Privacy Policy

1. What information we collect

We collect personal information that you voluntarily provide to us and information that is automatically collected when you use our services.

Information you provide directly

• Identity data: first name, last name, and — for People Wellness services — age group.
• Contact data: email address.
• Professional data: organisation name, job function, and the nature of services required (Tech Enablement enquiries only).
• Wellness data: information you voluntarily share about your emotional wellbeing, type of grief support sought, and any personal circumstances shared during counselling or in contact forms (People Wellness services only).
• Communications data: the content of any messages, enquiries, or correspondence you send to us.

Information collected automatically

• Device and usage data: IP address, browser type and version, operating system, referring URLs, pages viewed, and time spent on pages.
• Cookie data: session identifiers and preferences stored by cookies. See Section 11 for details.

We do not collect payment card details, government identification numbers, biometric data, or precise geolocation data through our website.

2. How we collect information

• Contact and enquiry forms: when you submit an enquiry through our website, the data you enter is transmitted directly to our team via email.
• Email correspondence: when you contact us by email.
• Counselling sessions: during online People Wellness sessions, notes and records may be created by our qualified counsellors in accordance with clinical governance requirements.
• Website analytics: we use anonymised or pseudonymised analytics tools to understand how visitors use our website.

3. How we use your information

We use the personal information we collect for the following purposes:

• To respond to your enquiries and provide the services you have requested.
• To deliver and manage Tech Enablement services including staffing, support, and development projects.
• To provide People Wellness counselling services, including maintaining clinical records as required by professional standards.
• To send service-related communications necessary to fulfil your request.
• To improve our website, services, and user experience.
• To comply with our legal and regulatory obligations.
• To protect the safety and wellbeing of individuals engaging with our People Wellness services.
• To detect and prevent fraud, misuse, or unlawful activity.

We do not use your personal information for automated decision-making or profiling that produces significant legal or similarly significant effects without your explicit consent.

We do not sell, rent, or otherwise commercially exploit your personal information to third parties.

4. Legal bases for processing

We process personal information only where we have a lawful basis to do so. Depending on the context, the applicable legal basis may be:

• Consent: where you have given clear, informed consent for a specific purpose — for example, engaging with People Wellness counselling services or subscribing to communications.
• Contract performance: where processing is necessary to fulfil a contract with you or to take steps at your request before entering into a contract.
• Legitimate interests: where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Such interests include operating and improving our services, maintaining security, and communicating about our offerings.
• Legal obligation: where we are required to process information to comply with applicable law, professional regulatory obligations, or court orders.
• Vital interests: in rare circumstances where processing is necessary to protect the vital interests of a person — this may apply in the context of People Wellness services where there is a serious risk to life.

5. Sharing your information

We do not share your personal information with third parties except in the following circumstances:

• Service delivery partners: we may share information with carefully selected service providers who assist us in operating our business — for example, email hosting providers, video conferencing platforms, and clinical supervision services. All such sharing is governed by data processing agreements and is limited to what is strictly necessary. See Section 6.
• Professional supervision: People Wellness counsellors operate under professional supervision requirements. Case information may be shared with supervisors in an anonymised or pseudonymised form unless specific identification is essential.
• Legal requirements: we may disclose information where required by applicable law, regulation, legal process, or governmental request.
• Protection of rights: we may disclose information to protect the rights, property, or safety of OCIPO, our clients, or others, including exchanging information with other organisations for the purposes of fraud protection.
• Business transfers: in the event of a merger, acquisition, or sale of assets, personal information may be transferred to the successor entity, subject to the same privacy protections described in this policy.

We will never share your personal information with vendors, sub-vendors, or any third party for marketing, profiling, or any commercial purpose without your explicit, informed prior consent.

6. Vendors and sub-processors

OCIPO engages certain trusted third-party vendors and sub-processors to support the delivery of our services. These parties process personal data on our behalf and are bound by contractual obligations that require them to:

• Process personal data only on our documented instructions.
• Implement appropriate technical and organisational security measures.
• Not engage further sub-processors without our prior written consent.
• Assist us in responding to data subject rights requests.
• Delete or return all personal data upon termination of the engagement.
• Provide all information necessary to demonstrate compliance with applicable privacy obligations.

Personal information will only be shared with vendors or sub-vendors with your explicit consent, except where strictly necessary for delivery of a service you have requested, or where required by law. Where consent is the basis for such sharing, you retain the right to withdraw that consent at any time.

