Privacy & Data Protection Policy

---

The Sand & Sound Centre is operated by me, Masha (Maria) Bennett, trading as Practical Happiness – Emotional Health Consultancy, a sole trader based in the United Kingdom.

I am registered with the Information Commissioner's Office (ICO) as a Data Controller (Registration Number: ZA196122) and process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection legislation.

1. Personal Information Collected

I may collect and process the following personal information:

• Name
• Email address
• Telephone number
• Postal address (where relevant)
• Information you provide when making enquiries or booking services
• Information relevant to therapy, training, workshops or other services provided
• Correspondence between us, including emails, text messages, WhatsApp messages and contact form submissions.

I only collect information that is necessary for providing my services, responding to enquiries, managing bookings, maintaining records, meeting legal obligations, and improving my services.

2. Lawful Basis for Processing

Under UK GDPR, I process personal data on one or more of the following lawful bases:

• Consent – where you have given permission for me to contact you or provide information.
• Contract – where processing is necessary to provide a service you have requested.
• Legitimate Interests – where processing is necessary for the operation and administration of my practice.
• Legal Obligation – where I am required to retain or disclose information by law.

Where special category data is processed (for example, information relating to physical or mental health), this is processed in accordance with Article 9 UK GDPR and relevant professional and legal requirements.

3. How Your Information Is Stored

Personal information is stored securely using password-protected devices, secure cloud services where applicable, and appropriate safeguards designed to prevent unauthorised access, loss, misuse, or disclosure.

I take reasonable steps to ensure that any third-party service providers used for storage, communication, scheduling or administration meet appropriate data protection standards.

4. How Long Information Is Retained

Personal information is retained only for as long as necessary for the purposes for which it was collected, including satisfying legal, regulatory, insurance, safeguarding, and professional requirements.

When information is no longer required, it will be securely deleted or destroyed.

5. Marketing Communications

If you choose to receive newsletters, updates or information about services, I will retain your contact details for this purpose until you unsubscribe or ask me to remove your details.

You may withdraw your consent to receive marketing communications at any time.

6. Cookies

This website may use cookies and similar technologies to improve user experience, analyse website traffic, and support website functionality.

Cookies are small files stored on your device. You can manage or disable cookies through your browser settings, although doing so may affect the functionality of certain parts of the website.

Where legally required, a cookie consent mechanism will be used to allow you to choose which cookies you accept.

7. Sharing Personal Information

Your personal information will not be sold or shared with third parties for marketing purposes.

Information may be shared only where:

• You have requested it/given consent;
• It is necessary for providing a service you have requested;
• I am legally required to do so;
• There is a safeguarding concern or serious risk of harm to yourself or others;
• Disclosure is required by a court order or other lawful authority.

8. Your Rights

Under UK GDPR you have the right to:

• Access the personal data I hold about you.
• Request correction of inaccurate information.
• Request erasure of your data in certain circumstances.
• Request restriction of processing.
• Object to certain forms of processing.
• Request transfer of your data where applicable.
• Withdraw consent where processing is based on consent.

Requests relating to your personal data can be made using the contact details provided on this website.

9. Data Breaches and Complaints

I take data protection seriously and have procedures in place to respond to any personal data breach.

If you believe that your personal information has been lost, disclosed, accessed without authorisation, or otherwise mishandled, please contact me as soon as possible via email admin@sandsoundcentre.co.uk

Any complaint will be investigated promptly and appropriate action taken. Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, it will be reported to the Information Commissioner's Office (ICO) in accordance with legal requirements.

If you are dissatisfied with how your personal data has been handled, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office (ICO)

Telephone: 0303 123 1113

I would appreciate the opportunity to address your concerns first, but you are not required to do so before contacting the ICO.

10. Changes to This Policy

This Privacy & Data Protection Policy may be updated from time to time to reflect changes in legal requirements, professional obligations, or business practices.

The most recent version will always be available on this website.

11. Contact Details

Masha (Maria) Bennett

admin@sandsoundcentre.co.uk

+44 (0)7887 617558

The Sand & Sound Centre

Digital House

35 Ridling Lane

HYDE

Greater Manchester

SK14 1NP