Who we are and how to contact us

Mark Butterton trading as Butterton Wellbeing is responsible for your personal information (the data controller). This policy explains how we use information when you visit buttertonwellbeing.com, enquire, book a call, receive support or pay for a programme.

For privacy questions, requests or complaints, email mark@buttertonwellbeing.com. You can also ask us for a postal contact address.

Information we collect

• Contact information: your name, email address and phone number.
• Enquiries and bookings: messages, appointment dates and times, and correspondence about your enquiry or support.
• Client support records: information you tell Mark about your goals, habits and circumstances, advice discussed and progress. This may include health information, such as medical conditions or medication, where relevant and with your explicit consent.
• Payment records: the programme purchased, agreed price, invoices, payment status, transaction references and refunds. When you pay through Stripe, we may receive billing details and limited payment-method information, such as card brand and last four digits. We do not receive your full card number or security code.
• Technical information: information such as IP address, browser details and server/security logs needed to operate and protect the website.

Most information comes directly from you through forms, calls, emails and your work with Mark. Payment providers also supply payment confirmations. Please provide only contact and appointment details when booking, and do not put medical information into the booking or contact forms or payment descriptions.

Why we use information and our lawful bases

• To discuss support you request, arrange calls, provide agreed programmes and handle related payments: steps at your request before entering a contract, or performance of our contract with you.
• To answer general enquiries, keep appropriate business correspondence, protect our systems and manage complaints or disputes: our legitimate interests in running a safe and effective business, balanced against your rights.
• To maintain records required by tax and other applicable law: legal obligation.
• To keep and use health information for suitable, consistent support: explicit consent under Article 9(2)(a) of UK GDPR, alongside the appropriate Article 6 basis above. We ask for and record this consent separately before keeping health notes.

We use contact details for your enquiry, appointments and agreed support. These communications are separate from marketing. Booking a call or paying does not sign you up to promotional emails or texts. We will seek any permission required before sending marketing, and you can ask us to stop.

Health information and your choices

Health information has extra protection under data protection law. We only keep relevant information needed for the support agreed with you. Please do not send detailed health records unless Mark has discussed why they are needed and how they will be handled.

You may withdraw your explicit consent by contacting Mark. This does not affect processing already carried out lawfully. We will stop using health information on that consent basis and explain what can be deleted and whether any limited record must be retained on another lawful basis and applicable special-category condition. Without the relevant information or consent, we may be unable to provide parts of the support safely or appropriately.

Who handles or receives information

Information is accessible to Mark and authorised service providers or support personnel only where needed for their role. The website uses WordPress, Simply Schedule Appointments for booking and WPForms for contact enquiries. Website hosting and business email are provided through Fasthosts. These systems handle form submissions, appointment details and messages as needed to deliver their services.

When we send a Stripe payment link or invoice, Stripe processes the payment. For a personalised invoice we provide the necessary client and billing details; a generic link does not itself require us to create a named invoice. Stripe also collects information directly during checkout and uses information for payment processing, fraud prevention and its legal obligations. Depending on the activity, Stripe acts as a processor and/or a separate controller. Read Stripe’s privacy policy.

We may also share necessary information with accountants, professional advisers, insurers or public authorities where needed for their work, a legal obligation or a legal claim. We do not sell your personal information. Health notes are not included in payment requests.

Processing outside the UK

Some service providers, including Stripe, may process information outside the UK. Where we arrange a restricted international transfer, we must use an applicable UK adequacy regulation or appropriate safeguards, such as approved contractual safeguards, together with any required assessment. Stripe describes its international transfers and safeguards in its privacy policy. Contact Mark for information about safeguards relevant to your information.

How long we keep information

• Enquiries that do not lead to a client relationship: 12 months after the last contact.
• Client support records: 6 years after support ends, unless an applicable insurer requirement or legal obligation requires a longer period. Health information is subject to the consent and lawful-retention rules described above.
• Invoices and financial records: for the period required by the tax and accounting rules applicable to the business.
• Technical and security records: only as long as needed to operate the service, investigate incidents and meet relevant obligations.

We may keep necessary records longer while a complaint, dispute or legal matter is unresolved. Records are deleted or anonymised when no longer needed; copies in backups are removed through the backup retention cycle.

Security

We use appropriate technical and organisational measures to protect personal information and limit access to people who need it. No online service or email system can guarantee complete security. Please do not email card details; enter payment information only into the secure payment provider’s checkout.

Cookies and external services

WordPress and website services use cookies or similar technologies for functions such as login, security and form operation. WordPress login cookies apply when signing into an account; ordinary visitors do not need an account to enquire or book. You can control cookies through your browser, although blocking necessary cookies may affect functionality.

Following a Stripe payment link takes you to Stripe’s service, which has its own privacy and cookie information. External sites linked from this website also have their own policies.

Your rights

Depending on the circumstances and lawful basis, you can ask to access your information, correct inaccurate information, erase information, restrict its use, or receive and transfer certain information in a portable format. You can object to processing based on legitimate interests and object to direct marketing at any time. Where we rely on consent, you can withdraw it at any time.

These rights are not absolute. Contact Mark at the email above to exercise them. We may need to verify your identity and will normally respond within one month; we will explain any lawful extension or reason a request cannot be fulfilled. We do not make solely automated decisions about access to our support that have legal or similarly significant effects.

Questions and complaints

Please contact Mark first so we can try to resolve any concern. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/ or by calling 0303 123 1113. You do not have to complain to us before contacting the ICO.

Changes to this policy

We will update this page when our practices change and bring significant changes to your attention where appropriate.