GDPR Policy

Data Protection Information

Yorkshire Hypnotherapy Training (YHT) is a trading name of my company, Yorkshire Therapies & Training Ltd, which is registered with the ICO – https://ico.org.uk/ESDWebPages/Entry/ZA230146.

Yorkshire Therapies & Training Ltd (“we”, “our”, “us”) are committed to protecting and respecting your privacy. This privacy notice explains how we collect, use, and protect your personal data when you visit our website, sign up for our newsletter, or apply for a place on a practitioner training course.

The nominated Data Controller and Data Protection Officer is Debbie Waller who can be contacted via yorks.ht@btinternet.com or via the contact form on this website

1A. The Personal Data We Collect

From Website Visitors

• Contact Form Data: Your name, email address, and any message you type when you use our website contact form.
• Technical Data: IP addresses and cookies when you browse our website.

From Students

We collect and process personal data when you apply for a place on our practitioner course:

• Application forms: your name, contact details, emergency contact, your GP’s name and address, health information, medications, disabilities or other circumstances relevant to safe participation in practical activities or the provision of reasonable adjustments.
• Booking Information: Your name, email, phone number and any message you choose to send when you book a free Discovery call.
• Payment: name, email and payment history.

Newsletter Subscribers, and Requests for Free eBooks and Access to the Free Taster Course

• your name and email address.

2. Who Has Access To Your Data?

2A. Debbie Waller is the only person who has access to your data unless:

• you ask us in writing to share your information with someone else,
• a third party (for example, an employer) is paying all or part of your fees, in which case pre-arranged levels of information will be shared with these relevant parties,
• Debbie Waller is temporarily or permanently rendered incapable of acting (e.g., by ill health or death) in which case her therapeutic executor (David Waller) will be given access to your contact details. David Waller will only use this information to notify students, arrange for the secure transfer or destruction of records, complete any outstanding administrative tasks relating to the course, and otherwise administer the closure of the training practice.

2B. Sharing Information with Classroom Visitors and Other Students

• At certain points in the course, your written work and practical skills need to be assessed by someone other than your tutor. This is a requirement set out in the Hypnotherapy Training Standards. Your name will be shared with these guest tutors, along with any other information (such as reasonable adjustments) necessary to enable them to assess your work fairly and effectively.
• A list of students’ names and contact details will normally be shared within each class to enable students to keep in touch, arrange practice sessions, and support one another throughout the course. This information must be treated confidentially and not used for any other purpose. If you would prefer not to have your details included, please contact us.

2C Third party services:

We rely on trusted third-party providers to manage some services. These platforms act as “Data Processors.” Your data is handled according to their respective privacy policies:

• Our newsletter is administered via EmailOctopus. Their privacy policy is HERE.
• Stripe to process payments for fee payments made by credit/debit card. Their privacy policy is HERE.
• Our online forms are powered by Jotform and your form submissions are processed through their servers. Read their privacy policy HERE
• Our online calendar is powered by ZCal and they collect and store your name and contact details when you book an appointment. Read their privacy information HERE.
• If you contact us on social media your messages will be stored on their servers.
• Our accounts are kept on Zoho books, which stores your name, email address and payment history. Their privacy policy is HERE.

2D. Safeguarding and exceptions to confidentiality

We offer the same level of confidentiality to students as we do to therapy clients. Exceptions to the confidentiality rules are set out by hypnotherapy professional bodies under a provision called the ‘Duty of Care’. We may choose to reveal information about you to the appropriate person or authority if:

• there is a legal requirement to share information (for example, a court order or warrant is issued),
• there is good cause to believe that not disclosing information will expose you or others to a serious risk of harm (for example, if you are at risk from suicide or abuse, or taking part in serious law-breaking).

The Code of Ethics also allows us to share anonymous case histories verbally or in hypnotherapy publications for the purposes of supervision or training. Anonymous means your personal details are removed and small details about you are changed so that you cannot be recognised.

The Duty of Care provision applies to everyone, but you can opt out of the use of anonymised case material by dropping me an email.

3. Lawful Basis (How and Why We Use Your Data)

You are not obliged to provide us with personal information, but if you do not, we will not be able to communicate with you, process your application, or provide training services.

We only use your information for specific reasons, relying on the following lawful bases under UK GDPR.

• Contractual Necessity: We process your personal information to assess your suitability for training, arrange classes, maintain educational records, administer assessments, and provide you with the accredited training services you have requested. This may include sharing relevant information with guest tutors and assessors, where this is necessary to deliver the course and meet accreditation requirements.
• Criminal offence data: Information about unspent criminal convictions is collected only where necessary to assess suitability for training and the potential impact on future professional practice. This information is processed in accordance with applicable data protection legislation and retained only for as long as necessary.
• Consent
  • When you sign up for our newsletter, there is a double opt-in process, and you may unsubscribe at any time.
  • When you request a free eBook or access to the free Taster Course, you indicate consent on the request form.
  • When you indicate agreement on the practitioner application form, your name and contact details will be shared with other members of your class to facilitate peer support and the arrangement of practice sessions.
  • If you make a formal complaint, you will be asked to give consent for the information you provide to be used for the purposes of investigating and responding to that complaint. This includes sharing it with relevant parties during the investigation process.
• Explicit Consent: Where we process special category data, such as information about your physical or mental health, we do so with your explicit consent, obtained separately through our practitioner application process.
• Legitimate Interest (GDPR Article 6(1)(f)): If you contact us by phone, or through our website or social media, it is in our legitimate interest to use your contact details to reply. This is so that we can provide efficient customer service, manage client relations and handle incoming queries about our activities.

4. Data Retention (How Long We Keep It)

• Student records: application forms, payment details, attendance records, assessments, correspondence, and details of certificates issued are retained for seven years after the end of your course, after which they are securely destroyed.
• Administrative records, such as eBook requests and emails, for seven years after they are received.
• Newsletters: Your email address will be retained for as long as you wish to receive updates. If you unsubscribe, you will be removed from the active mailing list. Limited information may be retained where necessary to ensure that your unsubscribe request is respected.

5. Your Rights

Under UK GDPR, you have the following rights. You can read more about your rights on the ICO Website.

• To know what data we collect, how we use it and how long we keep it,
• To look at the data we hold about you,
• To ask us to correct mistakes,
• To ask us to delete your information, although there may be circumstances where we are legally entitled or professionally required to retain some records,
• To ask us to limit some of the ways we use your data,
• To ask us to share your data with another organisation,
• To object to us using your data in some ways, e.g. for direct marketing,
• Not to be subject to decisions based solely on automated processing.

To make a request, or if you have any questions about this privacy notice, please contact us.

6. Data Protection Complaints

If you have any concerns about the way we use your data, you may make a complaint.

Further Information

Further information about privacy is available in our cookie policy.

Updated June 2026 to include the provisions of the new rules in force from 16.6.26
Updated April 2026 to clarify details about student confidentiality
Updated October 2025 to reflect the change of newsletter provider from Mailchimp to Email-Octopus
Updated November 2023 to clarify the use of third-party services and add Z-Cal.
Updated August 2022 to remove references to NHS Test and Trace/COVID