We maintain a register of our current sub-processors and will provide a copy upon request. Contact us at privacy[at]ocipo.com.

7. International data transfers

OCIPO may transfer personal information across international borders in the course of providing our services. Where such transfers occur, we ensure that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by relevant data protection authorities.
• Adequacy decisions recognising equivalent data protection standards.
• Binding corporate rules or other legally approved transfer mechanisms.
• Your explicit consent, where required and obtained.

We take care to transfer data only to countries or jurisdictions that offer an adequate level of protection, or where appropriate safeguards have been implemented. Information will not be transferred to third parties in other jurisdictions without the protections described in this section.

8. Data retention

We retain personal information for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, clinical, accounting, or reporting obligations.

• Tech Enablement enquiries: enquiry and contact data is retained for up to 3 years following the last interaction, unless a longer period is required for contractual or legal purposes.
• People Wellness clinical records: records related to counselling services are retained for a minimum of 7 years following the conclusion of services, in line with professional clinical governance standards. Records relating to children or young people are retained until the individual reaches the age of 25 years, or 8 years following the final session if later.
• Website analytics data: anonymised or pseudonymised analytics data is retained for up to 26 months.

When personal information is no longer required, we securely delete or anonymise it. If deletion is not immediately possible, we ensure the information is securely isolated from further processing until deletion is practicable.

9. Security of your information

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest where technically practicable.
• Access controls limiting personal data access to authorised personnel only.
• Regular security assessments and staff training on data protection.
• Incident response procedures for managing potential data breaches.
• For People Wellness services: additional safeguards appropriate for sensitive health and wellbeing data.

No method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals in accordance with applicable legal requirements.

10. Your privacy rights

Depending on your location and applicable law, you may have the following rights in relation to your personal information:

• Right of access: to request a copy of the personal information we hold about you.
• Right to rectification: to request correction of inaccurate or incomplete information.
• Right to erasure: to request deletion of your personal information in certain circumstances.
• Right to restrict processing: to request that we limit how we use your information in certain circumstances.
• Right to data portability: to receive your personal information in a structured, commonly used, machine-readable format.
• Right to object: to object to processing based on legitimate interests, or to direct marketing.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right not to be subject to automated decisions: not to be subject to decisions based solely on automated processing, including profiling, where such decisions have significant effects.
• Right to opt out of sale or sharing: we do not sell personal information; however, if applicable under the law of your jurisdiction, you may exercise this right by contacting us.

To exercise any of these rights, please contact us at privacy[at]ocipo.com. We will respond within the timeframe required by applicable law — generally within 30 days. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with a relevant supervisory authority or data protection regulator in your jurisdiction if you believe your rights have been infringed.

11. Cookies and tracking technologies

Our website may use cookies and similar tracking technologies. Cookies are small data files placed on your device. We use cookies for the following purposes:

• Strictly necessary cookies: essential for the website to function correctly. These cannot be disabled.
• Analytics cookies: anonymised or pseudonymised data used to understand how visitors use our website, in order to improve the experience.
• Preference cookies: to remember your settings and preferences.

We do not use advertising, retargeting, or cross-site tracking cookies. Where required by law, we will obtain your consent before placing non-essential cookies on your device. You may control or disable cookies through your browser settings, though this may affect the functionality of our website.

12. Children's privacy

Our website is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 through our general website. People Wellness services may be provided to children under 13 only with verifiable parental or guardian consent and in accordance with applicable law and clinical governance requirements. If you believe we have inadvertently collected information from a child, please contact us promptly at privacy[at]ocipo.com and we will take steps to delete the information.

13. Sensitive personal information

People Wellness services involve the collection and processing of sensitive personal information, including information relating to mental health, emotional wellbeing, and bereavement. We treat this category of information with the highest level of care. Such information is:

• Collected only with your explicit consent.
• Accessible only to the qualified counsellor assigned to you and, where necessary for supervision, in accordance with professional clinical standards.
• Stored with enhanced security controls appropriate for sensitive health data.
• Never used for commercial purposes, sold, or shared without your explicit prior consent except as required by law or to protect vital interests.

You have the right to withdraw consent at any time; however, please note that withdrawal of consent may affect our ability to continue providing People Wellness services.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by updating the effective date at the top of this policy and, where appropriate, by sending a notification to the email address associated with your account or services. We encourage you to review this policy periodically. Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated policy.

15. Contact us

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

We take all privacy enquiries seriously and will respond within the timeframe required by applicable law.