Kipapa understand that your privacy is important to you and that you care about how your information is used and shared on and offline. We respect and value the privacy of everyone whom we provide services to (for example consult with) or who visits Our Website, and will only collect and use information in ways that are useful to you and in a manner consistent with your rights and Our obligations under the law.
This Policy applies to Kipapa’s use of any and all data collected by us (whether as a data controller or processor) in relation to the provision of our Services (such as your consultations with us), your use of Our Website and our Platform whether you are a User of Our Services (see Our applicable terms and conditions) or a visitor.
Please read this Privacy Policy carefully and ensure that you understand it. Your acceptance of this Privacy Policy is deemed to occur upon your first use of the Website and/or Platform or our Services
By providing Us with clinical or health data, you expressly agree to us processing that special category data (as described below).
If you do not accept and agree with this Privacy Policy, you must stop using our Services, the Website and/or Platform immediately.
We use Cookies on our website. Where those Cookies are not strictly necessary for the provision of our website and services, we will ask you to consent to our use of Cookies when you first visit our Website.
Definitions and Interpretation
In this Policy the following terms shall have the following meanings:
| “Cookie” | means a small text file placed on your computer or device by Our Site when you visit certain parts of Our Site and/or when you use certain features of Our Site. Details of the Cookies used by Our Site are set out below; |
| “GDPR” | Means the General Data Protection Regulations 2016, as amended from time to time, as appliable in the UK; |
| “Our Website” | means our website, www.kipapa.co.uk; |
| “Platform” | means collectively the online facilities, tools, services, and information made available to you on our Psynopsis platform; |
| “Services” | Means any clinical or professional services that we may provide to you and as described to you prior to any such service provision; |
| “UK and EU Cookie Law” | means the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended in 2004, 2011 and 2015; and |
| “Kipapa” | means Kipapa Ltd, a Limited Company registered under registration number 5279703, with a registered office and principal place of business at 48 Cleveland Square, London W2 6DB.. |
Our details
2.1 We are Kipapa Ltd, registered in England and Wales under registration number 5279703, and our registered office is at 48 Cleveland Square, London W2 6DB.
2.2 Our principal place of business is at Flat 3, 48 Cleveland Square, London, W2 6DB UK
2.3 You can contact us:
(a) by post, to the postal address given above;
(b) using our website contact form;
(c) by telephone, on the contact number published on our website from time to time; or
(d) by email, using the email address published on our website from time to time.
GDPR Compliance
3.1 Under GDPR we will ensure that your personal data is processed lawfully, fairly, and transparently, without adversely affecting your rights. We will only process your personal data if at least one of the following bases applies:
(a) you have given consent to the processing of your personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which you are a party or in order to take steps at the request of you prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which we are subject;
(d) processing is necessary to protect the vital interests of you or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; and/or
(f) processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
How we obtain and use your personal data
4.1 We comply with the General Data Protection Regulation (GDPR), we will tell you:
(a) the categories of personal data we may process
(b) the legal bases we may use for the processing of personal data;
(c) the purposes for which we may process personal data; and
(d) the sources of that data, in the case of personal data that we did not obtain directly from you.
4.2 We use Cognito Forms to securely collect and manage your personal information in compliance with GDPR. You can learn more about how Cognito Forms protects your personal information in the Cognito Forms Privacy Policy.
4.3 Some data will be collected automatically by Our website and Platform (for further details, please see below on Cookies that we use), other data will only be collected on the basis set out below in this section. Below is a summary of the types of processing of different types of personal data that we may carry out for different activities, and our Lawful Basis for doing so. See attached link for a detailed analysis of the relevant lawful basis http://www.kipapa.co.uk/gdpr-lawful-basis-table/.
4.4 We may process data about your use of our Website and services (“usage data“). This usage data may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as the timing, frequency and pattern of your service use. The source of this usage data is our Website analytics tracking system. This usage data may be processed to analyze use of the website and services. Our legal basis for this processing is our legitimate interest in monitoring and improving our Website and services.
4.5 We may process information contained in any enquiry you submit to us regarding goods or services (“enquiry data“). This enquiry data may be processed to offer, market and sell relevant goods or services to you. Our legal basis for this processing is your consent.
