Please note: This is a draft website that is being updated at present. Apologies for the delay. Thank you for your interest and your patience.

Empowering children through their play. 

Sunshine Play Therapy 2019

Privacy policy

Organisation name: Sunshine Play Therapy

ICO Registration reference:  ZA253712 

Date registered: May 2017

Responsibility for controlling and processing assigned to Lesley Towers (Self-employed owner and play therapist of Sunshine Play Therapy).

Email address:


Under the Data Protection Act 1998 (DPA) and in line with GDPR Sunshine Play Therapy will:

  • use personal information fairly and lawfully;
  • collect only the information necessary for a specific purpose(s);
  • ensure it is relevant, accurate and up to date;
  • only hold as much as we need, and only for as long as we need it;
  • allow the subject of the information to see it on request; and allow them to request to withdraw

        their information.

  • keep it secure.


Nature of work description:

Play Therapy , Creative Art Therapy and Creative Supervision Provider


Reasons/purposes for processing information:

 We process personal information to enable us to provide:

  • therapy,
  • supervision
  • to monitor our services,
  • to promote our services,
  • to maintain our own accounts and records,


When we hold data we will inform the individual of the data we hold, how we store it, how long we keep

it for and whom it is shared with. They can request to see that data and we will provide that within

30 days. They can request for the data to be corrected, erased or the processing restricted.


Type/classes of information processed:

 We process information relevant to the above reasons/purposes. This may include:

  • personal details
  • family details


We also process sensitive classes of information that may include:

  • physical or mental health details
  • racial or ethnic origin
  • professional body membership


 We process personal information about:

  • Customers (schools, organisations, individuals) – email addresses and contact numbers, names of

        and roles of staff/individuals

  • Clients (adults and children) – personal details
  • Suppliers – contact details and finance for payment


How the information is stored:

 Where ever possible data is stored electronically on Bacpac []:

How safe are my records?

Your therapist uses Bacpac: a system designed to ensure that your information is safe, secure and completely confidential.


The information stored within Bacpac is encrypted and in addition to a password, your therapist must

input a unique code each time they log in. This ensures that your records are accessible only to them.


Bacpac has been built on a secure hosting platform by Mayden, a company with over 10 years

experience developing protected software for the NHS, voluntary services and the private sector.


Mayden has been vetted by the NHS and by the Ministry of Defence to host confidential medical

information, so you can be certain that your notes are stored safely and securely.

Mayden has robust procedures in place to ensure that your information remains confidential. We are

happy to share these with you.

Simply email for details.”  [Bacpac, 2019]

The Sunshine Play Therapy laptop is password protected. Where paper records are kept these are

stored in a private building, in a locked filing cabinet.


Data will be kept until it is no longer needed for the reasons or purposes listed above, or in certain

cases in line with legal requirements (e.g. Looked after or Adopted Children). As stated above,

individuals can enquire as to how long their data will be kept for.


Who the information may be shared with

 We sometimes need to share the personal information we process with the

individual themselves and also with other organisations. Where this is necessary we

are required to comply with all aspects of the Data Protection Act (DPA) and with GDPR.


What follows is a description of the types of organisations we may need to share some of the personal

information we processwith for one or more reasons.


Where necessary or required we share information with:

  • other involved professionals
  • professional clinical supervisors
  • family, associates and representatives of the person whose personal data we are processing
  • persons making an enquiry or complaint


When information is shared it is anonymised (where appropriate) and sent by email, password protected.


Undertaking research

Personal information is also processed in order to undertake research. For this reason the information

processed may include name, contact details, family details, lifestyle and social circumstances. The

sensitive types of information may include physical or mental health details, racial or ethnic origin. When used for research the individual will not be identifiable from the data. Data is anonymised. Where

necessary or required this information may be shared with customers and clients.


Consulting and advisory services

Information is processed for consultancy and advisory services that are offered. For this reason the

information processed may include name, contact details, family details, lifestyle and social

circumstances. The sensitive types of information may include physical or mental health details, racial or ethnic origin. This information may be about customers and clients. Where appropriate this information

is shared with the data subject themselves, family members, other professional advisers and service providers.



Contact information of schools organisations and individuals is held in order to promote our services.

Where an email is a personal one the individual has been a previous client and has opted in to being on

our mailing list.


Incident Management and Reporting:

Should there be an incident regarding a data breach the relevant parties are to initially report the

details to the play therapist and owner of Sunshine Play Therapy. A record will be made of the relevant details and advice will be sought from the ICO as to the required form of action.  

Post incident the relevant parties will meet the play therapist to decide what needs to be put in place to ensure that the situation is not repeated. A time scale will be specified for the changes to be implemented. 

Complaints Handling:

Should someone have a complaint about Data protection initially they will be directed to the play

therapist. A record will be made of the relevant details and attempts will be made to resolve the

situation. If the complainant is still dissatisfied, then the requester will be informed that they can register their complaint with the ICO. In this case advice will be sought from the ICO.

Post incident the Play Therapist and relevant parties will meet to decide what needs to be put in place to ensure

that the situation is not repeated. A time scale will be specified for the changes to be implemented.


This policy and Sunshine Play Therapy’s Data protection procedures will be formally reviewed every year and changes communicated to all relevant parties. Ongoing reviews and changes will also take place in response to information and situations.

Date for review: October 2020