your full name. If you do sign in with your own Zoom account, Zoom holds your account details as well.

Zoom carries the picture and sound of our session, and both are encrypted — scrambled — using strong, industry-standard encryption while they travel between us. I want to be straight about the limit of that, because it is often overstated. On Zoom's normal setting, the keys that unscramble a meeting are created and held on Zoom's own servers, which means Zoom is technically capable of accessing the content of a meeting. Zoom states that it does not do so except in limited circumstances, such as where it is legally required to, or for safety, security or support reasons.

I do not record Zoom sessions, so there is no audio, video or transcript of what we say. Zoom's artificial-intelligence features, such as automatic meeting summaries, are switched off on my account and I do not use them in sessions. Zoom does still keep a record that a meeting took place, and because Zoom is a US company some of that information goes to the United States — the section on information that may leave the UK sets out what covers that.

You never have to use Zoom. If you would rather meet in person in Paisley, or talk by phone, just say so at any point. It makes no difference at all to the counselling, and I would not think anything of it.

Emails, texts and voicemails between us about your counselling form part of your record. That matters in two ways: they are kept for the same length of time as your notes, and if you ever ask to see what I hold about you, they would be included.

Email and text are convenient but not perfectly secure — messages can arrive on a shared device, or be seen by someone else with access to an inbox or a phone. For that reason I keep what I put in writing to a minimum: practical things like arranging or moving a session, and never session notes.

Tell me how you would like me to contact you, and how you would rather I did not. If it is safer for you that I never leave a voicemail, or never send a text, or only ring at certain times, say so and that is what I will do. You can also tell me what to say — and what not to say — if someone else answers your phone. I will follow exactly what you ask, and you can change it at any time without explaining why.

This website does not track you. There is no Google Analytics here, no advertising or social media tracking, no pixels, and no chat widget. I do not build a profile of you, and I cannot tell who has visited the site.

The site sets no tracking cookies. The software it runs on may set a small number of cookies that are strictly necessary to deliver the page you asked for, and nothing it stores is used to follow you anywhere. The law about storing things on your device (regulation 6 of the Privacy and Electronic Communications Regulations 2003) does not require your consent for anything that is strictly necessary in that way, which is all these are.

Because nothing here is used to track you, and nothing on the site needs your consent, you will not see a cookie banner when you arrive. There is nothing for you to accept or refuse. If you would still like to clear or block cookies generally, your browser settings let you do that, and it will not stop this site working.

The lettering

I should be plain about this one, because it happens before you can read a word of this page. The lettering used for headings and text on this site — two typefaces called Roboto and Roboto Slab — is loaded from Google Fonts rather than from my own server. That means that every time you open a page here, your browser asks Google for those files, and Google receives your device's IP address. It happens automatically, as the page loads, and there is nothing for you to click. Google Fonts does not place cookies on your device, and Google is not told why you came to the site or what you read. The rest of the lettering comes from typefaces already on your own device and involves no one but you.

The map

My homepage shows a Google map so you can find the studio. When that part of the page loads, your device contacts Google's servers so the map images can be sent, which means Google receives your device's IP address and records that the map was shown. When I last checked, on 13 September 2026, the map did not place any cookies on your device — but Google may recognise you if you are already signed in to a Google account. The full address is written out on the page as well, so you never need to use the map at all.

If you use the contact form

Your browser visits FormSubmit's own page to complete the anti-spam check. Any cookies used there are theirs, not mine. The section on the contact form explains this in full.

Checking all of this

I check from time to time what this whole website stores on visitors' devices, and I last did so on 13 September 2026. If that ever changes, I will update this page and say so.

I will not add you to a mailing list. I do not send newsletters, offers or promotional emails, and I will never pass your details to anyone else for marketing. A list of people who have contacted a counsellor is, in substance, a list of people who were looking for help with their mental health, and it is not something I am willing to market to.

If I ever decided to send anything of that kind, I would ask you first and wait for a clear yes. You would be free to say no without it making any difference to the support you receive, and free to change your mind at any time.

Messages about your own sessions — confirming an appointment, sending you a video link, letting you know I am unwell, or sending an invoice — are not marketing, and I will keep sending those while we are working together.

Rather than say something vague like "as long as necessary", here is how long I keep each kind of record, and why.