4.6 We may process information that you provide to us when subscribing to our email notifications or newsletters (“notification data“). This notification data may be processed to send you the relevant notifications or newsletters. Our legal basis for this processing is your consent.
4.7 We may process information that you post for publication on our Website or through our services (“publication data“). This publication data may be processed to publish and administer our website and services. Our legal basis for this processing is our legitimate interest in the proper administration of our Website and business.
4.8 If you open an account with us as part of our contract with you, we will process your account data (“account data“). This account data may include your name, email address, home address, telephone number, insurance policy and authorization numbers, NHS number, and other identification numbers. The source of the account data may be you, or the person or organization who referred you. Your account data may be processed to operate our Website, provide our services, ensure the security of our Website and services, maintain back-ups of our databases, communicate with you, and communicate with the person or organization who referred you to us. Our legal basis for processing is to perform of a contract between you and us or take steps, at your request, to enter into such a contract.
4.9 We may process information contained in or relating to any communication that you send to us (“correspondence data“). This correspondence data may include the content of the communication and metadata associated with the communication. Our website will generate the metadata associated with communications you make using the Website contact forms. This correspondence data may be processed to communicate with you and keep records. The legal basis for this processing is our legitimate interest in the proper administration of our website, communications and business.
4.10 We may process information relating to transactions, including purchases of goods or services that you enter into with us, whether through our Website or through other means (“transaction data“). This transaction data may include your contact details, payment card details and transaction details. The transaction data may be processed to supply the purchased goods and services and keep proper records of those transactions. The legal basis for this processing is to pursue our legitimate interest in the proper administration of our website and business, as well as to perform a contract between you and us, or to take steps, at your request, to enter into such a contract.
4.11 We may process information relating to our client relationships, including client contact information (“client relationship data“). This client relationship data may include your name, your job title or role, your contact details, and information contained in communications between us and you. The source of this client relationship data may be you, or the person or organization who referred you to us. This client relationship data may be processed to manage our relationships with you, communicate with you, keep records of those communications and promote our products and services to you. The legal basis for this processing is our legitimate interest in the proper management of our client relationships.
4.12 We may process the information included in your personal profile (“profile data“). This profile data may include your name, address, telephone number, email address, gender, date of birth, relationship status, interests, preferences, education and employment. This profile data may be processed to enable and monitor your use of our Website and services. The legal basis for this processing is to perform a contract between you and us or take steps, at you request, to enter into such a contract.
4.13 We may process personal data you provide during your use of our Services (“service data“). Our services may include without limitation coaching, counselling, psychological psychotherapy, professional supervision or training. This service data may include information about your attitudes, behavior, beliefs, career, circumstances, education, family, friends, habits, history, interests, motivations, personality, preferences, problems, solutions, and relationships. This data may be processed to provide you with our services. If the source of the service data is you or your referrer, then the legal basis for processing is to perform a contract between you and us or take steps, at your request, to enter into such a contract. If the source of the service data is other people or organisations, then the legal basis for this processing is your consent.
4.14 We may process what the GDPR refers to as “special category data” provided during your use of our services. This data may include your race, ethnic origin, politics, religion, trade union affiliation, genetics, health, sex life or sexual orientation. The source of this special category data may include you, your referrer, or other people or organizations. This special category data may be processed to provide you with our Services. The legal basis for this processing is to perform a contract between you and us or to take steps, at your request, to enter into such a contract, on condition that this processing is necessary for preventive or occupational medicine, for the assessment of your working capacity as an employee, for medical diagnosis, for the provision of health or social care or treatment or for the management of health or social care systems and services.
4.15 Where we process special category data (as defined by the GDPR) (also known as “Sensitive Data”), We only process that data in accordance with this clause and in accordance with an additional legal base for processing such data under GDPR Article 9(h) (where processing relates to Health or social care and that processing is necessary). Special Data is only processed where that processing is lawful, fair and based on transparency. We process Special data only for the limited purposes that it was collected, and ensure that we do not collect more data than we need to fulfil that purpose. The data is kept securely and confidentially and in accordance with our data retention obligations (set out in this document).
