This privacy policy applies to my website and website use. Visiting my website or contacting me through my online form does not constitute a therapist-client relationship. If we agree to work together, we will agree a mutually binding contract and I will provide my privacy policy for my therapy services at that time.

Who I am and how to contact me:

Hi, I’m Sophie Holdstock, the psychotherapist you’re interested in working with and the data controller for this website and the digital information I hold about you for my business.

I take your privacy seriously and if you have any questions or concerns please email me at sophieholdstocktherapy@gmail.com.

My website is hosted by Squarespace.

Squarespace collects personal information when you visit my website in order to run the site, and to protect and improve its platform and services. You can read more about how Squarespace uses your data for its own purposes in their privacy policy.

1. What personal data my website collects

1. Cookies

Squarespace uses cookies and similar technologies, which are small files or pieces of text that download to your device when you access my website. For information about viewing the cookies dropped on your device, you can check your cookies.

Some are necessary and required cookies that are always used, which allow Squarespace, my hosting platform, to securely serve this website to you. You cannot turn these off.

Others are analytics and performance cookies and are only used on this website when you acknowledge my cookie banner. My website uses analytics and performance cookies to view site traffic, activity, and other data as described below.

You can decline the use of these performance cookies by clicking the “decline all” button on my cookie banner, or by changing your cookie preferences. The “cookie preferences” tile can be found in the bottom left hand corner on any page.

2. Analytics (performance cookies)

If you consent to performance cookies, then my website will collect this personal information to power my site’s analytics, including:

• Information about your browser, network, and device

• Web pages you visited prior to coming to this website

• Your IP address

This information may also include details about your use of my website, including:

• Clicks

• Internal links

• Pages visited

• Scrolling

• Searches

• Timestamps

By providing this information to Squarespace, my website analytics provider, I learn about my site traffic and activity.

3. Contact form details

When you submit information to this website via the web form, I collect the data requested in the form in order to track and respond to your submissions. Squarespace, my website hosting provider, stores your name and email address so that they can help me manage my relationship with you. They do not store the content of your form submission.

The form is then emailed to my Gmail account, which is hosted by Google and subject to their privacy policy. Gmail is not end-to-end encrypted and Google has the capacity to read all content stored on their servers (see their privacy policy, heading “information we collect,” subheading “things you create or provide to us”). For this reason, please keep your form submission and emails brief with limited personal details.

2. How my website collects your personal data 

My website collects this information through:

1. Necessary cookies

2. Tracking technologies and performance cookies

3. Contact form submissions

When you visit my site the necessary cookies will start collecting data.

The performance cookies will only function if you consent to doing so.

Similarly, if you contact me via my web form you are consenting to your data being held in line with this privacy policy.

3. Why I collect and use this data

My website hosting provider, Squarespace, collects this information to securely serve my website to you. This enables you to see my professional psychotherapy services and to contact me.

In line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), the lawful bases for processing your information are:

1. Necessary cookies - legitimate interest, article 6(1)(f) of UK GDPR. I need my website to function in order to market my services to you.

2. Performance and analytics cookies - consent, article 6(1)(a) of UK GDPR. My website will only track certain technical information if you agree to doing so via my cookie consent banner.

3. Information from contact form submission - consent, article 6(1)(a) and legitimate interest, article 6,(1)(f) of UK GDPR. It is necessary for me to process your personal information in order to respond to any queries and discuss my professional services with you.

4. How long I retain your data

1. Necessary and required cookies - these cookies are sometimes per-session cookies, which means they are temporary and deleted after you close your browser. However, not all of them are. For a full list of cookies Squarespace uses and their retention period please check out their cookie policy.

2. Performance and analytics cookies - these can be stored for up to two years; some are only stored for 30 minutes. The complete list can be found in Squarespace’s cookie policy.

3. Contact form details - Squarespace does not store the content you provide in your contact form, however they do store your name and email address in my contacts list hosted on their server. These will be stored for as long as my website if functioning. If you would like your details removed from my contacts list hosted on Squarespace please email me at sophieholdstocktherapy@gmail.com.

The content of the form itself is emailed to my Gmail account, which is hosted by Google and subject to their privacy policy and retention periods. Please see reference to what they can access above.

If you end up becoming a client I will keep your contact form submission for seven years, in line with my legal obligation to my insurer.

If you do not become a client, I will delete your emailed contact form after six months, and I will delete your contact details from Squarespace.

5. Third-party sharing and disclosures

My website hosting provider, Squarespace, collects technical and browsing data from you when you use my website. Please see above for details about cookies, and see their privacy policy for more detailed information.

Google receives your data from your contact form submission. Please see their privacy policy for more information.

If you click on a third-party link, like Unsplash, you will be directed to that third party's site. I advise you to review the privacy policy of every site you visit.

6. International data transfers

Squarespace (Squarespace Inc, USA) and Google (Google LLC, USA) have servers based in the USA and may transfer your personal data outside the United Kingdom.

These companies meet the adequacy requirements of UK GDPR, and participate in the UK Extension to the EU-US Data Privacy Framework (DPF). This means they ensure a similar degree of protection is afforded to your personal data as in the UK, and they maintain active certification under the DPF and comply with its data protection principles. You can verify the certification status of my service providers on the Data Privacy Framework List.

7. Your rights and how to exercise them

You have the right to:

1. Be informed about how I am collecting and using your personal data.

2. Request access to receive a copy of your personal data. This is called a “subject access request” (SAR) and I have one month to respond to your query once your ID has been verified.

3. Amend or update your personal data if incorrect or incomplete.

4. Request deletion of your personal data.

5. Withdraw consent for data processing or restrict processing where applicable.

6. Reuse your personal data for your own purposes.

7. Object to the processing of your personal data.

8. Not to be subject to a decision based solely on automated processing, including profiling. I do not use automated processing.

For a complete list of your rights and to understand more fully the circumstances in which they will apply, please see the ICO website. Not all rights are absolute, and some only apply in certain circumstances.

8. Data protection complaints

If you have any concerns about my use of your personal information, you can make a data protection complaint to directly to me:

Email: sophieholdstocktherapy@gmail.com.

I will respond promptly, and under UK GDPR I must respond within 30 days.

If you remain unhappy with how I’ve used your data after raising a complaint with me, you can also complain to the ICO. 

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow, Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

9. Changes to this policy

This policy is version 1, uploaded to my website July 2026.