Data Protection Information

The CPD.expert website is provided by Yorkshire Hypnotherapy Training (YHT), which is a trading name of my company, Yorkshire Therapies & Training Ltd, which is registered with the ICO – https://ico.org.uk/ESDWebPages/Entry/ZA230146.

Yorkshire Therapies & Training Ltd (“we”, “our”, “us”) is committed to protecting and respecting your privacy. This privacy notice explains how we collect, use, and protect your personal data when you visit our website, sign up for our newsletter, or purchase a course.

The nominated Data Controller and Data Protection Officer is Debbie Waller, who can be contacted via debbie.waller@btinternet.com or via the contact form on this website

1. The Personal Data We Collect

From Website Visitors

We collect and process personal data when you interact with our website or services:

  • Contact Form Data: Your name, email address, and any message you type when you use our website contact form.
  • Technical Data: IP addresses and cookies when you browse our website.

From Those Making a Website Purchase

  • Payment: name, email, and payment history.
  • Postal address: from those purchasing a course with a hard copy certification.

From Supervisees

  • Booking Information: Your name, email, phone number and any message you choose to send when you book a free Discovery call.
  • New Supervisee form: Your name, email and phone number, along with details of your training, previous supervision and current supervision needs.
  • Payment: name, email, and payment history.
  • If you participate in professional supervision, additional information may be processed as part of the supervisory relationship. This may include details of your professional practice, reflective discussions, ethical dilemmas, and anonymised information relating to your clients.

2. Who Has Access To Your Data?

2A. Debbie Waller is the only person who has access to your data unless:

  • you ask us in writing to share your information with someone else,
  • you are undertaking a CPD course (for example, the Advanced Practitioner Course or the Advanced Anxiety Workshop) that is co-written or co-administered with someone else, in which case your name and contact details, along with coursework submissions, will be shared with these other individuals (co-tutors),
  • Debbie Waller is temporarily or permanently rendered incapable of acting (e.g., by ill health or death), in which case her therapeutic executor (David Waller) will be given access to your contact details. David Waller will only use this information to notify course participants and supervisees, arrange for the secure transfer or destruction of records, complete any outstanding administrative tasks relating to courses, and otherwise administer the closure of the training.

2B Third party services:

We rely on trusted third-party providers to manage some services. These platforms act as “Data Processors.” Your data is handled according to their respective privacy policies:

  • Our newsletter is administered via EmailOctopus. Their privacy policy is HERE.
  • Payhip to facilitate the instant delivery of courses purchased. Their privacy policy is HERE.
  • Stripe to process payments for fee payments made by credit/debit card. Their privacy policy is HERE.
  • Our online forms are powered by Jotform and your form submissions are processed through their servers. Read their privacy policy HERE
  • If you contact us on social media your messages will be stored on their servers.
  • Our accounts are kept on Zoho books, which stores your name, email address and payment history. Their privacy policy is HERE.

3. Lawful Basis (How and Why We Use Your Data)

You are not obliged to provide us with personal information, but if you do not, we will not be able to communicate with you, process your booking or enquiry, or provide the courses, supervision, or other services you have requested.

We only use your information for specific reasons, relying on the following lawful bases under UK GDPR.

  • Legitimate Interest (GDPR Article 6(1)(f)): If you contact us by phone, or through our website or social media, it is in our legitimate interest to use your contact details to reply. This is so that we can provide efficient customer service, manage client relations and handle incoming queries about our activities.
  • Contractual Necessity: 
    • We process your personal and financial information to deliver and administer the courses, supervision, and professional development services you purchase or book.
    • Co-tutors need to know your name and contact details, and see your submissions, to assess your work fairly and effectively.
  • Consent: Our newsletter operates a double opt-in process, and you may unsubscribe at any time.

4. Data Retention (How Long We Keep It)

  • CPD records: seven years after completion of the course.
  • Supervision records: seven years after the end of the supervisory relationship.
  • Newsletters: Your email address will be retained for as long as you wish to receive updates. If you unsubscribe, you will be removed from the active mailing list. Limited information may be retained where necessary to ensure that your unsubscribe request is respected.

5. Your Rights

Under UK GDPR, you have the following rights. You can read more about your rights on the ICO Website.

  • To know what data we collect, how we use it and how long we keep it,
  • To look at the data we hold about you,
  • To ask us to correct mistakes,
  • To ask us to delete your information, although there may be circumstances where we are legally entitled or professionally required to retain some records,
  • To ask us to limit some of the ways we use your data,
  • To ask us to share your data with another organisation,
  • To object to us using your data in some ways, e.g. for direct marketing,
  • Not to be subject to decisions based solely on automated processing.

To make a request, or if you have any questions about this privacy notice, please contact us.

6. Data Protection Complaints

If you have any concerns about the way we use your data, you may make a complaint.

The law is changing on 16th June, 2026. Until then, please contact https://ico.org.uk. 

After June 16th 2026, the following applies.

Company Name: Yorkshire Therapies & Training Ltd

This policy explains how you can submit a complaint to us if you believe we have mishandled your personal data or breached UK data protection laws (including the UK GDPR and Data Protection Act).

 

How to Make a Complaint

We want to make it as simple as possible for you to voice your concerns. You do not need to use formal legal language to file a complaint. You can reach out to us directly through either of the following channels:

 

Our Mandatory Response Timeline

Once we receive your data protection complaint, we will follow a strict, legally mandated response framework:

  • Acknowledgement (Within 30 Days): We will formally acknowledge receipt of your complaint within 30 days of receiving it.
  • Investigation: We will launch an internal enquiry into the matter without undue delay to understand what occurred and how to rectify it.
  • Progress Updates: If the investigation takes time (for example, due to technical complexity), we will provide you with regular, timely updates on our progress.
  • Final Outcome: We will write to you to explain the final outcome of our investigation, including any corrective actions taken, without undue delay.

 

Your Right to Escalate to the ICO

We are committed to working with you to resolve any data privacy complaints amicably. However, if you remain dissatisfied with our final decision, or if we fail to respond to you within the legal timeframes, you have the statutory right to escalate your complaint directly to the UK supervisory authority:

  • Authority: Information Commissioner's Office (ICO)
  • Website: ico.org.uk
  • Helpline: 0303 123 1113

Updated June 2026 to reflect changes in GDPR provisions

Updated April 2021 to reflect the addition of an e-commerce platform for automated course delivery after purchase.

Updated July 2025 to remove references to COVID-19 track and trace provisions.

Updated August 2025 to reflect the addition of online accounting to our admin systems.

More about privacy – our use of cookies