Privacy policy

Draft — requires review by a UK commercial solicitor before live use.

This policy describes how information is intended to be handled, including once online purchasing is switched on. It has not been reviewed or approved by a solicitor and must not be described as legally approved, legally checked or professionally drafted. Passages marked ⚖ need that review most, and items in [square brackets] are placeholders that must be completed before publication.

Who is responsible for your information

The data controller is [registered trading name and legal status — sole trader or limited company, with company number if applicable], trading as Alexander Watson Studio, of [business address]. Contact: hello@alexanderwatson.co.uk. [Confirm whether ICO registration is required and, if so, add the registration number.] ⚖

I aim to collect as little personal information as possible, and to be specific about what happens to it. Your information is never sold, and it is never shared with third parties for marketing.

Information about your own therapy clients

I do not need, want or ask for any information about the people you work with. Please do not send client names, session notes, case material, referral details, correspondence or health information — not in your website copy, not in screenshots, not in testimonials, and not in anything attached to an email or a shared folder.

If identifiable client information reaches me by accident, I will tell you, delete it and confirm that I have done so. Where you want to publish a client's words, that person's clear, informed and recorded consent is your responsibility to obtain and to hold.

What is collected, and why

1. Enquiries

If you use the enquiry form or email me, you provide your name, email address and whatever you choose to tell me about your practice. The enquiry form on this website prepares a message in your own email application; it does not transmit or store anything on this website. I use enquiries to reply to you and to provide information you have asked for.

Lawful basis: your consent, and my legitimate interest in responding to people who contact my business.

2. Stripe checkout

If you buy the Therapist Website online, the payment is taken by Stripe Payments UK, Ltd. and its group companies (“Stripe”).

Card details are entered on Stripe's own secure payment page. They are never entered on, sent to, or stored by this website, and I never see them.
Stripe collects the details set out at its checkout — at present your name, business name, billing address, email address, your chosen website design and, optionally, your current website or profile address.
Stripe passes me the information I need to fulfil your order: typically your name, business name, billing address, email address, the amount paid, the date and those checkout answers.
Stripe acts as an independent controller of the payment information you give it, under its own privacy policy at stripe.com/gb/privacy.
The page you are returned to after checkout receives no payment information at all, and records nothing.

Lawful basis: performance of our contract; and my legal obligation to keep accurate financial records.

3. The Website Content Questionnaire

The questionnaire runs entirely in your browser and prepares an email in your own email application. Nothing you type into it is transmitted to or stored by this website. Once you send that email, I hold your answers and the materials you attach in my email account and project files, and use them only to build and support your website.

Lawful basis: performance of our contract.

4. Contract and project administration

During a project I hold our correspondence, your approvals, the scope and terms in force, drafts and revision rounds, and the files you supplied. This is how the project is run and how either of us can later show what was agreed.

Lawful basis: performance of our contract; and my legitimate interest in keeping a record of what was agreed and delivered.

5. Payment and accounting records

Invoices, receipts, and the record of what was paid and when are kept as business records.

Lawful basis: legal obligation (tax and company record keeping).

Who else handles your information

I use a small number of established suppliers to run the studio. They handle your information on my instructions, or as independent controllers where they are named as such.

Stripe — payment processing (independent controller for payment data).
Netlify — hosting of this website. Its servers produce ordinary technical logs, including IP addresses, for security and reliability.
Email and file storage — [name the email provider and any file-sharing or cloud storage service actually used, e.g. Google Workspace, Microsoft 365, Dropbox]. ⚖
Accounting — [name the bookkeeping or accounting software or accountant, if any].

Information is otherwise disclosed only where the law requires it, or where it is necessary to establish or defend a legal claim.

Where your information is held

Information is held in the United Kingdom and the European Economic Area where possible. Some suppliers, including Stripe, are international and may transfer information outside the UK. Where that happens, the transfer relies on the safeguards those suppliers put in place, such as UK International Data Transfer Agreements or the UK extension to the EU–US Data Privacy Framework. [Confirm the actual transfer mechanism for each supplier named above.] ⚖

How long information is kept

Enquiries that do not become projects — kept while a reply is useful, then deleted. [Confirm the period actually operated, e.g. 12 months.]
Project files and correspondence — kept for the life of the project and for a reasonable period afterwards so the website can be supported. [Confirm the period, e.g. 6 years from the end of the project, to match the limitation period.]
Payment and accounting records — kept for as long as tax law requires. [Confirm the statutory record-keeping period that applies to the business's legal form.]

⚖

Security

Accounts are protected with strong, unique passwords and two-factor authentication where the supplier offers it. Devices are encrypted and kept up to date. Access to project files is limited to me and to any specialist brought in for a specific piece of work, who is told what they may and may not see. [Confirm the security measures actually in place before publication; do not describe controls that are not operated.] ⚖

Cookies and analytics

This website sets no cookies of its own and uses no analytics, advertising or tracking. No analytics event is recorded anywhere in the purchase journey, including on the page you are returned to after checkout. If that ever changes, this notice will be updated before any such system is introduced, and consent will be sought where it is required.

Stripe's payment page is a separate website and sets its own cookies, which are necessary for it to take a payment securely.

External websites

Some pages link to other websites — Stripe, Counselling Directory, YouTube, LinkedIn, Instagram. Those websites have their own privacy policies, which are outside my control.

Your rights

You can ask me to:

give you a copy of the personal information I hold about you;
correct it, if it is wrong;
delete it, where there is no longer a lawful reason to keep it;
restrict or object to a particular use of it;
provide it in a portable format, where that right applies;
withdraw consent, where consent is the basis being relied on.

Email hello@alexanderwatson.co.uk and I will respond within one month. There is no charge for a reasonable request.

Complaints

If you are unhappy with how your information has been handled, please tell me first so I can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.

Contact

hello@alexanderwatson.co.uk

Draft version 0.1 — prepared 27 August 2026. Not legally approved, and not yet in force. Superseded versions are kept for reference.