Privacy Policy

Cutting Edge Psychology Ltd

Last updated: 2 July 2026

1. Introduction

1.1 Cutting Edge Psychology Ltd ("we", "us", "our") is committed to safeguarding the privacy of visitors to our website, course participants, tutors, and licence holders.

1.2 This policy applies where we act as a data controller in respect of the personal data of our visitors, course participants, tutors, and licence holders — that is, where we determine the purposes and means of the processing of that personal data.

1.3 This policy is governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended from time to time.

1.4 We use cookies and similar technologies on our website. Except where a technology is strictly necessary for the operation of our website or the provision of our services, we will ask for your consent before using it. See Section 10 below for full details.

1.5 For information about who we are and how to contact us, see Section 14.

2. Credit

2.1 This document was created using a template from SEQ Legal (seqlegal.com) and subsequently amended for UK data protection compliance.

3. How we use your personal data

3.1 In this Section 3, we set out: (a) the general categories of personal data we may process; (b) the purposes for which we may process it; and (c) the legal basis for that processing.

3.2 Usage data. We may process data about your use of our website and services ("usage data"), including your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views, and navigation paths, together with information about the timing, frequency, and pattern of your use of our services. The source of the usage data is Google Analytics. This data is processed to analyse and improve the use of our website and services. The legal basis for this processing is our legitimate interests, namely monitoring and improving our website and services.

3.3 Service data. We may process personal data provided in the course of your use of our services ("service data"), including your name, email address, telephone number, employment details, qualifications, and certificates of attendance issued by us on completion of a course. The source of this data is you (and, in the case of certificates of attendance, us). It is processed to provide our services, administer courses, and evidence course completion. The legal basis is that processing is necessary for the performance of a contract between you and us, or to take steps at your request prior to entering into such a contract.

3.4 Special category data. Where you provide us with information about dietary requirements, or complete pre- or post-course questionnaire measures that record information about your mental or physical health, this constitutes special category data under Article 9 UK GDPR. We only process this data with your explicit consent, given at the time you provide it. You may withdraw this consent at any time by contacting us, though this will not affect the lawfulness of processing carried out before withdrawal. We use dietary information solely to make appropriate arrangements for your attendance (for example, catering), and questionnaire measures solely to evaluate and evidence the outcomes and effectiveness of our training, and do not use either for any other purpose.

3.5 Financial data. We may process invoicing, billing, and payment information ("financial data"). The source of this data is you. It is processed to administer payment for our services and to comply with our accounting and tax obligations. The legal basis is the performance of a contract and compliance with a legal obligation (see Section 6.5 for the retention period that applies to this data, which differs from our standard 12-month period).

3.6 Enquiry data. We may process information contained in any enquiry you submit to us regarding our goods and/or services ("enquiry data"), for the purposes of offering, marketing, and selling relevant goods and/or services to you. The legal basis for this processing is your consent.

3.7 Notification data. We may process information you provide when subscribing to our email notifications and/or newsletters ("notification data"), for the purpose of sending you those notifications and/or newsletters. The legal basis is your consent.

3.8 We may process any personal data identified in this policy where necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or an administrative or out-of-court procedure. The legal basis is our legitimate interests, namely the protection and assertion of our legal rights and the legal rights of others.

3.9 We may process any personal data identified in this policy where necessary for obtaining or maintaining insurance cover, managing risk, or obtaining professional advice. The legal basis is our legitimate interests, namely the proper protection of our business against risk.

3.10 We may also process personal data where necessary for compliance with a legal obligation, or to protect your vital interests or those of another person.

3.11 Please do not supply another person's personal data to us unless we have prompted you to do so.

4. Providing your personal data to others

4.1 We may disclose your personal data to our insurers and/or professional advisers, insofar as reasonably necessary for obtaining or maintaining insurance cover, managing risk, obtaining professional advice, or the establishment, exercise, or defence of legal claims.

4.2 We may disclose your personal data to our service providers, including Google (as provider of Google Analytics), insofar as reasonably necessary to provide our services. See Section 5 for information about international transfers arising from this.

4.3 We may disclose financial data to our accountants, auditors, and to HM Revenue & Customs and Companies House, insofar as necessary to comply with our accounting, tax, and company law obligations.

4.4 We may disclose your personal data where necessary for compliance with a legal obligation, to protect your vital interests or those of another person, or for the establishment, exercise, or defence of legal claims.

4.5 Except as set out in this policy, we will not disclose your personal data to third parties without your consent.

5. International transfers of your personal data

5.1 Some of our service providers (including Google Analytics) may store or process personal data outside the UK, including in the United States.

5.2 Where we transfer personal data outside the UK, we do so on the basis of one of the following safeguards, as applicable: (a) a UK adequacy regulation confirming that the destination country provides an adequate level of protection; (b) the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or (c) another lawful transfer mechanism recognised under the UK GDPR, such as the UK extension to the EU–US Data Privacy Framework (the "UK–US data bridge"), where the recipient is a certified US organisation.

