Last updated: 31 August 2026

Your privacy is important to me. This Privacy Policy explains how I collect, use, store and protect your personal information when you visit my website, contact me, book an appointment or work with me through Rapid Transformational Therapy (RTT), hypnotherapy, coaching or related services.

I aim to handle your personal information respectfully, confidentially and transparently and in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Data (Use and Access) Act 2025 and Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who I am

Business/trading name: NTL Collective
Practitioner: Gemma Treeby
Website: www.itsnevertoolateclub.co.uk/www.ntlcollective.com
Email: [email protected]
Business address/contact address: NTL Collective, 124 City Road, London, EC1V 2NX
ICO registration number: C2023539

For the purposes of UK data protection law, I am the data controller responsible for the personal information described in this Privacy Policy.

If you have questions about how I use your personal information, or you wish to exercise any of your data protection rights, please contact me using the details above.

2. Personal information I may collect

The information I collect depends on how you interact with me.

Enquiries and contact information

When you contact me, join a discovery call or make an enquiry, I may collect:

• your name;

• email address;

• telephone number;

• the content of your enquiry;

• information you voluntarily provide about what you would like help with; and

• correspondence between us.

Client and booking information

If you decide to work with me, I may also collect:

• postal address where necessary;

• date of birth or age;

• appointment and booking information;

• emergency contact details where appropriate;

• completed intake, consultation or consent forms;

• information relevant to assessing whether my services are appropriate for you;

• session notes;

• goals, progress and information discussed during our work together;

• records of communications relating to our sessions; and

• invoices, payments and transaction records.

I aim to collect only information that is reasonably necessary for the service I am providing.

3. Sensitive or “special category” information

Because of the nature of RTT, hypnotherapy and coaching, you may choose to share sensitive information about yourself.

This may include information concerning your:

• physical health;

• mental or emotional wellbeing;

• medical history;

• racial or ethnic origin;

• religious or philosophical beliefs;

• sex life; or

• sexual orientation.

UK data protection law calls certain types of sensitive information special category personal data, and it receives additional protection.

Where I need to process special category information in order to provide services to you, I will only do so where I have both an appropriate lawful basis under Article 6 of the UK GDPR and an appropriate condition under Article 9.

Where applicable, I rely on your explicit consent under Article 9(2)(a) to process the special category information you choose to disclose for the purposes of providing RTT, hypnotherapy or coaching services.

In limited circumstances, another Article 9 condition may apply, for example where processing is necessary for the establishment, exercise or defence of legal claims or where another condition is required or permitted by law.

You may withdraw consent to the processing of special category information where consent is the basis I rely upon. Withdrawal will not affect processing that was lawful before you withdrew your consent.

Because some personal and wellbeing information may be necessary for me to assess suitability and provide my services safely and appropriately, withdrawing consent or choosing not to provide certain information may mean that I am unable to continue providing a particular service.

4. Why I use your personal information and my lawful bases

I will only use your information where I have a lawful reason to do so.

Responding to enquiries and arranging discovery calls

I use your contact details and the information you provide to respond to your enquiry and discuss services you have requested information about.

My lawful basis will normally be taking steps at your request before entering into a contract and, where appropriate, my legitimate interests in managing genuine business enquiries.

Providing RTT, hypnotherapy, coaching or related services

I use relevant client information to:

• assess whether my services are appropriate for you;

• prepare for and provide sessions;

• communicate with you about appointments;

• maintain appropriate client records;

• monitor our work together; and

• provide recordings, exercises or other agreed materials.

My Article 6 lawful basis is normally performance of a contract or taking steps at your request before entering into a contract.

Where this involves special category personal information, the additional Article 9 condition described in section 3 also applies.

Administration, payments and accounting

I process information where necessary to:

• schedule and manage appointments;

• issue invoices;

• process and reconcile payments;

• maintain financial and tax records; and

• manage the administration of my business.

Depending on the processing involved, I rely upon performance of a contract, legal obligation and/or my legitimate interests in properly administering my business.

I do not normally receive or store full debit or credit card details where payment is handled by a third-party payment provider.

Legal, insurance and professional obligations

I may retain or use information where reasonably necessary to comply with applicable legal obligations, deal with complaints, meet insurance requirements, protect my legal rights or establish, exercise or defend legal claims.

The appropriate lawful basis will depend upon the particular circumstances and may include legal obligation or legitimate interests. Where special category information is involved in legal proceedings or potential proceedings, Article 9(2)(f), relating to legal claims, may apply where its requirements are met.

