The Welsh Psychotherapy Institute (WPI) provides psychotherapy training and other psychotherapy and counselling services. It is an organisational member of the United Kingdom Council of Psychotherapy.

Psychotherapy, as a profession, has the principle of confidentiality at its heart. We take very seriously the safe keeping and processing of information about you that we hold as a result of our relationship with you; as a student, trainee, member of WPI, client, volunteer, employee or member of our freelance staff.

This policy sets out WPI’s commitment to making sure that that any personal data processed by WPI, including special category personal data, is handled carefully in compliance with data protection law.

This policy should be read alongside the following other documents:

• WPI 2020 2021 Handbook – Section 2
• Privacy Notice – General
• Privacy Notice – Student, Trainee, Professional Member
• Raising A Concern Pack

Policy Statement

This policy applies to all personal data processed by WPI and is part of WPI’s approach to compliance with data protection law including the General Data Protection Regulation and the Data Protection Act, 2018. All WPI staff and members are expected to comply with this policy and failure to comply may lead to disciplinary action for misconduct.

Terms used in this document

Personal data includes any information about you from which you can be identified.

special category personal data includes information about you that is particularly sensitive, which requires a higher level of protection. (For example health information or information about your race or ethnicity)

Data Controller is the name used in the General Data Protection Regulation to describe the person ororganisation that is responsible for your data. In this case the Data Controller is the Welsh Psychotherapy Institute. We are registered as a controller on the Data Protection Register. Our registration number is ZA543833.

Processing your data involves collecting, using, storing and transferring information about you.

Data Protection Principles

WPI complies with the data protection principles set out below. When processing personal data, WPI seeks to ensure that your data is:

• processed lawfully, fairly and in a transparent manner.
• collected for specified, explicit and legitimate causes.
• adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
• accurate and where necessary, kept up to date.
• kept in a form which would permit you to be identified for no longer than is necessary for the purposes for which the personal data is processed.
• processed in a manner that is appropriately secure, using both organisational and technical measures, and that protects against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Process/Procedures/Guidance

WPI will:

• ensure that the legal basis for processing personal data is identified in advance and that all processing complies with the law.
• not do anything with your data that you would not expect given the content of this policy and the fair processing or privacy notice.
• ensure that appropriate privacy notices are in place advising staff and others how and why their data is being processed, and, in particular, advising data subjects of their rights.
• only collect and process the personal data that it needs for purposes it has identified in advance.
• ensure that, as far as possible, the personal data it holds is accurate, or a system is in place for ensuring that it is kept up to date as far as possible.
• only hold onto your personal data for as long as it is needed, after which time WPI will securely
• erase or delete the personal data.
• ensure that personal data can only be accessed by those who need to access it and that it is held and transferred securely.

Special Category Personal Data

This includes the following personal data revealing:

• race or ethnicity
• political opinions
• religious or philosophical beliefs
• trade union membership
• health information, such as disability status or learning difficulty
• sex life or sexual orientation

There are a number of conditions that allow us to ask you for this category of information. Our privacy notice has more information about the grounds on which we ask for this information.

WPI Responsibilities

WPI will ensure that all staff who handle personal data on its behalf are aware of their responsibilities under this policy and other relevant data protection and information security policies, and that they are adequately trained and supervised.

Breaching this policy may result in disciplinary action for misconduct. Obtaining (including accessing) or disclosing personal data in breach of WPI’s data protection policies may also be a criminal offence.

We aim to communicate with you in ways that are intelligible and accessible and in a timely manner.

If you are unhappy with any aspect of our processing of your data, please raise the matter with us using the Raising A Concern pack. You also have the right to lodge a complaint with the Information Commissioner’s Office.

We are required to contact the Office of the Information Commissioner, if we believe the privacy of your data has been compromised.

You will find more information about the data we process, the legal basis on which we process it, and your rights in relation to your data in our Privacy Notices. For the Information Commissioner’s Office website, click here.

If you have any questions about the way we use your data, including any requests to exercise your legal rights, please contact WPI. Our Administrator will be pleased to help on 02920 396998.

Data Retention

WPI only hold onto your personal data for as long as it is needed, after which time WPI will securely erase or delete the personal data. We have an annual review of stored data, after which time, personal information that we no longer require will be securely deleted.

We retain your data as follows:

Applicants for courses – if you decide not to take up a place, or are unsuccessful in application, your data will be securely destroyed following our annual data storage review.

Students, trainees and professional members – while you are a member of WPI or while you have indicated that you wish us to retain your data. (This may be because you anticipate returning to training, or WPI membership or other professional membership in the future.) In general, your data will be retained for 6 years following your membership of WPI, with the exception of financial/contractual data which will be retained for 7 years.

Volunteers – while you volunteer or have indicated that you wish us to retain your data. (For example, because you anticipate volunteering with WPI in the future).

Employees – application and recruitment data for unsuccessful applicants will be securely deleted after 6 months or following our annual data storage review. Employee data will be retained for 6 years with the exception of pension data which will be retained for 12 years.

Freelance staff – application and recruitment data for unsuccessful applicants will be securely deleted after 6 months or following our annual data storage review. Freelance staff data will be retained for 6 years with the exception of contract data which will be retained for 7 years.

Clients – until your information is passed on to a WPI therapist, this may be a matter of days or weeks, rarely longer.

Associate practitioners – while you are an associate practitioner member of WPI, with the exception of contractual data which will be retained for 7 years.

Honorary members of WPI – honorary membership is a lifelong membership. We retain your data until you or your estate asks us to delete it.

Responsibility for the Processing of Personal Data

The directors of WPI take ultimate responsibility for data protection.

If you have any concerns or wish to exercise any of your rights under the GDPR, then you can contact the data protection lead in the following ways:

Name: Nicola Hinchcliffe

Address: 10 Park Grove, Cardiff.  CF10 3BN

Email: admin@welshpsychotherapy.org.uk

Telephone: 02920 396998

Monitoring and review
This policy was last updated on 3rd March 2021 and will be regularly monitored and reviewed, at least every two years.