Counselling records for adult clients — session notes, our working agreement, the information you gave me at the start, dates of sessions, and correspondence about your counselling. Kept for 7 years from the date of your last session. Seven years is a commonly used period in counselling practice, my professional indemnity insurance requires me to keep records for seven years, and it is long enough to cover the great majority of complaints, claims and questions that come back after a piece of work has ended.

Counselling records where you were under 18 while we worked together. Kept until your 25th birthday. A young person may want to raise something years later, once they are older. It also covers two Scottish periods: a transaction entered into at 16 or 17 can be challenged as a prejudicial transaction until the 21st birthday, under section 3 of the Age of Legal Capacity (Scotland) Act 1991, and a claim for personal injury resulting from abuse suffered before 18 has no time limit at all, under section 17A of the Prescription and Limitation (Scotland) Act 1973. This is a deliberately cautious choice on my part.

Enquiries that do not lead to counselling. Kept for 12 months from our last contact, then deleted. Long enough that you can come back to me without starting from scratch, and no longer.

Website server logs. Any logs of this kind are held by my host, IONOS, as part of running the server, and are deleted on IONOS's own cycle rather than one I set. I do not copy anything out of them into my own records, and I only look at them if I have to investigate a problem with the security of the site.

Payment and invoice records. Kept for 6 years from the end of the tax year they relate to. HMRC requires a self-employed person to keep business records until at least five years after the 31 January filing deadline for the tax year in question; I round that up to six years from the end of the tax year so that I am not tracking two different dates. These show dates and amounts only — nothing about what we discussed.

Supervision material. My own supervision log is kept for as long as I am in practice. BACP requires me to keep a record of my supervision — dates, length and the kind of work discussed. It does not name clients or record what you told me. My supervisor will keep a brief record of our sessions, under their own retention policy.

Records about my supervisees. If I am your supervisor, I keep your contact details and my notes of our sessions for as long as the supervision arrangement continues, and then for as long afterwards as I could still be asked to account for the supervision I provided — in a complaint, a claim, or an insurance or BACP matter. I have not yet fixed a single figure for that, and I am not going to print a number I have not decided on. Ask me at any point and I will tell you exactly what I hold and how long I expect to keep it, and once the period is settled it will be published here. When it is reached, I destroy the records in the same way as everything else on this page.

These periods are my own policy. No law in Scotland or the UK fixes a retention period for private counselling records, and BACP does not set one either — data protection law simply asks me to choose a period I can justify, tell you what it is, and stick to it.

I would rather be straight than reassuring here. Under Scots law a personal injury claim normally has to be raised within three years, and most other obligations are extinguished after five. But a court has a discretion to let a personal injury action proceed late, there is no twenty-year long-stop for personal injury claims in Scotland, and where a claim is for personal injury resulting from abuse suffered while under 18 there is no time limit at all. So seven years is my considered policy choice. It is not a period after which no claim could ever be made, and I would rather say that plainly than imply a certainty Scots law does not give.

When a record reaches the end of its period, I destroy it securely — see the next section. I review these periods from time to time, and if they change I will update this page.

I am the only person who has access to my session notes in the ordinary course of my work. Nobody works with me, no one else answers my phone or arranges my appointments, and no one else reads what I write about our sessions — apart from the limited situations set out above, where a court, the Procurator Fiscal, BACP's complaints process, or my insurer or solicitor could require them. If you want to know exactly where your own records are kept and what protects them, ask me. It is a fair question, people do ask it, and you will get a straight answer rather than a general one.

I keep notes brief and factual — enough to hold your work in mind and to account for what I did, and no more than that. They are working notes rather than a report; if you read them you will find them shorter and plainer than you might expect.

When records reach the end of the periods above, I destroy them properly. Any paper records are cross-cut shredded or destroyed by a confidential waste service. Any digital records are deleted from my device and emptied from the Trash rather than left sitting in it. Where my email or hosting provider keeps backups of its own, those run on its cycle and are outside my control. I do not simply move old records into a box or an archive folder and forget about them — putting something out of sight is not the same as deleting it.

If something ever went wrong — if information about you were lost, stolen, or seen by someone who should not have seen it — I would not keep that from you. I would tell you what had happened, what I was doing about it and what it might mean for you, and I would report it to the Information Commissioner's Office where the law requires me to.