Website operation and security

I may process limited technical information where necessary to operate, protect and understand the use of my website.

This may include:

• IP address;

• browser and device information;

• date and time of visits;

• pages visited;

• referring website or source; and

• cookie or analytics information.

Strictly necessary information is processed because it is required for the operation and security of the website.

Where cookies or similar technologies require consent under PECR, they will not be used until the appropriate consent has been obtained.

Please see my Cookie Policy and cookie controls for more information.

5. Marketing

I will not automatically add you to a marketing list simply because you enquire about or purchase a service.

Where consent is required for marketing emails, text messages or similar electronic communications, I will ask you separately whether you would like to receive them.

Marketing consent is optional and is not a condition of receiving my services.

Where I rely on consent, you can withdraw that consent at any time by:

• clicking the unsubscribe link contained in an email;

• using any other unsubscribe method provided in the communication; or

• contacting me at [email protected]

In circumstances where the PECR “soft opt-in” lawfully applies to existing customers, I may contact you about my own similar services provided you were offered a clear opportunity to opt out when your details were collected and are given a simple opportunity to opt out in every subsequent marketing communication.

I will respect marketing objections and maintain a minimal suppression record where necessary to ensure that I do not contact someone who has asked not to receive marketing.

6. How I collect your information

I may obtain information:

• directly from you;

• through my website;

• through contact or enquiry forms;

• by email, telephone, video call or messaging;

• through my booking system;

• through questionnaires or client forms;

• during discovery calls and paid sessions;

• through payment providers; and

• through other service providers you use to contact or book with me.

If someone else contacts me on your behalf, I will handle any information supplied in accordance with applicable data protection requirements.

7. Who I share information with

I do not sell your personal information.

I may use carefully selected service providers to help operate my business. Depending upon the systems I use, these may include providers of:

• website hosting;

• email;

• online booking and scheduling;

• secure forms;

• videoconferencing;

• cloud storage;

• payment processing;

• bookkeeping or accounting;

• email newsletters;

• IT support; and

• practice or customer management software.

Where these organisations process personal information on my behalf, I take reasonable steps to ensure appropriate data protection arrangements are in place.

Current key service providers include:

[INSERT ACTUAL PROVIDERS, FOR EXAMPLE:
Website: FEA Create
Booking: FEA Create
Videoconferencing: Google Meet/Zoom
Email: Google Workspace
Storage: Google Drive
Payments: Stripe/PayPal
Accounting: Xero/Tide
Email marketing: FEA Create

Certain providers, such as payment processors, may act as independent data controllers for some of the information they process. Their own privacy policies will apply to that processing.

I may also disclose information where reasonably necessary:

• to professional advisers such as my accountant, insurer or legal adviser;

• where required by law, court order or a competent authority;

• for the establishment, exercise or defence of legal claims; or

• where disclosure is necessary to protect someone's vital interests in circumstances recognised by law.

I will not routinely disclose information you share during sessions to friends, relatives, employers or other third parties simply because they request it.

8. Confidentiality

Information shared during RTT, hypnotherapy and coaching sessions is treated confidentially.

However, confidentiality is not necessarily absolute. There may be exceptional circumstances where information can or must be disclosed, for example where required by law or legal process.

Any professional, ethical or safeguarding limits on confidentiality that apply specifically to the service you receive should also be explained in my client agreement or terms of service.

This Privacy Policy concerns data protection and should be read alongside those contractual and professional confidentiality arrangements.

9. International transfers

Some technology and service providers operate internationally or use infrastructure, group companies or subprocessors located outside the United Kingdom.

This means that personal information may in some circumstances be transferred to or accessed from countries outside the UK.

Where a restricted international transfer takes place, I will take reasonable steps to ensure that an appropriate transfer mechanism recognised by UK data protection law is in place. Depending upon the recipient and destination, this may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved standard contractual clauses; or

• another lawful transfer mechanism.

Where required, I will also consider whether additional safeguards are necessary.

You can contact me if you would like further information about the safeguards relevant to a particular transfer.

10. How I protect your information

I take reasonable and proportionate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

Depending upon the type of information and system involved, these measures may include:

• password-protected accounts and devices;

• multi-factor authentication where available;

• access controls;

• device and software security measures;

• secure or encrypted communications and storage where appropriate;

• limiting access to information to those who genuinely require it; and

• secure deletion or destruction when information is no longer required.

