Echo Privacy Notice | How We Use Your Information

ECHO PRIVACY NOTICE

Accessibility Note

This Privacy Notice is available in alternative formats.
If you need this information in a different format, please contact us via the website contact form or email info@theechosociety.org.uk.

1. Who We Are

The Echo Society Ltd (“Echo”, “we”, “us”) is a community‑focused organisation supporting people affected by narcissistic abuse, coercive control, and a wide range of emotional and relational challenges through:

awareness raising and campaigning
outreach and community initiatives
workshops and training
support groups
events
volunteering opportunities
fundraising activities
and a counselling service pathway (intake, allocation, safeguarding coordination, continuity planning)

Echo is the Data Controller for the personal information we collect and manage in connection with these activities.

We do not hold clinical notes or therapeutic records.
Those are held by your counsellor (see the Counselling & Therapeutic Records Privacy Notice, provided by your counsellor).

Echo and your counsellor have separate responsibilities for the information they hold. Echo manages information needed for the counselling service pathway, while your counsellor may access information provided through the intake process that is necessary to support your counselling. Your counsellor is responsible for the clinical and therapeutic records they create and maintain.

Registered address:
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email: info@theechosociety.org.uk

2. What This Privacy Notice Covers

This notice explains how Echo uses your information when you:

visit our website
contact us
register for workshops, training, or events
join support groups
subscribe to our newsletter
volunteer with us
donate or support our fundraising
participate in campaigns or outreach
enquire about counselling
go through counselling intake and allocation
engage with Echo for safeguarding coordination or continuity planning
apply for or express an interest in becoming an Associate Counsellor or Psychotherapist with Echo

This is Echo’s organisation‑wide privacy notice.

Information about clinical records is provided separately in the Counselling & Therapeutic Records Privacy Notice.

3. Why You May Receive More Than One Privacy Notice

Echo manages the counselling service pathway.
Your counsellor provides your therapy.

Because we each hold different types of information, you may receive:

Echo’s Privacy Notice (this document)
Counselling & Therapeutic Records Privacy Notice (provided by your counsellor)

Associate counsellors are independent Data Controllers for their clinical records and therapeutic documentation.

Echo handles service‑level information.
Your counsellor handles clinical information.

4. The Information We Collect and Why

Echo collects only the information needed to run our services safely and effectively.

4.1 Information we collect directly from you

name and contact details
communication preferences
event/workshop registrations
support group registrations
volunteer applications
donation and fundraising information
newsletter subscriptions
general enquiries
availability and service preferences for counselling allocation
safeguarding information (where relevant)
safeguarding coordination records
continuity planning information
risk‑related service‑level information
information provided as part of an Associate Counsellor application or recruitment process, including CVs, supporting statements, professional information and recruitment correspondence

4.2 Information we may receive from others

In some circumstances we may receive information about you from:

referrers
existing service users
safeguarding agencies
individuals acting on your behalf
professionals or organisations involved in referral, safeguarding, or service coordination

We only record what is necessary for service delivery, safeguarding, or legal obligations.

4.3 Information we do NOT routinely collect

Echo does not routinely collect or maintain:

clinical notes
therapeutic records
session content
modality‑specific clinical documentation

If you choose to disclose sensitive or trauma‑related information during intake or communication with Echo, we will record only what is necessary for:

allocation
safeguarding
service‑level decision‑making
continuity planning
administrative documentation necessary to support the delivery of our counselling service

We do not create or store clinical records.

4.4 Information collected automatically

When you visit our website, we may collect:

IP address
browser type
device information
pages visited
interaction data
cookie preferences

See our Cookies Policy for details.

5. Special Category Data

Echo may process special category data where necessary, including:

health information
information about experiences of abuse
safeguarding information
risk‑related information

Where Echo processes special category data, we do so in accordance with UK GDPR and applicable safeguarding, legal, and regulatory requirements, and always limit this to what is necessary.

Echo stores special category data within its secure organisational systems, including Google Workspace and Microsoft 365, with appropriate access controls, confidentiality safeguards, and organisational oversight.

6. How We Use Your Information

We use your information to:

respond to enquiries
provide workshops, events, and support groups
manage volunteers and donors
send newsletters (with your consent)
coordinate campaigns and outreach
manage safeguarding concerns
run the counselling intake and allocation process
prepare administrative documentation necessary to support the delivery of our counselling service
maintain service continuity
operate and improve our website
comply with legal obligations
manage Associate Counsellor applications and recruitment processes
where appropriate, retain relevant application information for consideration in future Associate Counsellor recruitment cycles

We may also use information you provide in connection with campaigns, awareness‑raising, community engagement, or advocacy activities that you choose to participate in.

We do not use counselling‑related information for marketing.

7. Lawful Bases for Processing

Echo relies on the following lawful bases under Article 6 UK GDPR, depending on the purpose of the processing:

Legitimate Interests

To run a safe and effective organisation, including counselling intake, allocation, accessibility adjustments, safeguarding coordination (where not required by law), service continuity, and general organisational administration.

Legal Obligation

Where the law requires us to share or retain information, including statutory safeguarding duties, regulatory requirements, or compliance with court orders.

Vital Interests

Where processing is necessary to protect someone’s life, particularly in emergency situations.

Consent

For newsletters, optional communications, and voluntary equality‑monitoring information.

Contract

For services such as events, workshops, support groups, volunteering, and other non‑counselling activities that involve a contractual arrangement with Echo.

Echo does not rely on Contract for counselling delivery. Counselling is provided by independent counsellors, who are separate Data Controllers for their clinical records.

7.1 Special Category Data

Echo processes certain types of special category information, such as health, mental‑health, abuse, safeguarding or other sensitive information. When we do this, we rely on an applicable Article 9 condition in addition to the Article 6 lawful basis described above.

