Trust matters in every part of our work. This policy explains how we look after your information when you use our website, get in touch, or take part in therapy or training.
Who looks after your information?
Greyspace is the trading name of Greyspace Therapy Ltd. We are the controller responsible for the personal information described in this policy.
Greyspace Therapy Ltd
Company number: SC844995
54 St Quivox Road, Prestwick
South Ayrshire, KA9 1LU, United Kingdom
For privacy questions or requests, email hello@greyspacetherapy.co.uk.
What we collect
- Enquiries: your name, contact details, message and any details you choose to provide when asking about therapy or training. A brief outline is enough when you first get in touch—there’s no need to include detailed health information.
- Therapy and booking: your name, date of birth, contact details, booking and payment status, emergency contact details, relevant health or wellbeing information, information you share in sessions and brief counselling notes.
- Training: the organisation and contact person, course and venue or online delivery details, attendee names and contact information needed to administer a course, attendance, accessibility or participation requirements you choose to share, and anonymous feedback or evaluation responses. Please avoid including identifiable third-party health information in training discussions or feedback.
- Website use: technical information such as your IP address, browser, security logs and cookie choices. Optional statistics depend on your cookie preferences.
We usually receive this information directly from you through our contact form, therapy booking system, email or counselling sessions.
Private group training starts with a contact-form enquiry and later arrangements are agreed directly.
When an open session is available, you may book a place through an Eventbrite link on our website; Eventbrite collects booking and payment details through its own platform and may provide us with the information needed to administer your place.
If an organisation arranges training for you or someone refers you to us, we may also receive the details needed to respond or provide the service.
Why we use it
| Purpose | Usual lawful basis |
|---|---|
| Respond to your enquiry and arrange a service | Steps requested before entering a contract, or our legitimate interests in responding to business enquiries |
| Book and provide therapy to a client | Performance of a contract, or steps requested before one |
| Arrange and deliver training for an organisation | Legitimate interests in providing the agreed training and administering attendee information; a contract may apply to an individual booking their own place |
| Keep appropriate service records and manage safety | Legitimate interests in providing and managing a safe service; vital interests may apply in a genuine emergency |
| Keep accounting and tax records, or respond to a legal requirement | Legal obligation |
| Protect the website and remember your cookie preferences | Legitimate interests and, where relevant, compliance with legal obligations; optional cookies are used only where the required consent has been given |
Sensitive information
Information about health, mental wellbeing or other sensitive matters receives extra protection. In addition to a lawful basis above, we use the UK GDPR condition for health or social care where it applies to our confidential counselling work. If a training attendee shares health or accessibility information so that we can meet a request, we will identify an applicable additional condition for using that information, such as explicit consent when appropriate. We do not ask training participants to disclose health information unless needed for a specific purpose.
Agreement to receive therapy or training is separate from consent to optional marketing or cookies.
How we use and share information
We use your details to answer enquiries, arrange and deliver sessions or training, handle payments, keep proportionate records, respond to concerns and meet professional or legal obligations. We do not sell your personal data. We will not add you to marketing communications without the appropriate permission.
Who can access your information
Only people who need information to provide or administer a service can access it. This can include your counsellor, authorised Greyspace administrators and relevant training facilitators. A commissioning organisation may receive the booking and attendance information needed for its training, but not therapy records.
Training feedback and reports
We collect anonymous feedback to understand participants’ experiences and help improve our training. Organisations that commission training receive a report combining numerical results with analysis of written feedback. Reports do not identify individual participants. We remove identifying details from written comments before including them in reports.
The services we use
We use service providers for website hosting, contact forms, therapy booking (Bookly), therapy payments (Stripe), email and online meetings (Microsoft 365 and Teams), and cookie management (Complianz). Open training places may be booked through Eventbrite, which provides its own checkout and privacy information. These providers may process information needed for their role. Greyspace does not hold your full payment card number.
Confidentiality and safety
We do not record counselling sessions. Your counsellor keeps brief, confidential notes to support your therapy. Notes use a client code rather than your name and avoid unnecessary identifying details. They are stored securely.
Counsellors may discuss work in confidential professional supervision without unnecessary identifying details. Information may be disclosed when required by law, or where there is a serious concern about safety or safeguarding. Where appropriate and possible, we will discuss this with you first.
How we store and protect your information
We use access controls and appropriate security measures for our systems and records. Some technology providers may process information outside the UK. Where a restricted transfer occurs, we use an applicable adequacy arrangement or appropriate safeguards required by UK data protection law. Contact us if you would like more detail about a specific provider or transfer.
How long we keep it
We keep therapy records, including brief notes, for seven years after therapy ends under our current practice retention policy, then review them for secure deletion unless a longer period is needed for a specific legal or safeguarding reason.
Booking, payment and accounting records are kept for applicable financial and tax requirements.
Enquiry and training records are kept only for as long as needed for the purpose collected and any relevant legal or business record requirements. We review these periods as our services develop.
Your choices and rights
You have rights over your personal information. Depending on the circumstances, these include the right to:
- Ask for access to your personal information
- Have inaccurate or incomplete information corrected
- Ask for your information to be deleted
- Ask us to restrict how we use your information
- Receive information you have provided in a portable format, where this right applies
Your right to object
You can object to our use of your information where we rely on legitimate interests. We will consider your request and explain whether we have grounds to continue. You can object to the use of your information for direct marketing at any time.
Withdrawing consent and making a request
Where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of how we used information before you withdrew consent. Some rights have conditions or exceptions, which we will explain where relevant.
Email hello@greyspacetherapy.co.uk to make a request or ask us to explain your rights.
Our Cookie Policy explains website tracking and how to change cookie choices. You can complain to the Information Commissioner’s Office at any time. You are also welcome to contact us so we can try to address your concern.
Keeping this policy up to date
We may update this policy to reflect changes in our services or the law. The version on this page is the current one.
Last updated: 16 October 2026
