Privacy Policy
Last updated: June 2026 · Lewin Paro Ltd · Company No. 16993210
This Privacy Policy explains how Lewin Paro Ltd ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our website at lewinparo.com or any of our services. We are committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy should be read alongside our Terms & Conditions and Cookie Policy.
Part 1 — Who We Are & What We Collect
Who We Are
Lewin Paro Ltd is a performance psychology service registered in England and Wales (Company No. 16993210). Registered address: 20 Sandown Park, Tunbridge Wells, England, TN2 4RJ.
For any data-related queries: info@lewinparo.com
What Data We Collect
We may collect the following categories of personal data when you use our website or services:
Identity data — your name
Contact data — email address, phone number
Account data — login credentials for your member account on our Squarespace-hosted website
Booking data — session bookings, scheduling preferences, and attendance history
Transaction data — subscription plan, billing history, and payment records (payment processing is handled by Stripe; we do not store full card details)
Assessment data — your responses to the Lewin Paro burnout and wellbeing assessment (this is special category health data under UK GDPR Article 9 — see Part 3)
Session data — practitioner notes, progress records, and — for Performance Package members only — session transcripts used to prepare your monthly performance summary (treated as strictly confidential sensitive data)
Consent records — timestamped records of the consents you have provided, including Article 9 health data consent
Technical data — IP address, browser type, device information, and usage analytics collected via cookies
Marketing data — your preferences regarding communications
How We Collect Your Data
Directly from you — when you complete the burnout assessment form, create a member account, subscribe to a plan, book a session, attend a session, or contact us by email
Automatically — via cookies and analytics tools when you visit our website
From third-party processors — account, booking, and subscription data from Squarespace; payment data from Stripe
Part 2 — How & Why We Use Your Data
Lawful Bases for Processing
We use your personal data only where we have a valid lawful basis to do so under UK GDPR:
Contract — processing necessary to provide the Service you have subscribed to (account management, session booking and delivery, billing)
Legitimate interests — improving our platform, ensuring security, and sending service-related communications
Legal obligation — retaining financial records and complying with applicable law
Explicit consent (Article 9) — processing your burnout assessment responses and, for Performance Package members, session transcripts, which constitute special category health data. You may withdraw this consent at any time — see Part 3.
Consent — sending marketing emails where you have opted in
Purposes of Processing
Providing our services (contract) — to create and manage your account, take bookings, and deliver sessions via Zoom
Processing payments (contract) — to manage subscriptions and billing via Stripe
Delivering assessment results (explicit consent) — to send your burnout assessment results to your email address via Gmail
Preparing your performance summary (explicit consent) — for Performance Package members, to transcribe sessions and prepare your monthly performance check-in and progress summary
Service communications (contract / legitimate interests) — session confirmations, reminders, and support updates
Improving our service (legitimate interests) — to analyse usage and improve the platform
Marketing (consent) — newsletters or promotional emails where you have opted in; you can withdraw consent at any time
Legal compliance (legal obligation) — to meet our obligations under applicable law
Safeguarding (vital interests / legal obligation) — where we have a duty to act to prevent serious harm
Confidentiality of Session Data
Session notes, transcripts, and psychological support records are treated as strictly confidential. This information is never shared with your employer, insurer, or any third party without your explicit consent, except where we are legally compelled to do so (e.g. a court order) or where there is an immediate and credible risk of harm to you or another person.
Sessions are conducted by video call via Zoom. We do not retain video or audio recordings of any session. For Performance Package members only, sessions may be transcribed for the sole purpose of preparing your monthly performance summary. Essential Package sessions are not recorded or transcribed.
Part 3 — Special Category Health Data & Assessment Processing
Your Burnout Assessment & Health Data
⚕ UK GDPR Article 9 — Sensitive Health Data
Your burnout assessment responses — and, for Performance Package members, your session transcripts — are classified as special category data under UK GDPR Article 9 because they relate to your mental and emotional health. This data receives the highest level of legal protection and is processed only with your explicit consent.
How your assessment data flows
When you submit the Lewin Paro burnout assessment, your data moves through the following sequence of processors:
You (submit assessment) → Squarespace (captures & stores responses) → Gmail / Google Workspace (delivers results to your email)
Squarespace receives your name, email, all assessment responses, and a timestamped record of your Article 9 consent, submitted via our Squarespace assessment form. Squarespace acts solely as a data processor on our instructions and does not use your data for its own purposes. A Data Processing Agreement (Squarespace's Data Processing Addendum) is in place.
Google (Gmail / Workspace) is used to deliver your results email. Your name, email address, and result level (e.g. "Moderate Risk") pass through Google's mail infrastructure. This is covered by Google's Cloud Data Processing Addendum incorporating the UK Addendum to the EU Standard Contractual Clauses.
Stripe never receives your assessment responses. Stripe processes payment data only.
Session transcripts (Performance Package only)
If you subscribe to the Performance Package, your sessions may be transcribed solely to prepare your monthly performance check-in and progress summary. Transcripts are:
Processed on the basis of your explicit consent, given when you subscribe to the Performance Package
Stored securely within our Google Workspace environment
Accessible only to your practitioner and authorised Lewin Paro personnel
Never used for marketing, training, or any purpose other than your performance summary
Permanently deletable on request at any time
Consent and your right to withdraw
Your assessment data and session transcripts are processed solely on the basis of your explicit Article 9 consent. A timestamped record of this consent is retained for 6 years for compliance purposes. You may withdraw consent and request permanent deletion of your assessment data and/or transcripts at any time by emailing info@lewinparo.com. Withdrawal does not affect the lawfulness of any processing already carried out.
