Privacy Notice, Cookie Information and Data Protection Information

New Horizon Training Academy and Lisa Williams Therapy.

Last reviewed: 1 June 2026.

This page explains how New Horizon Training Academy and Lisa Williams Therapy collect, use, store and protect personal information.

We are committed to treating your personal information with care, respect and confidentiality. We only collect personal information where there is a clear reason to do so, and we only use it in ways that are fair, lawful and transparent.

This notice applies to people who:

• Visit our website.
• Contact us with an enquiry.
• Book therapy with Lisa Williams Therapy.
• Book training, CPD or supervision with New Horizon Training Academy.
• Attend a workshop, course, supervision session or event.
• Communicate with us by email, text, telephone, online form, video call or social media.
• Provide feedback, testimonials or other information to us.

Who we are

New Horizon Training Academy is owned by Lisa Williams Edgar and Angie Hayes.

Lisa Williams Therapy is owned by Lisa Williams Edgar.

For the purposes of UK GDPR and the Data Protection Act 2018, Lisa Williams Edgar and Angie Hayes are the Data Controllers for New Horizon Training Academy.

Lisa Williams Edgar is the Data Controller for Lisa Williams Therapy.

This means that we are responsible for deciding how personal information is collected, used, stored and protected.

Contact details

New Horizon Training Academy.
Lisa Williams Edgar and Angie Hayes.
7 Westward Close.
Wrington.
North Somerset.
BS40 5LU.

Email: enquiries@newhorizontraining.co.uk.
Telephone or text: 07920 147101.
Website: www.newhorizontraining.co.uk.

Lisa Williams Therapy.
Lisa Williams Edgar.
7 Westward Close.
Wrington.
North Somerset.
BS40 5LU.

Email: enquiries@newhorizontraining.co.uk.
Telephone or text: 07920 147101.

If you have any questions about this privacy notice, or about how your personal information is handled, please contact us using the details above.

What personal information we collect

The personal information we collect depends on your relationship with us and the reason you are contacting or working with us.

We may collect and process some or all of the following information:

• Your name.
• Your email address.
• Your telephone number.
• Your postal address, where needed.
• Information you provide when making an enquiry.
• Information you provide when booking therapy, supervision, training, CPD or events.
• Information relating to attendance at training, CPD workshops, supervision or events.
• Payment and transaction information.
• Professional information, such as your role, qualification status, professional membership, training background or supervision requirements, where relevant.
• Therapy information, including initial consultation information, relevant background information and session notes.
• Health information, where this is relevant to the service being provided.
• Safeguarding information, where necessary.
• Information shared in emails, text messages, online forms, telephone calls, video calls or social media messages.
• Testimonials, feedback or evaluation comments, where you have chosen to provide them.
• Images, recordings or promotional material, only where this is relevant and appropriate consent has been given.
• Website usage information, such as cookie and analytics information.

We only collect information that is necessary for the service being provided, for our professional responsibilities, for legal or accounting requirements, or for legitimate business purposes.

Why we use personal information

We may use personal information to:

• Respond to enquiries.
• Provide therapy services through Lisa Williams Therapy.
• Provide clinical hypnotherapy, psychotherapy-informed support, supervision, CPD workshops and training.
• Manage bookings, payments, attendance and certificates.
• Keep appropriate client, supervisee, learner and business records.
• Meet professional, ethical, safeguarding and insurance responsibilities.
• Communicate with clients, students, supervisees and training participants.
• Provide information about relevant services, events or training, where appropriate.
• Improve our services, website and training provision.
• Manage feedback, testimonials, complaints or concerns.
• Meet legal, accounting, tax and regulatory obligations.
• Protect our legal rights and professional position if required.

We do not sell personal information to third parties.

Our lawful basis for using personal information

Under UK GDPR, we must have a lawful basis for using personal information.

Depending on the purpose, we may rely on one or more of the following lawful bases.

Contract. We use this when processing is necessary in order to provide a service you have asked us to provide. This may include therapy, supervision, training, CPD workshops, bookings, certificates and related administration.

Consent. We use this where you have given clear permission for a specific purpose. This may include receiving certain marketing communications, providing a testimonial, allowing an image or recording to be used, or giving permission for us to contact another professional on your behalf. You can withdraw consent at any time where consent is the lawful basis being relied upon.

Legal obligation. We use this where we need to keep or share information because the law requires it. This may include financial records for HMRC, safeguarding obligations, or responding to lawful requests from a court or other authority.

