Privacy Policy — The Wayfinder Within

Compliant with the General Data Protection Regulation (GDPR) and Irish Data

Protection Law

1. Data Controller

The data controller responsible for your personal data is:

The Wayfinder Within

Elm Tree Clinic

Unit 6, Main Street

Oranmore

Galway

H92 F796

Email: [to be added]

2. What Personal Data I Collect

I collect and process the following categories of personal data:

 Contact information: name, phone number, email address

 Session information: appointment details, communication records

 Health-related information necessary for safe and effective hypnotherapy

 Consent forms for therapy, data processing, and (if applicable) working with minors

 Payment information processed securely via Stripe or Revolut (no card details

stored)

 Website and booking data submitted through Squarespace, Calendly, or Jotform

 Email subscription data collected via Squarespace or Mailchimp

Copilot may make mistakes

3. How Your Data Is Collected

Your data may be collected through:

 Online booking forms (Calendly)

 Website forms (Squarespace or Jotform)

 Email or phone communication

 In-person sessions

 Consent and intake forms

 Payment processors (Stripe, Revolut)

4. Why I Collect Your Data (Purposes of Processing)

Your personal data is used for:

 Providing hypnotherapy services

 Assessing suitability for therapy

 Managing appointments and communication

 Maintaining accurate clinical records

 Processing payments

 Sending updates or newsletters (only if you subscribe)

 Meeting legal and professional obligations

5. Lawful Bases for Processing

Under GDPR, I rely on the following lawful bases:

 Contract: processing necessary to provide the services you request

 Consent: for collecting health information, working with minors, and email marketing

 Legitimate interests: maintaining records, ensuring service quality, and managing

bookings

 Legal obligation: retaining records for required periods

Copilot may make mistakes

6. Working With Minors

I may work with minors on a case-by-case basis. In these cases:

 A parent or guardian must provide written consent

 All safeguarding requirements will be followed

 Garda Vetting and Tusla Children First training will be completed

7. How Your Data Is Stored

Your data is stored securely using:

 Encrypted laptop with password protection

 Google Workspace (email, documents, cloud storage)

 Physical notes stored in a locked cabinet

 Secure online platforms (Calendly, Stripe, Revolut, Squarespace, Jotform,

Mailchimp)

All third-party services used are GDPR-compliant.

8. Data Retention

To comply with professional and legal requirements:

 Adult client records are kept for 7 years after the final session

 Records for clients under 18 are kept until their 25th birthday

 Email marketing data is kept until you unsubscribe

 Payment records follow financial record-keeping laws

9. Sharing Your Data

Your data is never shared with third parties unless:

 You give explicit consent

 It is required by law

Copilot may make mistakes

 It is necessary to protect your vital interests

 It is required for professional supervision (always anonymised)

Third-party processors used include:

 Google Workspace

 Stripe

 Revolut

 Calendly

 Squarespace

 Jotform (if used)

 Mailchimp (if used)

These providers process data on my behalf under GDPR-compliant agreements.

10. International Data Transfers

Some third-party services may store data outside the EU. These transfers are protected

by:

 The EU-US Data Privacy Framework, or

 Standard Contractual Clauses (SCCs)

11. Your Rights Under GDPR

You have the right to:

 Access your personal data

 Correct inaccurate or outdated information

 Request erasure of your data (where legally permitted)

 Restrict processing in certain circumstances

 Object to processing based on legitimate interests

 Data portability (where applicable)

 Withdraw consent at any time

Copilot may make mistakes

 Lodge a complaint with the Data Protection Commission

12. Automated Decision-Making

I do not use automated decision-making or profiling.

13. Website, Cookies & Analytics

If you use my website:

 Squarespace may collect cookies and analytics data

 You will be informed via the website’s cookie banner

 You can manage cookie preferences at any time

14. Complaints

If you have concerns about how your data is handled, you can contact me at:

The Wayfinder Within

Email: [to be added]

You also have the right to contact:

Data Protection Commission (DPC)

www.dataprotection.ie

15. Updates to This Policy

This policy may be updated periodically. The most recent version will always be

available on my website.