PRIVACY NOTICE
Updated to reflect Data (Use and Access) Act 2025 requirements
Introduction
This privacy notice outlines what will happen to your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Protection) Act 2025, which updates and clarified aspects of UK data protection law.
Related Privacy Notices
CPCAB has its own privacy notice which can be found on their website. Please ensure that you familiarise yourself with this.
How We Use and Share Your Personal Data
The Northamptonshire Centre for Counselling Studies (NCCS) will not pass your personal details onto any organisation or person unless there is a signed agreement with you to do so.
However, your name, date of birth and gender are required for CPCAB registration, and this information is inputted onto their portal in line with UK data protection law.
Data Storage and Security
Your personal details, along with any recorded information (e.g. tutorial records) will be stored electronically in password protected systems.
Data Retention Period
Data will be retained for three years after the end date of the course, after which it will be securely deleted.
Access to Your Personal Data
Should you wish to access your records, you may make a request in writing via email to your tutor.
In line with UK GDPR and the Data (Use and Access) Act 2025, requests will be handled without undue delay and within 30 days, unless an extension is legally permitted (for example, where clarification is required or requests are complex).
Your Data Protection Rights
You have the right to request that records are corrected or deleted, or to object to certain types of processing, where applicable. Any such request should be made in writing to your course tutor.
When We Make Seek External Guidance
Where relevant, we may seek guidance from CPCAB or appropriate professional bodies such as BACP or NCPS standards guidance) if:
-
A complaint is raised by a student, or
-
We become aware of potential ethical concerns or safeguarding issues.
Marketing and Mailing List Preferences
Once the course has finished, you may request to be added to our mailing list to receive information about future training courses. If you do not request this, you will not be added to our mailing list and your details will be deleted after three years in accordance with our retention policy.
Type of Information We Process
Personal information you provide may be used in several ways. The following is a broad description of how NCCS processes personal information.
We process personal information to:
-
Enable us to provide education and training to students
-
Promote our services (where consent or legitimate interest applies)
-
Maintain accounts and records
-
Support and manage staff and course delivery
-
All processing is carried out in accordance with UK GDPR principles, including data minimisation, accuracy storage limitation, integrity and confidentiality.
Information that we process includes:
-
Personal details
-
Training details
-
Education and employment details
Special Category (Sensitive) Data
We also process special category (sensitive) information where necessary, which may include:
-
Physical or mental health details
-
Racial or ethnic origin
-
Religious or other beliefs
-
Criminal offences and alleged offences (where relevant and lawful).
Such information is handled with additional safeguards under UK GDPR and the Data Protection Act 2018.
Sharing Information with Internal and External Parties
We may need to share personal information with other organisations where necessary, including CPCAB and relevant internal staff such as:
-
Centre Manager
-
Tutors
-
Internal Moderators
-
Internal Verifiers
-
External Verifiers
-
NCCS Clinical Supervisors
Where this occurs, we ensure that sharing is:
-
Lawful
-
Limited to what is necessary
-
Proportionate to the purpose
-
In line with data protection legislation, including DUAA 2025 principles of transparency and accountability
Online Learning and Email Communication
Most internal assessment is undertaken electronically, and student may be required to email work to each other over the duration of the course.
When signing up to any online learning platform, students consent to their email address being visible to others involved in the same course as part of the platform functionality.
Safeguarding and Legal Disclosures
If there is a safeguarding concern (including but not limited to legal obligations or imminent risk of serious harm, such as suicidal intent disclosure), information may be shared with appropriate external parties, which may include:
-
Emergency services (e.g. Police)
-
General Practitioners (GPs)
-
Safeguarding authorities or relevant professionals
Any such sharing will always be done on a lawful, necessary and proportionate basis.
Additional Information Sharing for Operational Needs
Information may also be shared to support learning and operational needs, including:
-
Discussing legal issues with a solicitor or relevant consultant
-
Discussing learning needs with specialists (e.g. dyslexia, hearing or visual impairments, or other disability-related needs)
-
Involving designation staff or external professionals in disciplinary, complaint or investigation processes
Data Protection Rights and Complaints
In summary under UK GDPR and the Data (Use and Access) Act 2025, students have rights including:
-
Access to personal data
-
Correction of inaccurate data
-
Restriction of objection to processing (where applicable).
-
Requests for deletion (where legally permitted)
Requests will be handled transparently, fairly and within statutory timeframes.
If you are unhappy with how your data has been handled, you have the right to:
-
Raise the issues internally with NCCS in the first instance
-
Escalate the matter to the Information Commissioner’s Office (ICO) if unresolved.
We aim to handle data protection concerns promptly and in line with DUAA 2025 expectations for accessible and clear complaints handling.