Legitimate interests. We use this where we have a legitimate business or professional reason to use personal information, provided your rights and freedoms are not overridden. This may include responding to enquiries, keeping appropriate business records, managing services, improving our website, maintaining professional records, and protecting our legal position.

Vital interests. We may use this where it is necessary to protect someone’s life or safety, for example in a serious safeguarding or emergency situation.

Special category information

Some information is more sensitive and is known as special category data. This may include:

• Health information.
• Mental health information.
• Information about race or ethnicity.
• Religious or philosophical beliefs.
• Sexual orientation.
• Other sensitive information that may be relevant to therapy, supervision, safeguarding or training contexts.

Where we process special category data, we only do so where there is a lawful reason and an additional condition under UK GDPR and the Data Protection Act 2018. This may include where processing is necessary for the provision of health or social care, therapy, supervision, safeguarding, legal claims, or where you have given explicit consent for a specific purpose.

Therapy, supervision and confidentiality

Information shared in therapy, supervision or training contexts is treated with care and confidentiality.

For therapy clients, brief and relevant records may be kept to support safe and effective work. These may include:

• Initial consultation information.
• Relevant background information.
• Contact information.
• Session notes.
• Correspondence.
• Consent forms.
• Safeguarding information, where relevant.

For supervisees, relevant supervision notes and professional records may be kept.

For learners and training participants, records may include:

• Booking information.
• Attendance records.
• Assessment information, where relevant.
• Certificate records.
• Portfolio or course information, where relevant.
• Correspondence.

Confidentiality may need to be broken in limited circumstances, including where:

• There is a serious risk of harm to you or someone else.
• There is a safeguarding concern.
• We are required to do so by law.
• A court, police warrant or other lawful authority requires information.
• Information is needed to protect our legal position.

Where possible and appropriate, we would aim to discuss this with you first.

Supervision

In order to maintain safe, ethical and professional practice, aspects of therapy work may be discussed in professional supervision.

Wherever possible, identifying details are not disclosed.

Supervisors are also expected to work within appropriate confidentiality, ethical and data protection requirements.

Contact with other professionals

We will not normally contact your GP, another therapist, healthcare professional, tutor, supervisor, professional body or any other third party about you without your knowledge and consent.

There may be exceptions where there is a serious safeguarding concern, serious risk of harm, legal obligation or other lawful reason.

Website visitors

When you visit our website, some information may be collected automatically by website systems, hosting services, analytics tools or cookies.

This may include:

• Your IP address.
• Browser type.
• Device type.
• Pages visited.
• Date and time of visit.
• How long you spend on the website.
• How you arrived at the website.
• General website usage information.

This information helps us understand how the website is used, monitor performance, keep the website secure and improve the way the website works.

Cookies

Our website may use cookies or similar technologies.

Cookies are small files placed on your device when you visit a website. Some cookies are necessary for the website to work properly. Others may help us understand how people use the website, improve the website, remember preferences or support analytics and marketing.

Where cookies are not strictly necessary, we will ask for your consent before using them.

You should be able to:

• Accept cookies.
• Reject non-essential cookies.
• Manage your cookie preferences.
• Change your cookie settings later.

You can also control cookies through your browser settings.

Analytics

We may use analytics tools, such as Google Analytics or similar services, to help us understand how visitors use the website.

Analytics information may include:

• Pages visited.
• Time spent on the website.
• Referral source.
• Approximate location.
• Device type.
• Browser type.

Where analytics cookies or similar technologies are not strictly necessary, these should only be used with consent.

Website hosting and security

Our website is hosted by a third-party website or hosting provider.

When you visit the website, technical information may be processed by the hosting provider in order to:

• Deliver the website.
• Monitor performance.
• Manage security.
• Resolve technical issues.
• Protect the website from misuse.

We expect any providers we use to handle personal information securely and in line with appropriate data protection requirements.

Payment information

Where payments are made for therapy, supervision, training, CPD workshops or other services, payment information may be processed by banks, card payment providers, booking platforms or other payment systems.

We do not usually store full card details ourselves.

Payment providers are responsible for processing payment details securely through their own systems.

Financial records are retained in line with legal and HMRC requirements.

Emails, texts and online communication

If you contact us by email, text message, online form, telephone, WhatsApp, social media or another communication method, we may keep a record of that communication where it is relevant to your enquiry, booking, therapy, supervision, training, complaint, safeguarding matter or our professional records.

Email and online communication are not always completely secure. Please take care when choosing what information to send electronically.

Where documents containing sensitive personal information are sent by email, we will take reasonable steps to protect them, such as using password protection where appropriate.

