What data do I keep and why do I need it?
Name, age– this is basic information that helps me get to know you.
Address, email address, phone number – I use this as a way of contacting you regarding your sessions. I will mainly use the method you first contacted me on but if I cannot reach you, I will try a different method.
Next of kin/medical professional’s details – If I was worried that you were at risk then I may need to contact your next of kin or medical professional, if I can. I will let you know when/if I am going to do this.
Session notes – I receive and store all information you provide to me
- during and after a session
- when you communicate with me by telephone, e-mail or otherwise
- when you fill out a questionnaire or any form for the purposes of your session(s).
- I also keep brief notes of our session(s) and recordings of our sessions.
Payment details - bank account information for the purposes of tracing and verification of payment.
What is the Purpose of processing your information?
We use the information we keep about you in the following ways:
- To protect your interests by sharing with you information you consciously revealed during our session
- To execute the agrrement between us
- Where the processing of your information is necessary for the purposes of my legitimate interests unless these interests are overridden by your interests and/or rights.
- In case we need to process your personal data for an additional specific purpose which will be communicated to you, we will contact you to give us your consent. If you have given your consent for us to process your personal data for a specific purpose, you have the right to withdraw at any time and we will stop processing your data for that purpose.
- To confirm your payment and send you an invoice and/or proof of payment
Will I share your data and if I do, who will I share it with and for what purpose?
It is very unlikely that I will share your data. I will not sell it on or use it for unethical reasons. I may have to share it if my notes are subpoenaed by court, if you or anyone you tell me about is at harm or risk of harm, I may have to pass this information on. I may also discuss your case during supervision, but I only use your first name. In addition to what is stated above, in the event that I need to share your personal data with third parties, I will notify you of this and you will have the opportunity to exercise your right if you accept that I transfer your personal data to these third parties.
How will I store your data?
It is mainly stored as hard copy in a locked filing cabinet. Immediately after the work is finished, I transfer the data with your initials to my password protected computer. Your phone number(s) may be kept in my business mobile phone with your first name and last initial. Only I will access your information.
How long will I store your data for and how will I dispose of it?
I will keep your details, session notes and recordings for 3 years after your last session. This is the time required by my insurer (currently 3 years).
After this time, I will destroy any document with your personal information or recordings of your session and delete your phone number out of my mobile phone.
Right to withdraw your consent
You have the right to withdraw the consent you have given me regarding the processing of your personal data at any time. Please note that any withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal by you.
Right of Access to information
You can request from me, by sending a message to the email address xxxxxxxxxxxxxxxxx, to inform you whether or not your personal data is being processed and to receive a copy of your personal data being processed. I will respond to your request and inform you of the actions taken within one (1) month from the day of receipt of the request. This deadline can be extended by two (2) more months if required.
In the event that you request to receive additional copies i reserve the right to charge an administrative fee.
Right of rectification
You have the right to request, via email to the email address xxxxxxxxxxxxx, the correction of inaccurate personal data and the completion of incomplete personal data. I may keep a copy of the information you have entered before it is updated by you. In the event of correction of your personal data, I will communicate this to each recipient (if any) to whom your personal data was disclosed, unless this is impracticable or involves a disproportionate effort. You can ask me to be informed about these recipients.
Right to delete your personal information
You have the right to request the deletion of personal data concerning you for any of the following reasons, by sending a message to
- the personal data are no longer necessary in relation to the purposes for which they were collected or processed other than those described in this policy, or
- wish to withdraw your consent to the processing of your personal data by me, or
- you object to the processing of your personal data for which you have given your consent or the processing is for the purposes of my legitimate interests and there are no compelling and legitimate grounds for the processing, or
- object to the processing of your personal data because the processing is for direct marketing purposes, or
- the personal data were processed illegally, or
- the personal data must be deleted in order to comply with a legal obligation under Cypriot Law
The deletion of your personal data will not be permitted to the extent that the processing of the data is necessary:
- for the exercise of the right to freedom of expression and the right to information,
- to comply with a legal obligation that requires the processing based on EU law or Cyprus laws or to fulfil a duty performed in the public interest,
- to establish, exercise or support legal claims.
I will respond to your request for erasure and inform you of the actions taken within one (1) month from the day of receipt of the request. This deadline can be extended by two (2) more months if required.
In the event of deletion of your personal data, I will notify each recipient to whom your personal data was disclosed, unless this is impracticable or involves a disproportionate effort. You can further ask me to be informed about the recipients in question.
Right to data portability
When you provide me with personal data, and I process that data by automated means you have the right to receive your data in a structured and machine-readable format for further private use
if such transmission is technically feasible.
The exercise of the above right should not adversely affect the rights and freedoms of third parties.
Right to object
You have the right at any time you decide to object to the processing of your personal data by me, for which you have given your consent or where the processing is for the purposes of my legitimate interests and there are no compelling and legitimate reasons for the processing which to override your interests and rights or to exercise, establish or support legal claims.
You further have the right to object to the processing of your data for direct marketing purposes, including profiling.
You can object to the processing of your personal data by sending an email to []
I will respond to your request and inform you of the actions taken within one (1) month from the day of receipt of the request. This deadline can be extended by two (2) more months if required.
Data Breach Notification
In the event that a breach of your personal data is detected which may put your rights and freedoms at high risk, I will inform you immediately and notify you of the following:
- the potential consequences of the breach of your personal data, and
- the measures taken or proposed measures to address the breach of your personal data and where appropriate measures to mitigate any adverse consequences.
I will not provide you with the above information if i:
- have implemented appropriate technical and organizational safeguards so that the data is not comprehensible to those who do not have access to it, or
- have taken such measures to ensure that a high risk to your rights and freedoms is no longer likely to arise, or
- requires disproportionate effort.
Right to lodge a complaint with the Supervisory authority
If you have any doubt or concern regarding the protection of your personal data please contact me first.If you would like to make a complaint about the way I handled your personal data, you can contact the Data Protection Commissioner. The contact details of the Data Protection
Commissioner's office are as follows:
1 Jasonos Street, 1082 Nicosia
P.O. Box 23378, 1682 Nicosia
Tel: +357 22818456
Fax: +357 22304565
Email: commissioner@dataprotection.gov.cy
