PRIVACY NOTICE 

Horizons Therapy Limited ("we", "us", "our", “Horizons”) take the privacy of your information very seriously. We provide counselling and psychotherapy services and understand the sensitivities around the information you entrust with us. This Privacy Notice is designed to tell you about our data protection practices regarding the collection and use of your personal data. 

If you have any questions or concerns about the information in this privacy notice or need to contact us about any matters relating to your personal data, you can contact us in the following ways: 

Email: info@horizons-therapy.co.uk 

Post: Horizons Therapy Limited, Blue Pig Cottage, 1 Elmer Street North, Grantham, Lincs, NG31 6RE 

Unless stated elsewhere in this notice we are the data controller for the personal data we collect and use. We are registered with the UK Information Commission with the number ZB516287 and are a registered entity with Companies House in the UK with company number 14255221. 

We have identified the following ways you might interact with us. Please refer to the relevant section when reading this notice, you may be a: 

  1. Prospective Client – you have submitted an enquiry into our services, and we are actively engaged with you to establish if we are the right fit for your needs 

  2. Client – you have engaged with Horizons to provide you with one or more of our services within a contractual agreement you have with us 

  3. Job Applicant – you have applied for a job with us 

  4. Supplier – you are an employee of a service provider to Horizons 

  5. Website Visitor – anyone looking at this website  

What is Personal Data?  

Personal data is any information that can be used to identify you. We may create unique codes for you in our systems, so we reduce how easily you are identified. These codes are also considered to be personal data. We do our best to reduce anyone’s ability to know who you are unless they need to, as part of the work we are doing. 

What Personal Data do we collect and where do we get it from?  

If you are a Prospective Client or a Client, we collect your personal data directly from you which includes your name and email address, and any further confidential information you disclose to us while you review our suitability to provide you with our services, or when we work with you. As a client we will process your signature on our agreement, your bank details for the purpose of taking payment, next of kin information and any accessibility needs you may have if we will be meeting you in person as part of the service(s). 

Where you have applied for a job or work experience with us (Job Applicant) we will collect the following personal data. This list is non-exclusive: 

  • Contact details such as name, title, addresses, telephone numbers, and personal email addresses. 

  • Preferred method of contact, notice period, preferred start date. 

  • Copies of driving licence, passport, birth certificates and proof of current address, such as bank statements and council tax bills. 

  • Evidence of how you meet the requirements of the job, such as application forms, CVs, covering letters, references, assessment outputs, employment history, academic qualifications/history, professional training/certifications, skills, and work experience or internships 

  • Evidence of your current and/or future work eligibility status, immigration status, including visa type, and visa expiry date  

  • Diversity and equal opportunities monitoring information – this can include information about your race or ethnicity, religious beliefs, sexual orientation, disability and other ‘special category data’ information about your health, including any medical needs or conditions 

  • If you contact us regarding your application, a record of that correspondence including, but not limited to, the content and attachments of emails 

  • Details of your use of our recruitment tools and services, such as your candidate profile, the source of your application, the date/time, the role(s) you applied for, salary history/expectations, alerts for vacancies, the status of your application and updates on how it moves forward 

  • Derived data about you, that is, data that includes our staff’s opinion of you such as, but not limited, to the stages you complete of the recruitment process and those you do not, records of interviews, interview notes/feedback, assessment feedback, rejection stage, rejection reason, and job offer details 

As a Job Applicant may also collect, store and use the “special categories” of more sensitive personal information including, but not limited to: 

  • Information about your physical or mental health, or disability status 

  • Information about your health and medical conditions for health and safety reporting purposes 

  • Criminal records information 

  • Personal information related to the Equality Act 2010 inclusive of data known as ‘Protected Characteristics’ (age, disability, gender reassignment, marriage or civil partnership (in employment only), pregnancy and maternity, race, religion or belief, sex, sexual orientation) 

  • Personal information related to our internal equality and diversity monitoring policy (geographical location, organisation, socio-economic class, caring responsibilities, educational background) 

If you are an employee of a Supplier, we will be provided with your personal data from the organisation you work for or from a reference contact we may have if it is not directly from you. We will collect your name, job title, email address and the name of the organisation you work for. 

As a Website Visitor we will collect: 

  • Where you fill in a data capture form on the website we may collect, first name, last name, email address, reason for getting in touch with us and any further information you provide in a free-text box. 

  • If you make a purchase: First name, last name, billing address, delivery address, credit/debit card details. 

  • Information about the device used to access our website, your visits and use of the website including your IP address, internet log information, location, browser type and version, referrer and activity, and details of visitor behaviour patterns 

  • Your activity and preferences when visiting our website including through the use of cookies (see “Cookies”, below) 

  • IP address, operating system and browser information 

How we use your Personal Data and our Lawful Basis 

We will only use your personal data in a way that you expect us to use it. We will never sell your data or share it with anyone that you do not expect it to be shared with. We have aligned our uses to the lawful basis for your awareness as we’re required to do by UK law. 

