Privacy Policy
This privacy policy explains how I, Gemma Spokes ("I", "me", "my"), trading as Gemma Spokes Counselling, collect, use and protect your personal information when you visit this website or contact me through it.
I comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025. More information can be found on the ICO website at ico.org.uk.
I am registered with the Information Commissioner's Office (ICO) as a data controller, and operate as a sole trader. I am a BACP Registered Member (417786 MBACP).
Policy overview
This policy explains what personal data this website and my practice collect, how it's used, how it's stored, and your rights under data protection law.
Personal data means any information that could identify you, for example your name, contact details, or health-related information you choose to share.
How to contact me
If you have any questions about this policy or your data, email me at hello@gemmaspokes.co.uk.
Website contact and enquiries
You can browse this website anonymously. If you use the "Contact Me" page or phone me to enquire or book a free call, you'll be providing personal data such as your name, email address, phone number, and anything else you choose to share in your message.
Please be aware that email and online forms are never completely secure methods of transmission. I'd recommend keeping anything especially sensitive for our phone call or a session, rather than putting it in an initial written enquiry.
I use this information only to respond to your enquiry and arrange appointments.
I use Gmail (provided by Google) for email communication. My email account is password protected and only accessed from password-protected devices that I own. Google's privacy policy can be found at policies.google.com/privacy.
Scheduling and phone contact
I arrange appointments either via the Contact Me page on this website or by phone. I don't currently use a third-party scheduling or booking platform. Any details shared with me this way (name, contact number, availability) are used solely to arrange your appointment.
How long I keep your information
Enquiry data (from people who contact me but don't go on to become clients): kept for 12 months, after which it's deleted.
Client records (once we begin working together): kept for 7 years after the end of our counselling work, in line with professional guidance from BACP and standard practice across UK counselling bodies, after which records are securely destroyed.
Cookies
This website uses cookies to improve your experience and may use analytics cookies to understand how visitors use the site. Cookies may collect your IP address, browser type, the pages you visit, and the date and time of your visit.
As required by law, this website displays a cookie banner so you can give or withhold consent before non-essential cookies are set. For more information on cookies generally, visit aboutcookies.org.
External links and third parties
This website may link to third-party websites, including my professional registration bodies. I'm not responsible for the content or privacy practices of external sites, and I'd recommend reading their own privacy policies before sharing any information with them.
Social media
I will never knowingly request personal or sensitive information from clients or potential clients via social media, and I won't use social media to seek information about clients. If you'd like to contact me, please use the details on this website rather than social media messaging.
Controlling your data
I will not sell, distribute, or lease your personal data to third parties, unless you've given permission or I'm legally required to do so.
Your personal data will only be shared with others:
With your clear, written consent (for example, to liaise with your GP or another professional)
Where I have a legal or professional duty to disclose it (for example, risk of serious harm to you or someone else, or a safeguarding concern)
Where I'm required to do so by court order
In such cases, I'll always aim to discuss this with you first, unless doing so would increase risk.
Your rights
Under UK GDPR, you have the right to:
Access the personal data I hold about you (a Subject Access Request)
Correct inaccurate data
Request erasure of your data ("right to be forgotten"), where applicable
Data portability — receive your data in a usable format, or have it transferred elsewhere
Withdraw consent at any time
To exercise any of these rights, email me at hello@gemmaspokes.co.uk. I'll respond within 30 days. If your request is unclear or very broad, I may need to ask for clarification before that deadline applies.
Complaints
If you're unhappy with how your data has been handled, you can complain to me directly at hello@gemmaspokes.co.uk, I'll acknowledge this within 30 days. You can also contact the Information Commissioner's Office on 0303 123 1113 or at ico.org.uk.
Last updated: 2 October 2026