Privacy Policy

Karen Marie Johnston — Sole Trader

Last updated: 14 October 2026

About this privacy notice

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) set out your right to be informed about the processing of your personal data. We provide information about the processing of your personal data through privacy notices, such as this one. We may provide other information to explain our approach, at other times when collecting your personal data.

If you need this information in another format, or you can’t find the information you’re looking for, please contact us. You can find our contact details at the end of this page.

1. Who I am

I am Karen Marie Johnston, an independent social worker consultant, trainer, coach and professional supervisor working across health and social care, trauma-informed practice, leadership and personal development.

I am registered with Social Work England: Registration number: SW10323

About Social Work England

Social Work England is the regulator of social workers, and education and training courses and qualifications for social workers, in England. Our statutory objectives, duties and powers as a regulator are set out in the Children and Social Work Act 2017 and The Social Workers Regulations 2018.

Social Work England is a non-departmental public body, operating at arm’s length from the government. It is sponsored by the Department for Education (DfE), and has a partnership with the DfE and the Department of Health and Social Care (DHSC).

I operate this part of my business as a sole trader, independently of UK Recovery Retreats Ltd.

I respect your privacy and am committed to handling your personal information responsibly, securely and confidentially. This Privacy Policy explains how I collect, use, store and protect your information when you visit my website, contact me, book my services or work with me.

Business name: Karen Marie Johnston
Website: www.karenmariejohnston.com
Contact email: karen@karenmariejohnston.com
Business address: 42 Firs Glen Road, Bournemouth, Dorset, BH9 2LT.

I am responsible for deciding how and why personal information is used in connection with my sole-trader business.

2. What information I collect

The information I collect depends on how you interact with me and the services you use.

Contact and enquiry information
This may include your name, email address, telephone number, organisation, job title and any information you provide when contacting me about my services.

Consultancy, training and speaking
If you enquire about or commission consultancy, training, speaking engagements or organisational development, I may collect information relating to your organisation, your professional role, project requirements, bookings, correspondence, invoices and service delivery.

Where relevant, this may include professional observations, feedback and information relating to workplace practice or organisational needs.

Coaching and professional supervision
If you work with me through coaching or professional supervision, I may keep relevant notes about our sessions, agreed actions, goals, professional development and ongoing work.

You may choose to share personal experiences, challenges or other information during our work together. I aim to collect only information that is relevant and necessary to the service I am providing.

Sensitive personal information
My work involves trauma-informed practice, social work, coaching and professional supervision. Depending on the nature of our work, you may share information relating to health, mental health, trauma, substance use, personal circumstances or other sensitive matters.

Some of this information may be classified as special-category personal data under UK GDPR. I will only process such information where an appropriate lawful basis and additional legal condition apply.

Please avoid sending sensitive personal information through general website enquiry forms unless it is necessary for your enquiry.

Mailing list and website information
If you subscribe to my mailing list, I may collect your name, email address, subscription preferences and records of your marketing consent where applicable.

My website is hosted on Wix. Depending on the website settings and tools enabled, technical information such as IP addresses, browser information, device information and website usage data may also be collected.

3. How I use your information

I may use your information to:

• Respond to enquiries and requests for information.
• Arrange and deliver consultancy, training, speaking engagements, coaching and supervision.
• Manage bookings, appointments, contracts, invoices and payments.
• Maintain relevant records of professional sessions, agreed actions and ongoing work.
• Communicate with clients and organisations about services they have requested or commissioned.
• Send newsletters, resources and information about my services where permitted.
• Improve my website, services and professional practice.
• Maintain appropriate business, accounting, insurance and legal records.
• Protect the rights, safety and legitimate interests of myself and others where appropriate.

I will not use your personal information for purposes that are incompatible with those explained in this policy without an appropriate lawful basis.

4. My lawful basis for processing information

Under UK data protection law, I must have a lawful basis for processing personal information.

Depending on the circumstances, I may rely on:

Contract: where processing is necessary to enter into or fulfil an agreement with you.
Legitimate interests: where I have a legitimate reason for using information for my business or professional work, provided your rights and interests do not override those interests.
Legal obligation: where I need to retain or use information to meet legal requirements, including relevant financial and accounting obligations.
Consent: where you have freely agreed to a specific use of your information and consent is the appropriate legal basis.

Where I process special-category information, such as health information, I must also identify an appropriate additional condition under Article 9 of UK GDPR and meet any other applicable requirements.

The specific lawful basis and any additional condition will depend on the information involved and the purpose for which it is used.

Where processing is based on consent, you can withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.

5. Confidentiality and professional boundaries

Confidentiality is the cornerstone of my work

I am registered with Social Work England 2023-2024 Registration number: SW10323

“Social workers understand when confidentiality applies to the information and data that they
gather, communicate, record and store about people using their services. Social workers treat
people’s personal information with discretion and should only disclose confidential information
about people in certain circumstances, and in line with the law.

Sharing information is, at times, essential where a person or group’s safety is at risk. However, if
confidential information is disclosed without authorisation or justification, this could be considered a
breach of a person’s privacy.

Confidentiality also applies to the use of technology and social media. Social workers should not
refer to anyone they support or disclose personal or professional information about colleagues,
managers, or employers on social media, an online forum or blog. Even if the references are
anonymised, the identity of the person may be recognisable to others.”

