Last reviewed on 8 September 2026. The Westcountry Association for Counselling (WAC) is the controller of personal information handled through this website, its membership activities and WAC-run events. This notice applies to visitors, account holders, members, event attendees, professional-directory users, volunteers, committee and group representatives, event organisers and people who contact WAC.
How to contact WAC about privacy
Use the public contact form or, when signed in, open a Help & Support request and select the privacy or account category. Mark the request “Data protection”. This provides an auditable route to the appropriate WAC team without requiring personal information to be sent to an individual volunteer’s address.
Information WAC may collect
- Identity and account data: name, email, password hash, membership number, account status, roles, authentication and security records.
- Membership and professional data: plan, renewal and cancellation history, qualifications, registration details, verification evidence and professional-profile information.
- Contact and profile data: telephone number, correspondence or practice address, photograph, pronouns, biography, preferences and fields you choose to publish.
- Event and group data: bookings, attendance, ticket type, event interests, dietary or accessibility requirements, local-group membership and organiser information.
- Payment data: Stripe customer, subscription, invoice, payment-intent and refund references, amounts, card brand and last four digits. WAC does not receive or store a full card number or card security code.
- Communications: support tickets, inbound email, messages between members, feedback, notification choices and delivery events such as bounce, delivery or opening where the email service supplies them.
- Technical and usage data: IP address, browser/device information, security and application logs, page or profile views, sign-in history, realtime presence and cookie choices.
Why WAC uses information and its lawful bases
Providing an account, membership, booking or requested service — contract
WAC uses the information needed to create and secure an account, administer membership, take payment, issue an invoice, process a refund, manage bookings, deliver member communications and respond through the support desk. If required information is not supplied, WAC may be unable to provide that service.
Running and protecting the association — legitimate interests
WAC has legitimate interests in administering groups and committees, preventing misuse and fraud, maintaining service and audit records, measuring whether its services are useful, handling complaints and keeping members informed about operational matters. WAC considers the effect on individuals and does not use this basis where their rights override those interests.
Legal obligations and legal claims
Information may be used to meet tax, accounting, consumer-protection, equality, safeguarding and data-protection duties, respond to lawful requests and establish, exercise or defend legal claims.
Consent
WAC relies on consent where required, including optional newsletters, postal communications, publishing a professional directory profile and handling optional dietary, health or accessibility information. Consent can be withdrawn through account preferences or by contacting WAC. Withdrawal does not make earlier lawful processing unlawful.
Special-category and sensitive information
Dietary or accessibility details may reveal health or religious information. WAC requests only what is needed to make suitable arrangements and restricts it to relevant organisers or authorised staff. Credential documents and private support or member messages may also contain sensitive material. Do not include clinical information about a client or another identifiable person unless there is a lawful, necessary reason and WAC has expressly requested it. WAC is a professional association platform, not a clinical-record system or emergency service.
Public directory and member visibility
A professional profile is not published automatically. An eligible member must actively enable the directory, confirm publication consent and choose the fields made public. Public content can be indexed or copied by search engines and other people. Switching publication off removes it from WAC’s public directory, but WAC cannot immediately erase copies already made by an independent third party. Member-only profile fields follow the visibility choices shown in Profile Settings.
Where information comes from
Most information comes directly from you. WAC may also receive it from an event organiser or group representative, Stripe following a payment, Mailtrap following email delivery or inbound email, Twilio following an SMS, a qualification or registration body during verification, another member who contacts WAC, or technical systems that record use and security events. Where appropriate, WAC will tell you the source.
Who WAC shares information with
Access inside WAC is role-based. Authorised committee members, staff, volunteers, support teams, group representatives and event organisers receive only the information reasonably needed for their responsibilities. For example, an organiser may need an attendee list and agreed dietary or accessibility requirements, but not unrelated profile or payment data.
WAC also uses specialist processors and service providers, presently including Stripe for payments and invoices; Mailtrap for outgoing and inbound email; Twilio for configured SMS; Zoom for configured online meetings; hosting, storage and backup providers; and address, mapping or image-library providers where an administrator enables those integrations. Professional advisers, insurers, banks, auditors, regulators, courts, police or safeguarding bodies may receive information where necessary and lawful.
WAC does not sell personal information. Partner-event organisers act under their own legal responsibilities for information they collect independently outside WAC.
International processing
Some technology suppliers may process information outside the UK. Where UK data-protection law requires a transfer safeguard, WAC relies on an applicable adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. You may ask WAC for information about the safeguard relevant to your data.
How long information is kept
WAC keeps information only while needed for the purpose described, its governance and any legal, accounting, safeguarding or dispute requirement. Account and profile information is normally kept while the account is active. When a person requests account deletion, the account is deactivated for a 30-day recovery period; after that, the platform anonymises core profile and contact details and removes uploaded profile and credential files. Historical membership numbers, attendance, transaction and refund records may be retained in a minimised form where required for accounts, governance or legal claims.
Payment and invoice records are generally retained for the period required by UK tax and accounting rules. Security logs, delivery records, support cases, messages, consent records and backups are reviewed according to their operational, security and legal need; a record subject to a complaint, safeguarding matter, fraud concern or legal hold may be kept longer. When no longer required, information is deleted, anonymised or allowed to expire securely. You can ask for the retention criteria applying to a particular record.
Security
WAC uses access controls, encrypted connections, password hashing, protected credential storage, audit records, backups and supplier controls appropriate to the information handled. Full card details remain with Stripe. No online system can be guaranteed completely secure; suspected personal-data breaches are assessed and reported to affected people and the ICO when the law requires it.
Your rights
Depending on the circumstances, you may have rights to be informed; obtain a copy; correct inaccurate data; request erasure or restriction; object to processing based on legitimate interests or to direct marketing; receive certain data in a portable form; and withdraw consent. You may also ask for information about any decision made solely by automated means. WAC does not currently use solely automated decisions that produce legal or similarly significant effects.
You have the right to object to direct marketing at any time. Marketing and newsletter preferences can be changed in the dashboard. Operational messages needed for an active booking, account security, payment or membership may still be sent.
WAC may need to confirm identity before fulfilling a rights request and normally responds within one month. Some rights have legal exemptions; if WAC cannot comply fully, it will explain why and describe any right to complain.
Complaints
Please contact WAC first so the concern can be investigated. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes to this notice
WAC will update this page when its services, suppliers or legal obligations materially change. Important changes affecting members will also be communicated through the website, dashboard or email where appropriate.