Uses 

Lawful Basis  

Prospective Clients and Clients 

To engage with you as a potential client and provide you the services you purchase when you become a client. 

UK GDPR Article 6.1(b) where the use of your personal data is necessary in the performance of a contract and UK GDPR Article 9.2(h) “the provision of health treatment” for special category information such as health data in the provision of services. 

To send you client agreements and any relevant contractual updates. 

UK GDPR Article 6.1(b) where the use of your personal data is necessary in the performance of a contract. 

Manage session bookings including inviting you to attend sessions you have with us. 

To report to the appropriate authorities, who would be able to take action, any incidents of harm, child safeguarding, or concerns of crimes that may be witnessed or discussed.  

The lawful basis we will be relying on is that the processing is necessary for a task in the public interest, also known as ‘Public Task’ (UK GDPR Article 6.1 (e)). 

Special categories of personal data used for the purpose of Substantial Public Interest (Preventing or detecting unlawful acts; Protecting the public; Regulatory requirements) under UK GDPR Article 9.2(g).  

To help protect an individual from neglect or physical, mental or emotional harm, or protect the physical, mental or emotional well-being of an individual. 

To identify Personal Data and take relevant action upon submission of a data subject rights request.   

Processing is necessary for compliance with a legal obligation to which the controller is subject under UK GDPR Article 6.1(c).  

The legal obligation is the separate obligation under the UK GDPR to comply with the exercise by a data subject of their rights and the separate obligation on a controller to use personal data in a manner that ensures appropriate security.  

Special categories of personal data would be used for the purpose of Substantial Public Interest (Preventing or detecting unlawful acts; Protecting the public; Regulatory requirements) under UK GDPR Article 9.2(g). 

To be able to assess any impact on individuals of a Personal Data Breach 

To deal with any legal claims and any ongoing litigation cases.  

Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is the UK General Data Protection Regulation to uphold your data protection rights. Special categories of personal data used for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity under UK GDPR Article 9.2(f).  

Job Applicants 

Processing your data is necessary to move your application forward before signing a contract of work. This concerns employment or pre-employment checks 

The lawful basis we shall be relying in accordance with UK GDPR Article 6.1(b) where the use your personal data is necessary in the performance of a contract which you have agreed to or where we are working to enter into a contract with you. 

To ensure compliance with employment law. 

Compliance with a legal obligation under UK GDPR Article 6.1(c). The legal obligation is The Employment Rights Act 1996. 

To reply to you about the position you have applied for or inquired about. 

The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f). 

To approach you as a good fit for employment, work experience or internship. 

To inform you about the status of your application. 

To check you are the right candidate for the role. 

To receive a reference from a sectoral relevant individual where they have gained permission from you to be introduced to us 

To send you notifications for other job, work experience or internship vacancies. 

With permission, retain your personal information for longer statutory requirements where you have not been successful but would like the opportunity to invite you to apply again in the future. 

The consent you have provided us for this use of your personal data in accordance with UK GDPR Article 6.1(a). 

Suppliers 

Review your applicability to provide your services to us. 

The lawful basis we shall be relying in accordance with UK GDPR Article 6.1(b) where the use your personal data is necessary in the performance of a contract which you have agreed to or where we are working to enter into a contract with you. 

Conduct business operations with you including contract management. 

Resolve queries or complaints. 

Process your invoice and its payment. 

Establish, defend, or enforce legal claims or regulatory investigations. 

Compliance with a legal obligation under UK GDPR Article 6.1(c). 

Website Visitors 

Monitor the website and keep it secure, it helps us understand how we might improve the website through numbers of visits, visitor patterns and behaviour. 

The lawful basis we shall be relying on is the legitimate interest of the Data Controller in accordance with UK GDPR Article 6.1(f). 

Run our organisation, provide administration and IT services, ensure network security, and prevent fraud. 

Collect information to understand more about our stakeholders’ interests and preferences and to inform our marketing strategy. 

To keep our website updated and relevant, to develop our organisation, and to inform our marketing strategies. 

Answer any enquiries you submit to us via the website inclusive of information submitted via any webform, survey, poll or information capture on any part of the website. 

To add you to digital communications activities lists and send you content where you have indicated your consent for us to do so. 

The consent you have provided us for this use of your personal data in accordance with UK GDPR Article 6.1(a). 

Do we share your Personal Data with anyone?

We only share your personal data in ways that you would expect. We will never sell your personal data. Your personal data will be accessed by the relevant, qualified person at Horizons. We operate a least privilege access policy where only the specific people you are aware of are allowed access to your personal data. 

Your personal data will be used within secure digital service providers for client and other information storage, sending emails, requesting digital signatures, direct communications, video communication, processing payments, and managing the company. All third parties we work with are bound by data protection agreements we have in place with them. 

Where appropriate, we may share your personal information with our professional advisers including our lawyers and auditors where it is strictly necessary. It is also possible that we may be required to share your data to comply with applicable laws or with valid legal processes, such as in response to a court order. 

