Privacy Policy

1. Who We Are

SoulSpace Pastoral is a trading name of [legal business name — to be confirmed], registered in England and Wales.

• Data Controller: Zoe [surname — to be confirmed]
• Business Address: [to be confirmed]
• Email: [email protected]
• ICO Registration Number: [to be confirmed — registration in progress]

We are committed to protecting your personal information and being transparent about how we use it. This policy explains what data we collect, why we collect it, how we use it, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

2. What Data We Collect and Why

2.1 Enquiries and Contact Forms

When you complete a contact or enquiry form on our website, we collect your name, email address, phone number (if provided), and any information you provide in your message.

Why: to respond to your enquiry. Legal basis: legitimate interests.

2.2 Booking Appointments

When you book an appointment via our booking system (Calendly), we collect your name, email address, phone number (if provided), and any pre-session information you choose to share.

Why: to manage your appointment and send reminders. Legal basis: contractual necessity.

2.3 Client Records

For individuals receiving pastoral support, we hold contact details, notes from our sessions (see Section 4 — Special Category Data), and any information you share that is relevant to our work together.

Why: to provide effective pastoral support and maintain appropriate professional records. Legal basis: legitimate interests; and where relevant, your explicit consent.

2.4 School and Organisation Records

For school and organisational clients, we hold contact details of our primary contact(s), correspondence and project records, and any information shared during delivery of services.

Why: to deliver contracted services and maintain professional records. Legal basis: contractual necessity.

3. How We Store and Protect Your Data

Your information is stored on encrypted, password-protected systems, accessible only to the practitioner (Zoe) directly involved in your case, backed up securely, and never stored on unsecured personal devices.

Where we use third-party tools (such as Calendly for bookings, or Microsoft 365 for email), these providers are contractually required to handle data securely and in accordance with UK GDPR.

4. Special Category Data

Pastoral work may involve information about your mental or physical health, or the health of a young person you are supporting. Under UK GDPR, this is classified as special category data and receives additional protection.

We will only process this type of information with your explicit consent, or where it is necessary to protect your vital interests or those of another person.

Session notes containing health-related information are stored separately, with additional security measures, and are never shared without your consent (except where required by safeguarding duties — see Section 6).

5. How Long We Keep Your Data

After the relevant retention period, data is securely deleted.

6. When We May Share Your Information

We do not sell, rent, or share your personal information with third parties for marketing purposes. We may share information in the following limited circumstances:

Safeguarding: if we have serious concern that you or someone else is at risk of significant harm, we may share relevant information with statutory authorities (Local Authority Children's Social Care, police) without your consent. We would normally inform you before doing this, unless doing so would increase the risk of harm. This is a legal and professional duty.

Legal requirements: if required by law (e.g. court order or statutory authority).

Professional supervision: we receive regular professional supervision to maintain the quality and ethics of our practice. We may discuss anonymised case material with our supervisor, who is bound by confidentiality.

Service providers: we use a small number of third-party tools (e.g. Calendly, Microsoft 365), contractually required to handle data in accordance with UK GDPR.

7. Your Rights

Under UK GDPR, you have the right to: access a copy of the personal data we hold about you; rectification of inaccurate data; erasure of your data (subject to our safeguarding and legal obligations); restriction of how we use your data; portability of your data in a commonly used format; objection to processing based on legitimate interests; and to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email [email protected]. We will respond within one calendar month.

8. Cookies

This website does not currently set any non-essential cookies — no analytics or tracking is in use. If that changes in future (for example, adding site analytics), this policy will be updated first and a cookie consent option will be added before any non-essential cookie is set, in line with ICO guidance.

See our Cookie Policy for full detail.

9. Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, phone 0303 123 1113.

We would welcome the opportunity to resolve any concerns directly before you contact the ICO — please email us first at [email protected].

10. Changes to This Policy

We review this policy annually and whenever our practices change. The current version will always be available on our website. If we make significant changes, we will notify active clients by email.