PRIVACY NOTICE & COOKIE POLICY
Cornwall Wellbeing (PK Awakened Life Ltd)  Last updated: November 2026  

1. Important Information & Who We Are 
PK Awakened Life Ltd ("we", "us", or "our") operates cornwallwellbeing.co.uk ("the Site"). Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, PK Awakened Life Ltd is the Data Controller responsible for your personal data.  

Our Contact Details:  
Company Name: PK Awakened Life Ltd (Company Number: 15968772)  
Registered Address: 31 Treberran Gardens, Camborne, Cornwall, UK, TR14 0HB  
Email: [email protected]  

If you have any questions about this Privacy Notice or wish to exercise your legal rights, please contact us at [email protected]  


2. The Data We Collect About You 
Personal data means any information that identifies you as an individual. We collect and process the following categories:

Identity & Contact Data: Name, title, billing address, email address, telephone number.  

Special Category (Health & Wellbeing) Data: Self-assessment intake forms, questionnaires, notes on emotional/physical health, lifestyle considerations, or accessibility needs relevant to your 1-on-1 therapy or workshop participation.  

Transaction Data: Details of payments made to and from you, session bookings, and workshop registrations. (Payment card details are captured and processed directly by our secure third-party payment gateways; we never store your full payment card details).  

Technical & Usage Data: IP address, browser type and version, time zone setting, browser plug-in types, operating system, and data on how you browse our website.  

Marketing & Communications Data: Your preferences in receiving updates or newsletters from us.  


3. How We Collect Your Personal Data Direct Interactions: 
When you complete booking forms, intake questionnaires, register for workshops, make payments, subscribe to newsletters, or contact us via email.  
During Sessions & Workshops: Notes taken during clinical therapy sessions or group workshops.  
Automated Technologies: When you interact with our website, we may automatically collect Technical Data about your equipment and browsing patterns via cookies and server logs.  


4. Lawful Bases for Processing Your Data Under the UK GDPR. We must have a valid lawful basis to process your personal data:  

Registering you as a client or workshop attendee
Type of Data: Identity, Contact, Transaction  
Lawful Basis (Art. 6): Performance of a contract with you  
Special Category Condition (Art. 9): N/A  

Conducting 1-on-1 therapy sessions and consultations  
Type of Data: Identity, Contact, Health/Wellbeing Data  
Lawful Basis (Art. 6): Performance of a contract  
Special Category Condition (Art. 9): Explicit Consent (Art. 9(2)(a)) or provision of health/social care (Art. 9(2)(h))  

Processing fees and managing cancellations/refunds  
Type of Data: Identity, Contact, Transaction  
Lawful Basis (Art. 6): Performance of a contract & Legal obligation (HMRC tax and accounting records)  
Special Category Condition (Art. 9): N/A  

Managing our relationship (admin, schedule changes, service updates)  
Type of Data: Identity, Contact  
Lawful Basis (Art. 6): Performance of a contract & Legitimate interests  
Special Category Condition (Art. 9): N/A  

Ensuring safety, duty of care, and safeguarding 
Type of Data: Identity, Health, Emergency Contact  
Lawful Basis (Art. 6): Vital interests (protecting life or physical integrity)  
Special Category Condition (Art. 9): Vital interests / Safeguarding  

Website security, fraud prevention, IT administration 
Type of Data: Technical, Usage  
Lawful Basis (Art. 6): Legitimate interests (securing our network and website operations)  
Special Category Condition (Art. 9): N/A


5. Disclosures of Your Data 
We treat all client and health details as strictly confidential. We only share information with third parties in the following limited situations:  

Professional Mentoring: Where necessary for professional development, discussions with peer mentors are conducted on a strictly anonymised basis without disclosing your identity.

Service Providers: Cloud storage providers, scheduling platforms (e.g., booking software), video conferencing tools, and payment gateways acting as data processors under contractual confidentiality.  

Safeguarding & Legal Exceptions: If we reasonably believe you or someone else is at immediate risk of serious harm, or where we are required to do so by a court order, statute, or law enforcement authority.  

Professional Advisers: Accountants, auditors, insurers, or legal counsel when reasonably necessary.  We never sell, rent, or trade your contact information to third parties for marketing purposes.  


6. International Data Transfers 
Some external third-party software tools we use (such as cloud hosting, email service providers, or calendar tools) may be based outside the United Kingdom or European Economic Area (EEA).  

Whenever we transfer personal data outside the UK, we ensure a similar degree of protection is afforded by ensuring at least one of the following safeguards is implemented:  The country has been granted an adequacy regulation by the UK Government.  The transfer is subject to legally approved International Data Transfer Agreements (IDTAs) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).  


7. Data Security & Storage 
7.1. We have implemented appropriate physical and electronic security measures to prevent your personal data from being accidentally lost, altered, disclosed, or accessed in an unauthorized way.  

7.2. Session notes and intake documents are stored either in password-protected, encrypted cloud environments or in locked filing cabinets. Access is restricted exclusively to authorized personnel.  


8. How Long We Keep Your Data General Enquiries: 
Kept for 12 months after the last correspondence.  

Client Session Records: Kept for 7 years following the date of your last session in accordance with professional insurance limitation periods.

Financial & Accounting Records: Kept for 6 years from the end of the last company financial year to satisfy UK statutory tax obligations (HMRC).  After the expiration of the retention period, your data is securely deleted or shredded.  


9. Your Legal Rights Under the UK GDPR and Data Protection Act 2018, you have the right to:  
Request access to your personal data (a "Subject Access Request").  

Request correction of incomplete or inaccurate data we hold about you.  

Request erasure of your data where there is no lawful reason for us to continue processing it (subject to statutory record retention and insurance rules). Object to processing of your data where we rely on a legitimate interest.  

Request restriction of processing while an accuracy dispute is resolved.  

Request transfer of your personal data to you or a third party (data portability).  

Withdraw consent at any time where we rely on consent to process your data.  

To exercise any of these rights, email [email protected] . We do not charge a fee and aim to respond within 30 days.  

You also have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk). We would, however, appreciate the chance to address your concerns directly before you approach the ICO.  


10. Cookies & Tracking Technologies 
Our website uses essential session cookies to allow the booking engine and pages to function correctly. Any non-essential analytical or marketing cookies are only placed with your consent via our on-site cookie banner. You can set your browser to refuse all or some browser cookies, but this may affect website functionality