No internet, email, videoconferencing or digital storage system can be guaranteed to be completely secure. I therefore review the systems I use and take measures appropriate to the sensitivity of the information being processed.

11. Session recordings

RTT services may involve personalised audio recordings created for you following a session.

I will explain how these recordings are created, delivered and retained.

I will not record a live client session without telling you and, where required, obtaining your agreement beforehand.

Where a recording contains personal information, it will be handled in accordance with this Privacy Policy.

My current retention arrangements for session/audio recordings are:

[DESCRIBE WHETHER LIVE SESSIONS ARE EVER RECORDED,

12. How long I keep your information

I do not intend to keep identifiable personal information for longer than reasonably necessary.

My principal retention periods are:

General enquiries that do not become clients:
Normally 12 months after our last meaningful contact, unless there is a legitimate reason to retain the correspondence for longer.

Client intake forms, session notes and associated client records:
Normally 7 years after our professional relationship ends, taking account of legal limitation periods, professional guidance and the requirements of my professional indemnity insurer.

Appointment and administrative records:
Normally retained for the period required by applicable UK tax and accounting legislation.

Financial, invoice and tax records:
Normally retained for the period required by applicable UK tax and accounting legislation.

Marketing information:
Until you unsubscribe, withdraw consent or object to the marketing, subject to retaining limited suppression information where necessary to honour your request not to be contacted.

Consent records:
For as long as necessary to demonstrate how and when consent was obtained and to deal with relevant legal or regulatory issues.

Website and analytics information:
According to the retention settings of the applicable website or analytics service, as described in my Cookie Policy.

At the end of the applicable retention period, information will be securely deleted, anonymised or destroyed unless there is a lawful reason to retain it for longer.

13. Your data protection rights

Depending upon the circumstances and the lawful basis on which your information is processed, you may have the right to:

• access personal information held about you;

• rectify information that is inaccurate or incomplete;

• request erasure of your information in certain circumstances;

• request restriction of processing in certain circumstances;

• object to certain processing;

• receive certain information in a portable format under the right to data portability;

• withdraw consent at any time where processing relies upon consent; and

• raise a concern or complaint about the way your information is used.

These rights are not absolute and certain exemptions may apply.

Your right to object

You have the right to object at any time to the use of your personal information for direct marketing. If you object, I will stop using your personal information for that purpose.

Where processing is based upon legitimate interests, you may also have a right to object on grounds relating to your particular situation.

To exercise a data protection right, please contact me at [email protected].

I may need to request reasonable information to confirm your identity before responding to a request.

14. Automated decision-making

I do not currently use your personal information to make solely automated decisions about you that produce legal or similarly significant effects.

If this changes, this Privacy Policy will be updated and the additional protections required by law will be applied.

15. Cookies

My website may use cookies and similar technologies.

Cookies that are strictly necessary for the website to function may be used without consent where permitted by law.

Where consent is legally required — for example, for certain analytics, advertising or tracking cookies — those technologies should remain disabled until you make the relevant choice through the website's cookie consent system.

You can change or withdraw cookie preferences through [COOKIE SETTINGS LINK/MECHANISM].

For more information about individual cookies, their purposes, providers and retention periods, please see my separate Cookie Policy.

16. Links and third-party websites

My website may contain links to websites, social-media platforms or services operated by third parties.

I am not responsible for the privacy practices of independent third parties. If you follow an external link or provide information directly to another organisation, I recommend reviewing that organisation's privacy information.

17. Children

My services are primarily intended for adults aged 18 and over.

I do not knowingly offer RTT, hypnotherapy or coaching services directly to children under 18.

18. Complaints

If you are concerned about the way I have handled your personal information, I would welcome the opportunity to address your concern first. Please contact me at:

[email protected]

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113

You are not required to contact me before making a complaint to the ICO.

19. Changes to this Privacy Policy

I may update this Privacy Policy from time to time, for example if my services, technology providers or legal obligations change.

The most recent version will be published on my website with the date of the latest update shown at the top.

Where a change would materially affect how I use information I already hold, I will take reasonable steps to bring the change to the attention of affected individuals before beginning the new processing where required.

20. Contact

For questions about this Privacy Policy or the way your personal information is handled, please contact:

Gemma Treeby
Trading as NTL Collective
Email: [email protected]
Website: [email protected]/www.ntlcollective.com