You have rights over the information I hold about you. Some of them depend on the legal reason I am relying on, so rather than give you a list of eight things that sound unconditional, here is what actually applies.

• To be told what I hold and to get a copy of it. In practice this is usually much simpler than the law makes it sound. If you want to see your notes, just say so — we can look at them together in a session, or I can print them for you. There is nothing in them I would not be willing to show you, and asking is a perfectly ordinary thing to do. There is also a formal route, with two narrow limits on it, and I have set both out in full in Asking for a copy of your information below.
• To have mistakes corrected. If something in your record is factually wrong, tell me and I will correct it. Where something is my professional opinion at the time rather than a fact, I would not delete it, but I would record your view alongside it so that anyone reading the record later sees both.
• To object. This one matters enough that it has a section of its own — it is the next one.
• To ask me to pause. If you have questioned something in your record or objected to something I am doing, you can ask me to stop using that information while we sort it out.
• To ask for deletion — with an honest caveat. This right only arises in defined circumstances, and for most of your counselling record none of them is met, because the information is still needed for the purpose I collected it for. On top of that, Article 17(3)(b) of the UK GDPR protects records I must keep to comply with a legal obligation, such as my HMRC records, and Article 17(3)(e) protects records I may need to establish, exercise or defend a legal claim. Where I am relying on my legitimate interests you can still object, and if you do I have to stop unless I can show compelling grounds that override your interests — so this is not a door that is simply shut. I will always consider a request properly and explain plainly what I can and cannot do.
• To get a copy you can take elsewhere. If you gave me information electronically, you can ask for it back in a format you could hand to someone else — another counsellor, for example. Just ask and I will sort it out.
• To withdraw consent for anything I asked your permission for — writing to your GP, for example — at any time, and as easily as you gave it. Withdrawing consent does not make anything I did beforehand unlawful, and it does not affect the records I have to keep about our work.

Exercising these rights is free. The one exception the law allows is that I could charge a reasonable fee, or refuse, if a request were manifestly unfounded or excessive (Article 12(5) UK GDPR). I have never had to do either, and if I ever did I would explain why in writing and tell you how to challenge it. I will not treat you any differently for using any of these rights. To use one, contact me using the details at the top of this page.

I am setting this out on its own, because the law says it has to be brought to your attention clearly and separately — and because it is a real right, not a formality.

Where I am relying on my legitimate interests — holding your enquiry details, keeping your records after our work has ended, taking my work to supervision, keeping my website secure, or being able to answer a complaint or claim — you can object. You do not need a special form or any particular wording. Just tell me what you are objecting to and, if you want to, why.

If you object, I have to look at it properly. I will either stop what I am doing, or explain to you clearly and specifically why I believe I am entitled to continue. If you think I have got the balance between my needs and your privacy wrong, saying so is exactly the right thing to do.

As I said above, if you simply want to see your notes, you can ask me in a session and we can look at them together. You do not have to use the formal route at all. But it is there if you want it.

You can ask me for a copy of the personal information I hold about you — by email, by phone, or by letter. You do not need to give a reason, and there is normally no charge.

I will normally reply within one month. Two things can affect that:

• I may need to check that you are who you say you are, or to ask you to tell me a little more about what you are looking for. If I do, the clock stops from the day I ask until the day you reply, and the rest of the month runs on from there — the days before I asked still count (Article 12A UK GDPR).
• If your request is a complicated one, or you have asked for a great deal, I may need up to two extra months. If that happens I will tell you within the first month and explain why.

When you ask, I will carry out what the law calls a reasonable and proportionate search. That means I will look properly, in the places your information is likely to be — your file and my email — but I am not expected to search every conceivable corner if the effort would be wildly out of proportion to what would turn up.