5.3 You acknowledge that anonymised personal data you submit for publication through our website or services may be available, via the internet, around the world. We cannot prevent the use, or misuse, of such data by others once published.

6. Retaining and deleting personal data

6.1 This Section 6 sets out our data retention policy, designed to ensure compliance with our legal obligations regarding retention and deletion of personal data.

6.2 Personal data processed for any purpose will not be kept for longer than is necessary for that purpose.

6.3 Except where a longer period is set out elsewhere in this policy, we retain all categories of personal data described in Section 3 — including usage data, service data (including certificates of attendance and questionnaire measures), enquiry data, and notification data — for a period of 12 months from the date of collection, the date of your last interaction with us, or the withdrawal of your consent (as applicable to the category of data), after which it will be securely deleted or anonymised.

6.4 Notwithstanding Section 6.3, we may retain personal data for longer than 12 months where there is a substantive reason for doing so, including where retention is necessary for compliance with a legal obligation, to protect your vital interests or those of another person, or for the establishment, exercise, or defence of legal claims.

6.5 Financial data. By way of example of the substantive reason described in Section 6.4: we retain financial data, including invoices, for a period of 7 years from the end of the company financial year to which the record relates. This period reflects our obligations under the Companies Act 2006 and HMRC's record-keeping requirements for Corporation Tax and VAT purposes, and may be longer still where: a transaction spans more than one accounting period; the record relates to an asset expected to last more than 6 years; a return was filed late; or HMRC has opened a compliance check (in which case records are kept until the check concludes).

6.6 Certificates of attendance. If a professional or accrediting body that recognises our courses requires certificates of attendance or CPD evidence to be retained for longer than 12 months, we will retain that data for the period required by that body, as a substantive reason under Section 6.4.

7. Amendments

7.1 We may update this policy from time to time by publishing a new version on our website.

7.2 You should check this page occasionally to ensure you are happy with any changes.

7.3 We will notify you of significant changes to this policy by email.

8. Your rights

8.1 This Section 8 summarises your rights under UK data protection law. Some rights are complex, and not all detail is included here — you should refer to guidance from the Information Commissioner's Office (ICO) at ico.org.uk for a full explanation.

8.2 Your principal rights are:

• the right to access;

• the right to rectification;

• the right to erasure;

• the right to restrict processing;

• the right to object to processing;

• the right to data portability;

• the right to complain to the ICO; and

• the right to withdraw consent.

8.3 Right of access. You have the right to confirmation of whether we process your personal data, and, if so, access to that data along with certain additional information (including the purposes of processing, the categories of data concerned, and recipients). We will provide a first copy free of charge; further copies may incur a reasonable fee. Request a copy using our Contact Us form, providing the same email address you have used with us.

8.4 Rectification. You have the right to have inaccurate personal data corrected and incomplete personal data completed.

8.5 Erasure. In some circumstances you have the right to erasure of your personal data without undue delay, including where: the data are no longer necessary for the purpose collected; you withdraw consent; you object to the processing; the processing is for direct marketing; or the data have been unlawfully processed. This right does not apply where processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, or for the establishment, exercise, or defence of legal claims.

8.6 Restriction. You may request restriction of processing where: you contest the accuracy of the data; processing is unlawful but you oppose erasure; we no longer need the data but you need it for legal claims; or you have objected to processing pending verification. Where restricted, we may continue to store the data but will only otherwise process it with your consent, for legal claims, to protect another person's rights, or for important public interest reasons.

8.7 Objection. You may object to processing based on our legitimate interests or a public task, on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for legal claims.

8.8 Direct marketing. You have an absolute right to object to processing for direct marketing purposes (including related profiling). We will stop such processing on request.

8.9 You have the right to object to processing for scientific or historical research or statistical purposes, on grounds relating to your particular situation, unless the processing is necessary for a task carried out in the public interest.

8.10 Portability. Where the legal basis for processing is consent, or performance of a contract, and processing is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format, provided this does not adversely affect others' rights and freedoms.

8.11 Complaints. If you consider that our processing infringes data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint

• Telephone: 0303 123 1113

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

8.12 Withdrawing consent. Where our legal basis is consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8.13 You may exercise any of these rights by written notice to us using the contact details in Section 14, in addition to any other method specified in this Section 8.

9. Automated decision-making

9.1 We do not carry out any processing based solely on automated decision-making (including profiling) that produces legal effects concerning you or similarly significantly affects you.

10. About cookies and similar technologies

10.1 A cookie is a small file containing an identifier (a string of letters and numbers) sent by a web server to your browser and stored by it. The identifier is then sent back to the server each time your browser requests a page from it. Similar technologies (such as pixels and local storage) may operate in a comparable way.

10.2 Cookies may be "persistent" (stored until an expiry date, unless deleted sooner) or "session" (expiring when the browser is closed).

10.3 Cookies do not usually contain information that personally identifies you, but personal information we hold about you may be linked to information stored in or obtained from cookies.

11. Cookies we use

11.1 The table below sets out full details of the cookies used on our website.​