Security of health data
All assessment data and transcripts are transmitted over encrypted HTTPS connections and stored with encryption at rest within our processors' systems (Squarespace and Google Workspace). Your health data is never transmitted in plain text at any point in the data flow.
Part 4 — Third-Party Processors & International Transfers
Our Data Processors
The following third-party service providers act as data processors on our behalf. Each is bound by a Data Processing Agreement (DPA) in accordance with UK GDPR Article 28. We do not sell your personal data to any third party.
Processor Role Data Processed Location Transfer Basis Squarespace Website hosting, member accounts, session booking, assessment forms, checkout Name, email, account details, booking data, assessment responses (special category health data), consent timestamps USA UK Addendum to EU SCCs (Art. 46 UK GDPR) Stripe Payment processing Payment method details, billing address, transaction records USA / Ireland UK Addendum to EU SCCs (Art. 46 UK GDPR) Google Workspace (incl. Gmail, Drive, Meet) Video sessions, session transcripts, document storage, email delivery of assessment results and service communications Name, email address, assessment result level, session transcripts (Performance Package only), service correspondence USA / EEA UK Addendum to EU SCCs (Art. 46 UK GDPR) Google Analytics Anonymous website analytics Anonymised browsing data, session duration, device type USA UK Addendum to EU SCCs (Art. 46 UK GDPR)
International Data Transfers
Squarespace, Stripe, and Google are headquartered in the United States of America, which does not benefit from a general UK adequacy decision under UK GDPR. All transfers of personal data to these processors are made under appropriate safeguards pursuant to UK GDPR Article 46, including the UK Addendum to the EU Standard Contractual Clauses and/or the UK International Data Transfer Agreement (IDTA) framework, or under the UK Extension to the EU-US Data Privacy Framework where the processor is certified.
Transfer Risk Assessments (TRAs): Before transferring data internationally, Lewin Paro has conducted a Transfer Risk Assessment for each processor in accordance with ICO guidance. We are satisfied that the contractual, technical, and organisational safeguards in place provide an essentially equivalent level of protection to that afforded under UK law. You may request a copy of these safeguards by emailing info@lewinparo.com.
Part 5 — Cookies, Retention & Security
Cookies
Our website uses cookies to improve your experience and analyse traffic. These include:
Essential cookies — required for the website and your account to function correctly (including cookies set by Squarespace)
Analytics cookies — to understand how visitors use our site (Google Analytics and Squarespace analytics, anonymised data only)
Marketing cookies — only set with your explicit consent
You can manage or withdraw cookie consent at any time through your browser settings or via our Cookie Policy.
How Long We Keep Your Data
Data Type Retention Period Reason Account & contact data Duration of membership + 2 years Service delivery and support Assessment responses (health data) 6 years from submission Article 9 consent compliance records Session notes & transcripts 5 years from your last session Professional practice standards and safeguarding Transaction & billing data 7 years Financial and legal compliance (HMRC) Consent records 6 years UK GDPR accountability obligations Analytics data 26 months (Google Analytics default) Service improvement
How We Protect Your Data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:
Encrypted connections (SSL/TLS) across all data transmissions
Encryption at rest for data held within Squarespace and Google Workspace
Access controls limiting who can view sensitive data internally
Data Processing Agreements with all third-party processors
Regular security reviews of our platform and supplier relationships
Part 6 — Your Rights & How to Exercise Them
Your UK GDPR Rights
You have the following rights in relation to all personal data held about you across our processor systems (Squarespace, Google Workspace, Stripe). These rights apply to both standard personal data and special category health data.
Right of Access — request a copy of all personal data we hold about you (Subject Access Request)
Right to Rectification — ask us to correct any inaccurate or incomplete data we hold
Right to Erasure — request deletion of your personal data from all our systems, including Squarespace and Google Workspace
Right to Withdraw Consent — withdraw Article 9 health data consent or marketing consent at any time
Right to Restrict Processing — ask us to pause or limit how we process your data in certain circumstances
Right to Data Portability — receive your data in a structured, machine-readable format
Right to Object — object to processing based on our legitimate interests or for direct marketing
Rights re: International Transfers — request details of the safeguards in place for any international transfer of your data
To exercise any of these rights, email us at info@lewinparo.com. We will respond within 30 days. For complex or multiple requests, we may extend this by a further 60 days and will inform you accordingly. We will not charge a fee for reasonable requests.
Part 7 — Changes, Complaints & Contact
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any significant changes will be communicated to you by email or via a notice on our website at least 14 days before they take effect. The "Last updated" date at the top of this page will always reflect the most recent version.
Complaints
If you have concerns about how we handle your data, please contact us first at info@lewinparo.com and we will endeavour to resolve the matter promptly.
If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's independent data protection authority:
Website:ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Contact Us
For all privacy-related questions, data rights requests, or to withdraw consent:
Lewin Paro Ltd
📧 info@lewinparo.com 🌐 lewinparo.com
Lewin Paro Ltd · 20 Sandown Park, Tunbridge Wells, England, TN2 4RJ · Company No. 16993210
Terms & Conditions · Cookie Policy