What Makes it Happen – Privacy Policy

Who is responsible for your information
Graham Barrone, trading as What Makes it Happen, is the data controller for personal information collected through this website and in connection with services provided.

You can contact me about your personal information through the contact details provided on the What Makes it Happen website.

Information I may collect
Depending on how you use the website or services, I may collect:

• your name and email address;
• your country or region;
• booking, appointment and payment information;
• messages or enquiries you choose to send;
• information you voluntarily provide before or during therapy, hypnotherapy, Past-Life Regression or Private Messaging;
• records reasonably necessary for providing and administering the service; and
• technical information generated when you use the website.

I aim to collect only information that is reasonably necessary for the purpose for which it is being used.

Sensitive and health-related information
Information shared in connection with psychotherapy or other therapeutic services may include information about mental or physical health and may therefore be treated as special-category personal data under UK data-protection law.

This information is processed only where necessary for providing the service and where there is an appropriate lawful basis and additional condition for processing special-category data under the UK GDPR and Data Protection Act 2018. ICO

Why I use your information
Personal information may be used to:

• respond to enquiries;
• arrange and manage bookings;
• provide the service you have requested;
• process payments, subscriptions and refunds;
• communicate with you about appointments or services;
• maintain appropriate professional and financial records;
• comply with legal obligations;
• protect the safety, security and legal rights of clients or others where necessary; and
• operate and improve the website and services.

For ordinary booking and administrative information, the lawful basis may include performance of a contract, compliance with a legal obligation and legitimate interests in operating the practice appropriately. Where consent is specifically relied upon, you may withdraw that consent at any time. The ICO requires organisations to identify both an Article 6 lawful basis and, where special-category data is involved, an appropriate Article 9 condition. ICO

Who information may be shared with
I do not sell your personal information.

Information may be processed by services used to operate What Makes it Happen, including:

• Wix, for the website, bookings, forms and payment administration;
• payment providers used to process transactions;
• Zoom, where sessions take place online;
• email, calendar or other technology providers used to administer services; and
• professional, legal or regulatory services where reasonably necessary.

Information may also be disclosed where required by law or where disclosure is reasonably necessary because of a serious risk of harm. Where practicable and appropriate, this would normally be discussed with you first.

International processing
Some technology providers may process information outside the United Kingdom. Where this occurs, appropriate safeguards required by applicable data-protection law are used by the relevant provider. Privacy information should identify international transfers and the safeguards used where applicable. ICO

How long information is kept
Personal information is kept only for as long as reasonably necessary for the purpose for which it was collected, taking account of contractual, legal, financial, insurance and professional-record requirements. Different types of information may therefore be retained for different periods.

Information that is no longer required will be deleted or securely disposed of where appropriate.

Security
Reasonable technical and organisational measures are used to protect personal information against unauthorised access, loss, misuse or disclosure. No internet-based system can, however, be guaranteed to be completely secure.

Your rights
Depending on the circumstances and applicable law, you may have rights to:

• request access to your personal information;
• have inaccurate information corrected;
• request deletion of information;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.

Some rights are subject to legal exceptions and will not apply in every circumstance. The ICO requires privacy notices to explain these rights and the right to complain. ICO

Complaints
If you have concerns about how your personal information is being handled, please contact me first so that I can try to resolve the matter.

You also have the right to complain to the UK Information Commissioner’s Office (ICO).

Changes to this policy
This policy may be updated from time to time to reflect changes in services, technology or legal requirements. The current version will be made available through the What Makes it Happen website.