Echo applies the relevant condition according to the purpose and circumstances of the processing, and only processes information that is necessary for that purpose.

Counselling‑pathway information

Where special category information is provided through Echo’s counselling intake process and is necessary for allocation, accessibility adjustments, safeguarding coordination, continuity planning, or other service‑level decisions that support access to counselling, Echo relies on:

Article 9(2)(h) UK GDPR (Health or social care), together with Schedule 1, paragraph 2 of the Data Protection Act 2018 (Health or social care purposes).

Echo provides and coordinates the counselling service pathway, including intake, allocation, safeguarding coordination and continuity planning. The clinical therapy itself is delivered by independent Associate Counsellors, who remain responsible for their own clinical practice and clinical and therapeutic records. Echo does not create or store clinical therapy records.

Safeguarding and protection from harm

Where special category information needs to be processed for safeguarding or the protection of a child or adult at risk, Echo may rely on:

Article 9(2)(g) UK GDPR, together with Schedule 1, paragraph 18 of the Data Protection Act 2018 (Safeguarding of children and individuals at risk).

This may apply where information needs to be used or shared to protect someone from harm and the specific legal conditions for this processing are met.

Emergency situations

In limited circumstances where processing is necessary to protect someone’s vital interests, and the individual is physically or legally incapable of giving consent, Echo may rely on:

Article 9(2)(c) UK GDPR (Vital interests).

This may apply in an emergency where information needs to be shared to protect life, using only the information necessary for that purpose.

Equality information

Where Echo collects voluntary equality information for equality monitoring or service‑improvement purposes, we may rely on:

Article 6(1)(a) UK GDPR (Consent) and Article 9(2)(a) UK GDPR (Explicit consent).

This information is optional and is not required for access to Echo’s counselling service.

Accessibility and disability‑related information

Where Echo processes information about a disability or medical condition in order to support an individual's accessibility needs or reasonable adjustments for counselling delivery, Echo may rely on:

Article 9(2)(h) UK GDPR (Health or social care), together with Schedule 1, paragraph 2 of the Data Protection Act 2018 (Health or social care purposes), where the relevant legal conditions and safeguards are met.

8. Safeguarding

If we believe someone is at risk of harm, we may share the minimum necessary information with:

emergency services
local authority safeguarding teams
other relevant agencies

We will always act proportionately and transparently wherever possible.

Echo may hold:

safeguarding coordination records
safeguarding communications
risk‑related service‑level information
continuity planning information

These are separate from clinical notes.

9. Who We Share Information With

Echo shares only the minimum necessary information required for service delivery, safeguarding, continuity, or legal obligations.

Depending on the purpose, Echo may share service‑level information with:

Your counsellor

For counselling allocation, service‑level suitability, accessibility adjustments, and continuity where a counsellor becomes unavailable.

Safeguarding agencies

Where required to protect a child or adult at risk, or where the law requires us to share information.

Emergency services or crisis responders

In situations where information must be shared to protect someone’s life.

Technology and administrative service providers

Echo uses secure organisational systems provided by Microsoft 365 and Google Workspace to store and manage service‑level information. These providers act as data processors under UK GDPR for the services they supply to Echo and operate under contractual data‑protection terms.

Event, workshop, and volunteer platforms

Where you register for events, workshops, training, or volunteer activities, we may share the minimum necessary information with the platforms that support those activities.

Legal authorities

Where required by law, including statutory safeguarding duties, court orders, or regulatory requirements.

10. How Long We Keep Your Information

Echo keeps personal information only for as long as necessary for:

delivering the services you request
coordinating safeguarding and risk‑related actions
maintaining service continuity
administering contractual arrangements (such as allocation and fee determination)
fulfilling legitimate organisational functions (such as volunteer management and event administration)
meeting legal and regulatory obligations

Different categories of information are retained for different periods depending on their purpose, legal requirements, safeguarding considerations, and organisational needs.

Echo applies organisational retention controls within Microsoft 365 and Google Workspace to support secure storage, access management, and timely deletion in accordance with our retention schedule.

Echo’s retention periods are set out in our Data Retention & Disposal Policy.

Your counsellor has their own retention schedule for clinical records, which is separate from Echo’s service‑level information.

11. Your Rights

You have rights under UK GDPR, depending on the circumstances and the lawful basis we rely on, including:

access
correction
deletion
restriction
objection
portability

Where we rely on your consent, you can withdraw that consent at any time. You can do this by contacting Echo using the details in Section 13. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Subject Access Requests (SARs)

For Echo‑held information, contact Echo.
For clinical records, contact your counsellor.

We will always explain which information we hold and which we do not.

Your right to complain

If you are unhappy with how your information has been used, you can complain to:

Information Commissioner’s Office (ICO)
Visit the ICO website

You can also contact Echo directly using the details below.

12. International Transfers

Some of our service providers may process or store personal information outside the UK.

Where Echo makes a restricted transfer of personal information outside the UK, we ensure that the transfer is covered by an appropriate mechanism under UK data‑protection law, such as:

UK adequacy regulations, where applicable
the UK Extension to the EU‑US Data Privacy Framework, where applicable
an International Data Transfer Agreement (IDTA), UK Addendum, or other appropriate contractual safeguards
other safeguards permitted under UK GDPR, where applicable

We also apply appropriate organisational and technical safeguards to protect personal information when it is processed internationally.

13. Contact Us

Data Protection Lead
The Echo Society Ltd
71–75 Shelton Street
Covent Garden
London WC2H 9JQ
Email: info@theechosociety.org.uk

14. Updates to This Notice

We may update this Privacy Notice from time to time.

The version that applies is the one published on our website on the day you use our services.

Version: 2.0

Approved: 13 August 2026

Next Review: 13 August 2027