4.16 We may process data about your previous criminal offences (“criminal offence data”) provided during your use of our Services. The source of this special category data may include you, your referrer, or other people or organizations. This special category data may be processed for the purposes of providing you with our Services. The legal basis for this processing is to perform a contract between you and us or to take steps, at your request, to enter into such a contract, on condition that this processing is necessary for preventive or occupational medicine, for the assessment of your working capacity as an employee, for medical diagnosis, for the provision of health or social care or treatment or for the management of health or social care systems and services.
4.17 We may process any of your personal data identified in this policy where necessary to establish, exercise or defend legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this processing is our legitimate interest in the protection and assertion of our legal rights, your legal rights and the legal rights of others.
4.18 In addition to the specific purposes for which we may process your personal data set out in this Section 4we may also process any of your personal data where processing is necessary to comply with a legal obligation to which we are subject, or where processing is necessary to protect your vital interests or the vital interests of another natural person. A person’s vital interests are defined in the GDPR as those essential for their life.
4.19 Please do not supply any other person’s personal data to us, unless we prompt you to do so.
Providing your personal data to others
5.1 We may disclose your personal data to our insurers or professional advisers insofar as reasonably necessary to obtain or maintain insurance coverage, manage risks, obtain professional advice, or establish, exercise or defend legal claims, whether in court proceedings or in an administrative or out-of-court procedure.
5.2 We may disclose your personal data your referrer insofar as reasonably necessary for health and social care purposes.
5.3 We may disclose your personal data your insurer insofar as reasonably necessary for health and social care purposes.
5.4 Financial transactions relating to our website and services may be handled by our payment services providers, Paypal and Stripe. We will share transaction data with our payment services providers only to the extent necessary to process your payments, refund such payments and deal with complaints and queries relating to such payments and refunds. You can find information about our payment services providers’ privacy policies and practices at
https://www.paypal.com/uk/webapps/mpp/ua/privacy-prev
5.5 In addition to the specific disclosures of personal data set out in this Section 5, we may disclose your personal data where such disclosure is necessary to comply with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person. We may also disclose your personal data where such disclosure is necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.
5.6 We may, from time to time, expand or reduce Our business and this may involve the sale and/or the transfer of control of all or part of Our business. Data provided by users will, where it is relevant to any part of Our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this Privacy Policy, be permitted to use the data for the purposes for which it was originally collected by Us.
5.7 In the event that any of your data is to be transferred in such a manner, you will be contacted in advance and informed of the changes.
International transfers of your personal data
6.1 In this Section 6, we provide information about the circumstances in which your personal data may be transferred to countries outside the European Economic Area (EEA).
6.2 We have our office in the United Kingdom.
6.3 The hosting facilities for our website are situated in the United Kingdom.
6.4 Our cloud software hosting providers are situated in the United Kingdom.
6.5 You acknowledge that personal data that you submit for publication through our website or services may be available, via the internet, around the world. We cannot prevent the use (or misuse) of such personal data by others.
Retaining and deleting personal data
7.1 This Section 7 sets out our data retention policies and procedure, which are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal data.
7.2 Personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
7.3 We will retain your personal data as follows:
(a) will be retained for a minimum period of 7 years following the date of our last communication, and for a maximum period of 10 years following the date of our last communication.
7.4 In some cases it is not possible for us to specify in advance the periods for which your personal data will be retained. In such cases, we will determine the period of retention based on the following criteria:
(a) the period of retention of case data and special category data will be determined based on our research or statistical purposes.
7.5 Notwithstanding the other provisions of this Section 7, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.
Security of personal data
8.1 We will take appropriate technical and organisational precautions to secure your personal data and to prevent the loss, misuse or alteration of your personal data.
8.2 We will store all your personal data on secure servers, personal computers and mobile devices, and in secure manual record-keeping systems.
8.3 The following personal data will be stored by us in encrypted form: your name, contact information, password(s) and cardholder data.
8.4 Data relating to your financial transactions that is sent from your web browser to our web server, or from our web server to your web browser, will be protected using encryption technology.
8.5 You acknowledge that the transmission of unencrypted (or inadequately encrypted) data over the internet is inherently insecure, and we cannot guarantee the security of data sent unencrypted over the internet.
8.6 You should ensure that your password is not susceptible to being guessed, whether by a person or a computer program. You are responsible for keeping the password you use for accessing our website confidential and we will not ask you for your password (except when you log in to our website).