Social media

If you contact us through social media, comment on posts, send messages or interact with our pages, your information may also be processed by the relevant social media platform.

Please check the privacy information provided by the relevant platform to understand how they use your information.

We may respond to social media messages or comments, but we recommend that sensitive personal information is not shared publicly on social media.

Marketing and updates

We may send information about services, training, CPD workshops, supervision or related professional updates where you have asked to receive this, where you have booked with us before and the communication is relevant, or where there is another lawful basis to do so.

You can ask us to stop sending marketing or update emails at any time.

To opt out, please email enquiries@newhorizontraining.co.uk or use any unsubscribe option provided.

We will not sell your details to third parties for marketing purposes.

Testimonials, feedback and images

If you provide a testimonial, review, feedback comment, image or recording, we will only use it publicly where it is appropriate and where we have a lawful basis to do so.

Where consent is used, you can withdraw consent for future use at any time.

Anonymous feedback may be used for service improvement, training quality assurance or promotional purposes where individuals cannot reasonably be identified.

Children and young people

We may work with children and young people where this is appropriate and where suitable consent, safeguarding and confidentiality arrangements are in place.

If you are under 18, please ask a parent or guardian to contact us with you.

We will always aim to handle information about children and young people with particular care.

Parents, guardians and young people will be given appropriate information about confidentiality, safeguarding and records before work begins.

How long we keep information

We only keep personal information for as long as necessary.

Retention periods depend on the type of information, the reason it was collected, professional requirements, legal obligations, insurance requirements and safeguarding considerations.

As a general guide:

• Therapy client records are usually kept for 8 years after the final session.
• Records for children and young people are usually kept until their 25th birthday, or until their 26th birthday if they were 17 when therapy ended.
• Financial and tax records are usually kept for 6 years.
• Training, attendance, assessment and certificate records may be kept for as long as needed for accreditation, verification, quality assurance, insurance, professional or legal purposes.
• Supervision records may be kept for as long as needed for professional, ethical, insurance or legal purposes.
• Safeguarding records may need to be kept for longer where necessary.
• Complaints, incident records and insurance-related records may need to be kept for longer where necessary.
• Enquiry information that does not lead to a booking will not be kept longer than necessary.
• Marketing contact information will be kept until you unsubscribe or ask us to remove you, unless we have another lawful reason to retain limited information.

Where information is no longer required, it will be securely deleted, destroyed or anonymised.

How we protect information

We take reasonable steps to protect personal information from loss, misuse, unauthorised access, alteration or disclosure.

These steps may include:

• Password protection on electronic devices.
• Secure storage of electronic records.
• Password protection or encryption of sensitive documents where appropriate.
• Secure email and account access.
• Locked storage for paper records.
• Limiting access to personal information.
• Secure disposal of paper records by shredding.
• Secure deletion of electronic records.
• Reviewing privacy and data protection practices regularly.

No system can be guaranteed to be completely secure, but we take confidentiality and data protection seriously and aim to protect information with appropriate care.

Sharing personal information

We only share personal information where there is a clear and lawful reason to do so.

This may include sharing information with:

• Professional supervisors, where appropriate and usually without identifying details.
• Professional bodies, insurers or legal advisers, where necessary.
• Accreditation or awarding organisations, where relevant to training or qualifications.
• Payment providers, booking systems or accounting services.
• Website, email, IT or hosting providers.
• HMRC or other legal authorities where required.
• Safeguarding services, emergency services or healthcare professionals where there is a serious risk or safeguarding concern.
• A court, police authority or other body where legally required.

We do not sell personal information.

International transfers

Some third-party services, such as website platforms, email systems, analytics providers, booking systems, cloud storage or payment providers, may process information outside the UK.

Where this happens, we expect appropriate safeguards to be in place to protect personal information in line with UK data protection law. This may include adequacy regulations, approved transfer safeguards or other lawful mechanisms.

Your data protection rights

Under UK GDPR, you have rights in relation to your personal information.

These include:

• The right to be informed about how your information is used.
• The right of access to your personal information.
• The right to ask for inaccurate information to be corrected.
• The right to ask for information to be erased in certain circumstances.
• The right to ask for processing to be restricted in certain circumstances.
• The right to object to certain types of processing.
• The right to data portability in certain circumstances.
• The right not to be subject to automated decision-making, including profiling.

We do not use automated decision-making or profiling.

Your rights may depend on the type of information, the lawful basis being used and whether there is a legal, professional, safeguarding, insurance or clinical reason for keeping the information.