We may also share your personal data if we choose to transfer the management of the service you have with us to another therapist, or where the company merges parts of its business or sells its assets in the future. Or we may seek to acquire other businesses or merge with them. During any such process, we may share your data with other parties. We will only do this if they agree to keep your data safe and private. 

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded by implementing at least one of the following safeguards: 

  • Transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK (the UK also recognises the European Commission list of adequate countries. For further details, see European Commission: Adequacy of the protection of Personal Data in non-EU countries) 

  • Specific contracts/agreements approved by the UK which give personal data the same protection it has in the UK. For further details, see UK International Data Transfer Agreements. We will also assess in-country standards as part of this process. 

How long we keep your Personal Data?

Data shall be reduced, redacted, de-identified and deleted at appropriate times so we retain the minimum amount of data possible. Personal data that we use for any purpose will not be kept for longer than is necessary for that purpose.   

In some circumstances we will anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you. Notwithstanding the other provisions of this section, we will retain your personal data:  

  • To the extent that we are required to do so by law 

  • If we believe that the information may be relevant to any ongoing or prospective legal proceedings 

  • To establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk) 

  • If we believe we have an overriding legitimate interest in order to do this. This is particularly the case for the “right to erasure”, where we maintain a minimal amount of information on our records. 

When you submit a right to deletion request, we will delete you from any and all locations we hold your personal data where it would mean we may make contact with you again and we will retain your information if: 

  • It has been, or is being used within a complaints, disputes or grievance process by us and we may need to evidence this in the future to defend legal claims. 

  • We need to keep it to comply with a legal obligation. 

  • Erasing your data would prejudice scientific or historical research. 

  • There is information associated with your data which is of a safeguarding concern to yourself or others. 

  • Erasing will mean we lose our logs of when you made any data protection rights requests. 

  • Erasing will mean we are unable to understand if you have been a member in the past. 

Potential Clients and Clients:

Unless there is another legal reason to keep your personal data longer, in line with our practice policies and insurance requirements, your personal data will be retained securely for 5 years from the date you are no longer a client or you have stopped engagement with us, after which they will be securely destroyed. 

Job Applicants:

We will store your information for the duration of the recruitment process. Where you have not been successful, we shall retain your personal data for up to 6 months in accordance with the UK Limitation Act 1980. We will only retain your personal data longer than 6 months where we have gained your permission to do so.  

If you have been successful in the recruitment process, we will provide you with an Employee Privacy Notice outlining the retention period of your personal information. 

Suppliers:

As a representative of a Supplier, we retain your personal data for 7 years after your service has ended although may be longer if there are legal circumstances which mean we need to keep your personal data for longer. 

Website Visitors:

Depending on your reason for visiting the website and how you decide to interact with our website will determine the amount of time we retain your personal information outlined above. 

Cookies

As you interact with our website, we automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies to enhance your experience of our website. 

Our website uses cookies for collecting user information which may include IP address, operating system, and browser information. We use persistent cookies to track returning visitors. They expire after 12 months and enable us to compare website traffic from month to month. 

Cookies are text files, which identify a user’s computer to our servers. Cookies in themselves do not identify the individual user, just the computer used. You can learn more about cookies by visiting http://www.allaboutcookies.org/. 

You can manage and delete cookies through your web browser. Each browser manages cookies differently, but you can learn more about cookie settings in the most common browsers using the links below: 

You can also prevent your data from being used by Google Analytics by using the Google Opt-out Browser Add-on, available at this link. 

Your data protection rights

You have the following rights in respect of your personal data: 

  • Your right of access – You have the right to ask us for copies of your personal information. 

  • Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 

  • Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. 

  • Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

  • Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances including where we are processing your data based on consent. 

  • Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances. 

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. To express your rights contact us at: info@horizons-therapy.co.uk

Security of Your Data

We take the protection of your information extremely seriously. We use a combination of physical, technical, operational, and administrative safeguards to prevent unauthorised access, use, or disclosure of your personal data, as required by law and in line with recognised industry best practice. We regularly review these measures to ensure they remain effective and appropriate. Your information is protected by: 

  • Secure storage on encrypted servers 

  • Password-protected access restricted to authorised staff 

  • Encrypted payment processing for donations 

  • Regular security reviews 

However, no system is 100% secure. We cannot guarantee absolute security, but we implement industry-standard protections. 

How to Complain 

We have a complaints policy that you can find on this website. If you have concerns about how we use your personal data: 

  1. Contact us first at info@horizons-therapy.co.uk — we'll do our best to resolve any data protection concerns you may have 

  2. If you still have concerns after we have worked to resolve your concerns, you can contact the Information Commission via their website or by calling 0303 123 1113 

Changes to This Privacy Notice

We may update this notice from time to time. We will post changes on this page with an updated revision date. Significant changes will be communicated to you via email. 

Last updated: June 2026