Amendments
9.1 We may update this policy from time to time by publishing a new version on our website.
9.2 You should check this page occasionally to ensure you are happy with any changes to this policy.
9.3 We will notify you of significant changes to this policy by email or through the private messaging system on our website.
Your rights
10.1 In this Section 10, we have summarised the rights that you have under data protection law. Some of the rights are complex, and not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.
10.2 Your principal rights under data protection law are:
(a) the right to access;
(b) the right to rectification;
(c) the right to erasure;
(d) the right to restrict processing;
(e) the right to object to processing;
(f) the right to data portability;
(g) the right to complain to a supervisory authority; and
(h) the right to withdraw consent.
10.3 You have the right to confirmation as to whether or not we process your personal data and, where we do, access to the personal data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of personal data concerned and the recipients of the personal data. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee.
10.4 You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.
10.5 In some circumstances you have the right to the erasure of your personal data without undue delay. Those circumstances include when: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and the personal data have been unlawfully processed. However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims.
10.6 In some circumstances you have the right to restrict the processing of your personal data. Those circumstances are: you contest the accuracy of the personal data; processing is unlawful but you oppose erasure; we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims; and you have objected to processing, pending the verification of that objection. Where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of important public interest.
10.7 You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for: the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.
10.8 You have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose.
10.9 You have the right to object to our processing of your personal data for scientific or historical research purposes or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
10.10 To the extent that the legal basis for our processing of your personal data is:
(a) consent; or
(b) that the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract,
and such processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.
10.11 If you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.
10.12 To the extent that the legal basis for our processing of your personal information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.
10.13 You may exercise any of your rights in relation to your personal data by written notice to us in addition to the other methods specified in this Section 10.
Third party websites
11.1 Our website includes hyperlinks to, and details of, third party websites.
11.2 We have no control over, and are not responsible for, the privacy policies and practices of third parties.
Updating information
12.1 Please let us know if the personal information that we hold about you needs to be corrected or updated.
Acting as a data processor
13.1 In respect of data supplied to us by licencees of software we do not act as a data controller; instead, we act as a data processor.
13.2 Insofar as we act as a data processor rather than a data controller, this policy shall not apply. Our legal obligations as a data processor are instead set out in the contract between us and the relevant data controller.
About cookies
14.1 A Cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.
14.2 Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.
14.3 Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.
Cookies that we use
15.1 We may use cookies for the following purposes:
(a) authentication – we may use cookies to identify you when you visit our website and as you navigate our website;
(b) status – we may use cookies to help us to determine if you are logged into our website;
(c) shopping cart – we may use cookies to maintain the state of your shopping cart as you navigate our website;
(d) personalisation – we may use cookies to store information about your preferences and to personalise our website for you;
(e) security – we may use cookies as an element of the security measures used to protect user accounts, including preventing fraudulent use of login credentials, and to protect our website and services generally;
(f) advertising – we may use cookies to help us to display advertisements that will be relevant to you;
(g) analysis – we may use cookies to help us to analyse the use and performance of our website and services; and
(h) cookie consent – we may use cookies to store your preferences in relation to the use of cookies more generally.
Cookies used by our service providers
16.1 Our service providers use Cookies and those Cookies may be stored on your computer when you visit our website.
16.2 We use Google Analytics to analyse the use of our website. Google Analytics gathers information about website use by means of cookies. The information gathered relating to our website is used to create reports about the use of our website. Google’s privacy policy is available at: https://www.google.com/policies/privacy/.
Managing Cookies
17.1 Most browsers allow you to refuse to accept Cookies and to delete Cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting Cookies via these links:
(a) https://support.google.com/chrome/answer/95647?hl=en (Chrome);
(b) https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences (Firefox);
(c) http://www.opera.com/help/tutorials/security/cookies/ (Opera);
(d) https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies (Internet Explorer);
(e) https://support.apple.com/kb/PH21411 (Safari); and
(f) https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy (Edge).
Data protection registration
18.1 We are registered as a data controller with the UK Information Commissioner’s Office (ICO).
18.2 data protection reference number with the ICO is ZA513705.
Contacting Us
If you have any questions about Our Website or this Privacy Policy, please contact Us by email at: [email protected]. Please ensure that your query is clear, particularly if it is a request for information about the data We hold about you.