Remember that your record includes emails, texts and voicemails about your counselling, not just my session notes. Two narrow limits apply, and I would rather set them out than surprise you. First, if releasing part of a health record would be likely to cause serious harm to your physical or mental health, or to someone else's, the law allows me to hold that part back (Data Protection Act 2018, Schedule 3, Part 2, paragraph 5) — and because I am not a health professional as that Act defines the term, I could not make that judgement on my own view; I would first have to obtain an opinion from an appropriate health professional that the serious harm test is met. The same Part works in the other direction too, and you should know about it: because I am not a health professional, paragraph 6 does not permit me to disclose health information to you by the formal route unless I have obtained an opinion from an appropriate health professional that the serious harm test is not met — except so far as I am satisfied that the information has already been seen by you or is already within your knowledge, which covers most of what is in your file, including everything you told me yourself. If that step were needed for anything else, such as my own observations, I would tell you so, explain why, and use the extra time the law allows if I had to. Second, where your record contains information about another identifiable person, I may have to remove or hold back that part (Schedule 2, Part 3). If either ever applied, I would tell you that something had been withheld and why, and you could complain about it — to me, or to the regulator.

When I reply, I will also remind you that you can complain to me if you are unhappy with how I have dealt with your request, and that you can complain to the regulator.

These are two things most people never need, and nobody enjoys thinking about. They are here because if either ever happened, you should be able to know now — while it is only a question on a page — what would become of what you told me.

If you were ever unable to make your own decisions

If a time came when you could not make decisions about your own affairs, Scotland has its own law for that — the Adults with Incapacity (Scotland) Act 2000. It is not the same as the English Mental Capacity Act, and English arrangements such as a Lasting Power of Attorney or a court-appointed deputy have no effect here. In Scotland the equivalents are a welfare attorney appointed by you under a registered welfare power of attorney, or a welfare guardian or intervener appointed by the sheriff.

If someone approached me on that footing, I would ask to see the registered power of attorney or the sheriff's interlocutor, check that it actually covers decisions of this kind, and share only what that authority allowed — applying the principles in section 1 of that Act, including taking account of your own present and past wishes. Losing capacity would not empty your file into someone else's hands.

If you died

Data protection law only protects living people, so the UK GDPR would stop applying to your record. My duty of confidence to you would not — in Scots law it survives death, and I would go on treating what you told me as confidential.

If your executor or a family member asked me for your records, I would not simply hand them over. The Access to Health Records Act 1990, which gives a personal representative limited access, applies to records made by a health professional, and as a counsellor I am not one within the meaning of section 204 of the Data Protection Act 2018. I would consider any request on its own facts, take advice if I needed it, and release only what I was satisfied was proper.

If you are unhappy with anything I have done with your personal information, please tell me. You have a legal right to complain to me directly, and I would much rather have the chance to put something right than have you leave it unsaid.

You can complain by emailing me at info@lknoxcounselling.com, by phoning me on 07411 740 415, or by writing to me at Studio 203, Old Embroidery Mill, Abbey Mill Business Centre, Seedhill, Paisley, Renfrewshire PA1 1TJ. Use whichever feels easiest. You do not have to use any particular wording — just tell me what has gone wrong, and what you would like me to do about it. The law also says I have to make complaining easy, and to offer a form that can be filled in electronically as well as on paper (section 164A(2) of the Data Protection Act 2018). I do not run an online form on this site, so just ask and I will send you one straight away — by email, as a document you can type into and send back, or on paper by post, whichever suits you. You do not have to use it at all: an email, a phone call or a letter counts every bit as much.

I will come back to you to say I have received your complaint — normally within a few working days, and in any event within 30 days, which is the limit the law sets me (section 164A of the Data Protection Act 2018). I will then look into it properly and tell you the outcome as soon as I reasonably can. If it is going to take a while, I will keep you posted rather than leaving you wondering.

Complaining to the regulator

If you are not happy with how I have dealt with it, you can take your complaint to the UK's data protection regulator, the Information Commissioner's Office. The ICO asks people to raise a complaint with the organisation first, so that it has the chance to put things right, and it will normally ask whether you have done that. But you do not have to wait for me. The ICO's own guidance is that you can complain to it at any point. If you do not feel able to raise it with me, go straight to them, and you never have to explain yourself to me to do so.

• Online: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• By post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Their Scotland office: Queen Elizabeth House, Sibbald Walk, Edinburgh EH8 8FT, scotland@ico.org.uk

On 30 September 2026 the office of the Information Commissioner is abolished and its functions pass to a new body, the Information Commission. The "ICO" name stays in use, anything already done by the Commissioner is treated as done by the Commission, and the way you make a complaint and all of the contact details above are unchanged.