Subject Access Requests

You have the right to ask for a copy of the personal information we hold about you. This is called a Subject Access Request.

You can make a request by contacting:

Lisa Williams Edgar.
Email: enquiries@newhorizontraining.co.uk.
Telephone or text: 07920 147101.

We will usually respond within one month.

In some circumstances, where a request is complex, the response time may be extended as allowed by law.

We may need to confirm your identity before releasing information.

There is usually no fee for making a Subject Access Request. A reasonable fee may be charged only where a request is manifestly unfounded, excessive, or where further copies are requested.

Right to erasure

You can ask us to delete personal information we hold about you.

We will consider each request carefully.

In some circumstances, we may need to keep certain information because of legal, professional, safeguarding, insurance, accounting or legitimate record-keeping requirements.

If we are unable to delete some or all of the information, we will explain why.

Data breaches

A personal data breach is a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information.

If a data breach occurs, we will take steps to assess and manage the situation promptly.

Where required, we will report a personal data breach to the Information Commissioner’s Office within the required timescale.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay.

Complaints about how your information is handled

If you are concerned about how your personal information has been handled, please contact us first so that we have the opportunity to look into it and respond.

Please contact:

Lisa Williams Edgar.
Email: enquiries@newhorizontraining.co.uk.
Telephone or text: 07920 147101.

We will acknowledge your complaint and aim to respond clearly and fairly.

We will keep a record of data protection complaints and how they have been handled.

From 19 June 2026, organisations are required to have a process in place for handling data protection complaints. We will handle data protection complaints in line with current legal requirements and ICO guidance.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office.
Telephone: 0303 123 1113.
Website: www.ico.org.uk.

Changes to this privacy notice

This privacy notice may be updated from time to time to reflect changes in law, professional guidance, services, systems or business practices.

The latest version will be available on our website.

This version was last reviewed on 1 June 2026.

New Horizon Training Academy

Proprietor is Lisa Williams Edgar. Head Office, 7 Westward Close, Wrington, North Somerset, BS40 5LU. Web: www.newhorizontraining.co.uk. Tel: 07920 147101.

Equal Opportunities Policy

Purpose

New Horizon Training Academy is committed to ensuring equal opportunities for all, ensuring that the qualifications we offer are inclusive and accessible to learners.

All who represent New Horizon Training Academy are responsible for implementation of this policy. We believe that all members and learners have the right to be treated with dignity and respect regardless of their age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, ethnicity, religion or belief, sex, and sexual orientation. We will not tolerate unfair treatment or unlawful discrimination, whether intentional or unintentional, direct, or indirect.

Policy

New Horizon Training Academy is committed to The Equality Act 2010 by taking positive action to:

• Comply with current legislative requirements and monitor that this is adhered to
• Develop qualifications, support services and products which take into consideration the needs of all learners and do not unnecessarily discriminate against any individual or group
• Promote fair access to qualifications, minimising any barriers to access or assessment by implementing reasonable adjustments and special considerations policies
• Ensure that learning opportunities and fair assessment is open to all who will benefit without compromising the integrity of qualifications
• Ensure content and language of all written content, including assessment materials and programmes are non-discriminatory and free from any bias or stereotypical wording
• Monitor our qualifications, entry requirements and assessments to identify barriers to access or achievement and remove or minimise unnecessary barriers or bias which could impact on individuals or groups.

New Horizon Training Academy shall implement this policy through:

• Ensuring staff, members and learners have access to this information to assist them in planning, putting into practice and monitoring their rights and responsibilities under this policy
• Providing support and relevant training/updates for all staff, members and learners and revising any policy or practice that could disadvantage individuals or groups
• Ensuring all staff, members and learners know how to offer feedback and register complaints
• Effective complaints procedures which will be used to resolve complaints of discrimination with a full and prompt consideration under this policy, breaches of this policy will be dealt with through New Horizon Training Academy complaints procedures.

Monitoring and Review

This policy and its procedures will be reviewed regularly for improvements as part of our quality assurance requirements. This will ensure it is fit for purpose, reflects the services we deliver to our customers and that we provide services which are relevant to the requirements of individual needs. Regular reviews will ensure that we are adhering to our quality policy statement.

*Occasionally circumstances will arise which result in the need to cancel, reschedule or postpone an event, due to an unforeseen occurrence or Act of God. When this is the case New Horizon Training Academy shall assume no liability.

Other Documents Available

Further policy documents can be downloaded here:

• Code of Conduct
• Complaint Handling
• Equality, Diversity & Inclusion