Catherine Knibbs Ltd — covering Children and Tech and all clinical, supervision, training and consultancy services
Version 1.0 · Effective 20 June 2026 · Review date 20 June 2027 · Owner: Catherine Knibbs, CEO
Catherine Knibbs Ltd ("we", "us", "our") is the data controller for the personal information described in this policy. We provide trauma psychotherapy and clinical work, clinical supervision, training and courses (including through Children and Tech), and consultancy and advisory services.
This policy explains how we handle personal information for everyone we deal with, including: people who enquire about or use our therapy and supervision services; parents, carers and others acting on a child's behalf; participants in our courses and training; supervisees and Drop In Clinic members; organisational and consultancy clients and their staff; newsletter subscribers; and visitors to our websites and social media.
Depending on your relationship with us, we may collect:
Some of what we do — particularly therapy, clinical assessment and supervision — involves special category data, including health and mental-health information. We treat this information with particular care and confidentiality. We rely on:
Our work concerns children, and we sometimes process children's personal information — for example where a child is a client, or where a parent or professional shares information about a child. Where we do, we handle it with additional care, collect only what is necessary, and rely on an appropriate lawful basis and, where relevant, the consent or authority of a person with parental responsibility.
We collect information directly from you (when you enquire, book, attend, correspond, or use our sites); from people authorised to act for you, or who refer you (such as a parent, carer or another professional); and automatically through cookies and analytics when you use our websites.
We only use your personal information where the law allows. Our main purposes and lawful bases are:
| What we use it for | Lawful basis (UK GDPR) |
|---|---|
| Providing therapy, supervision, courses, consultancy and other services you request | Contract (Art 6(1)(b)); for health data, Art 9(2)(h) and/or explicit consent (Art 9(2)(a)) |
| Responding to enquiries and managing our relationship with you | Legitimate interests (Art 6(1)(f)) — running and improving our services |
| Taking payment and keeping financial records | Contract (Art 6(1)(b)); legal obligation (Art 6(1)(c)) |
| Meeting legal, regulatory and professional obligations, and keeping clinical records | Legal obligation (Art 6(1)(c)); Art 9(2)(h) |
| Safeguarding — acting where a child or adult may be at risk | Legal obligation / vital interests (Art 6(1)(c)/(d)); DPA 2018 Sch 1 safeguarding condition |
| Sending you our newsletter and updates | Consent (Art 6(1)(a)) — you can withdraw at any time |
| Keeping our websites secure and understanding how they are used | Legitimate interests (Art 6(1)(f)); consent for non-essential cookies |
Where we rely on consent, you can withdraw it at any time without affecting anything we did before you withdrew it.
We do not sell your personal information. We share it only where necessary, with:
Where a provider processes information outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law (such as UK "adequacy" regulations or the International Data Transfer Agreement/Addendum). Our website host and form provider, Netlify, Inc., is based in the United States, and enquiry and report-download submissions made through catherineknibbs.co.uk are stored on its infrastructure. Transfers to Netlify are covered by the safeguards described above. [Confirm the transfer mechanism in place with Netlify — UK Addendum/IDTA or the UK extension to the EU-US Data Privacy Framework — and list any other non-UK providers.]
We keep personal information only as long as we need it for the purposes above, or to meet legal, regulatory and professional requirements, and then securely delete or anonymise it. In particular:
We use appropriate technical and organisational measures to protect your information — including access controls, secure storage, encryption where appropriate, and confidentiality obligations on everyone who works with us.
Under UK data protection law you have the right to:
Some of these rights are qualified — for example, we may need to keep certain clinical or financial records to meet legal and professional obligations.
How to exercise your rights: contact us at [dataprotection@childrenandtech.co.uk]. We will respond within one month. Where a request is complex, or you have made several requests, we may extend this by up to two further months and will tell you if so. We will carry out a reasonable and proportionate search for your information, and we may ask you to confirm your identity first. These rights are usually free.
Our websites use cookies and similar technologies to work properly and to help us understand how they are used. You can control non-essential cookies through our cookie banner and your browser settings. [See our separate Cookie Policy for details / A full list of the cookies we use is available here.]
If you have a concern about how we handle your personal information, please tell us first so we can put it right — contact [dataprotection@childrenandtech.co.uk]. We will acknowledge your complaint within 30 days and keep you updated as we look into it, in line with our [Complaints Procedure].
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, although we'd appreciate the chance to help first:
We may update this policy from time to time. We will publish any changes here and, where they are significant, let you know. This version is dated at the top.
Catherine Knibbs Ltd (company no. 14647646) 3 West Parade, Wakefield, West Yorkshire, WF1 1LT · contact@catherineknibbs.co.uk childrenandtech.co.uk · catherineknibbs.co.uk