One point of confusion worth clearing up: data protection law is identical across the whole United Kingdom, and the regulator for a Scottish practice is the ICO. The Scottish Information Commissioner deals only with freedom of information requests to public bodies, which does not apply to a private counselling practice like mine.

Complaining about my practice as a counsellor

If your concern is about my conduct as a counsellor rather than about your information, you can raise it with BACP, whose register I am on. My BACP membership number is 63792, which is how you can identify me to them. BACP also runs a service called Get help with counselling concerns for people who are unsure what to do. And you are always welcome to bring it to me first — I would rather know. If a complaint of that kind is made, BACP's process may require me to share my records of the work with them, including, where they are relevant, my session notes.

I work with adults and with young people aged 16 and over. If you are 16 or 17, the decisions on this page are yours to make. That is the law in Scotland from your sixteenth birthday — the Age of Legal Capacity (Scotland) Act 1991 — and in practice it means three things.

• You agree to counselling yourself. I do not need a parent's or carer's permission.
• Your information is yours. Under section 1(2) of the Children (Scotland) Act 1995, a parent's responsibility and right to direct you, and to act as your legal representative, ends at 16. Only the responsibility to offer you guidance continues until you are 18, and that carries no right to be told what we discussed. So a parent or carer has no automatic right to see your notes, to be told what we talked about, or to make decisions about your information on your behalf — and that stays true even if they are the one paying for your sessions.
• If you would like a parent, carer, teacher or anyone else involved in any way, that is entirely your call. I would need you to tell me so first.

Scotland gets here by a different route from England and Wales. There, section 8 of the Family Law Reform Act 1969 lets a 16- or 17-year-old consent to treatment, but full legal capacity for other purposes generally arrives at 18, and a person under 16 is assessed case by case. In Scotland the 1991 Act gives you full legal capacity at 16 for all purposes. And when it comes specifically to your information, Scotland has a separate rule of its own — section 208 of the Data Protection Act 2018 — under which a young person in Scotland is treated as able to exercise their own data protection rights once they have a general understanding of what that means, which is presumed from the age of 12. At 16 and 17 there is no question about it at all.

Two practical points. If a parent or carer arranges and pays for your sessions but is not part of our agreement, I still deal with you about your own information. And if you were under 18 while we worked together, I keep your records until your 25th birthday rather than for seven years, as explained above.

The limits on confidentiality further up this page apply to you in the same way as to anyone else. At 16 and 17 you sit in two places at once in Scots law: you are still a child for child protection purposes, because that guidance runs to 18, and you are already an adult for the purposes of the Adult Support and Protection (Scotland) Act 2007, which applies from 16. In practice that means a concern about your safety could go to social work at Renfrewshire Council by either route, or to the Principal Reporter. Either way the promise does not change: if I ever thought I had to tell someone something, I would talk to you about it first wherever it is safe to do so. I would not go behind your back.

I am based in Paisley and I practise under the law of Scotland. Scots law governs this policy and my working agreement with you, and the Scottish courts have jurisdiction — for most things that could realistically come up between us, that would be Paisley Sheriff Court, in the Sheriffdom of North Strathclyde, which serves Renfrewshire.

To be clear about what that does not mean: it does not shut any door to you. Data protection law gives you your own right to go to court (Article 79(1) UK GDPR), and in Scotland section 180 of the Data Protection Act 2018 means you may raise proceedings either in the Court of Session or in a sheriff court — the choice is yours, not mine. If you are a consumer, you cannot be made to raise or defend an action somewhere you do not live.

Nothing in this policy takes away any right you have as a consumer under the Consumer Rights Act 2015 or the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, both of which apply in Scotland. And nothing here stops you complaining to the Information Commissioner's Office instead of, or as well as, going to court.

The data protection law I follow is the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. That law is the same across the whole United Kingdom.

I last updated this page in September 2026.

I review it from time to time to check that it still describes what actually happens — which is the only thing a page like this is worth. If I change how I use your information, I will update this page, and where the change matters to you I will tell you about it before it starts rather than afterwards.

If you are working with me, I will also give you a copy of this at the start, and you are welcome to ask me about any of it at any point. If you would like it in larger print, or you would find it easier to talk it through with me rather than read it, just ask.