All matters discussed between us whether in person, via phone, Zoom or email, remain fully
confidential. I keep and dispose of your records in accordance with appropriate privacy
laws.

I do not discuss who I am working with either privately or publicly to any 3rd party and will
not share any details of our work together on social media.

I recognise the importance of creating professional relationships in which people can speak openly and share information with confidence. I treat personal and professional information with discretion and take appropriate steps to protect the privacy of people I work with.

I do not use identifying details about clients or people I support in public communications, on social media or in professional examples without an appropriate justification and, where required, consent.

I aim to keep records secure and limit access to information to those who need it for legitimate purposes.

However, confidentiality is not absolute. In certain circumstances, information may need to be disclosed where required or permitted by law, where necessary to protect someone's vital interests, or where there is a serious safety or safeguarding concern and disclosure is lawful and justified.

Where appropriate and safe to do so, I will seek to discuss a proposed disclosure with the person concerned.

If I use external platforms to deliver sessions, such as video conferencing or email, those platforms may process certain information in accordance with their own terms and privacy arrangements.

For group sessions, training or workshops, I may ask participants to respect the confidentiality of information shared by others. However, I cannot guarantee that other participants will maintain confidentiality.

6. Email marketing and newsletters

You may choose to subscribe to my mailing list to receive newsletters, resources, updates, invitations to workshops and information about my services.

I will handle marketing communications in accordance with applicable data protection and electronic marketing requirements.
Where consent is required, I will seek it appropriately. Enquiring about a service, booking a session or attending an event does not automatically mean you have agreed to receive unrelated marketing emails.

You can unsubscribe at any time by using the unsubscribe link in an email or by contacting me directly at karen@karenmariejohnston.com.

I may retain a limited record of your preferences or unsubscribe request to ensure that I respect your choices.

I may also send necessary administrative communications relating to services you have requested or commissioned. These are distinct from marketing communications.

7. Who I share your information with

I do not sell your personal information.

Where necessary to operate my business, I may use third-party service providers, including:

• Website hosting and website functionality: Wix.
• Email marketing: Flodesk, if used for this website and mailing list.
• Online sessions and meetings: Zoom, where used.
• Payment processing: Stripe or other payment providers, where applicable.
• Digital products and booking tools: ThriveCart, where applicable.
• Professional advisers: such as accountants, insurers or legal advisers where necessary.

I may also disclose information where required by law or where an appropriate legal basis exists.

The providers involved will depend on the service you use. Some act as processors on my behalf; others may act as independent controllers of personal information.

I will take appropriate steps to ensure that personal information is handled securely and lawfully.

8. International transfers

Some of the third-party providers I use may store or process information outside the United Kingdom.

Where personal information is transferred internationally, I will ensure that the transfer complies with applicable data protection law and that any required safeguards are in place.

Further information about a provider's data handling arrangements may be available in its own privacy documentation.

9. How long I keep your information

I retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including meeting applicable legal, accounting, insurance and professional requirements.

Different types of information may require different retention periods. These may include:

• General enquiries and correspondence.
• Consultancy and training records.
• Coaching and professional supervision notes.
• Contracts, invoices and financial records.
• Mailing list subscriptions and marketing preferences.
• Feedback, testimonials and professional development records.

When information is no longer needed, I will securely delete it or anonymise it where appropriate, unless there is a lawful reason to retain it for longer.

10. How I protect your information

I take appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

These measures include taking care over where information is stored, limiting access where appropriate and using suitable security measures for electronic and paper records.

No method of electronic storage or transmission is completely secure. However, I take reasonable steps to protect the information entrusted to me.

If a personal data breach occurs, I will assess it and take any action required under applicable data protection law.

11. Cookies and website analytics

My website is hosted on Wix and may use cookies or similar technologies to support website functionality, remember preferences and understand how visitors use the site.

The cookies and technologies in use will depend on my website settings, installed applications and any analytics or embedded services enabled.

Where consent is legally required for non-essential cookies or similar technologies, I will seek consent before using them and provide an appropriate way to reject them.

You can also manage cookies through your browser settings, although disabling some cookies may affect website functionality.
For further information, please refer to the cookie notice or cookie settings available on my website.

12. Your data protection rights

Under applicable data protection law, you may have the right to:

• Request access to the personal information I hold about you.
• Ask me to correct inaccurate or incomplete information.
• Request deletion of your information in certain circumstances.
• Request restriction of processing in certain circumstances.
• Object to certain types of processing.
• Request data portability where the relevant legal conditions apply.
• Withdraw consent where processing is based on consent.
• Complain to the Information Commissioner's Office.

These rights are subject to legal conditions and exceptions. For example, some information may need to be retained to meet legal obligations or establish, exercise or defend legal claims.

To exercise your rights or ask a question about how your information is used, please contact:
Karen Marie Johnston
Email: karen@karenmariejohnston.com

I may need to verify your identity before responding and will respond within the timeframe required by law.

13. Links to other websites

My website may contain links to third-party websites, resources or services.

I am not responsible for the privacy practices of external websites. If you follow a link to another website, please read its privacy policy before providing personal information.

14. Changes to this policy

I may update this Privacy Policy from time to time to reflect changes to my services, website, technology or legal obligations.
The latest version will be published on www.karenmariejohnston.com, with the date of the most recent update shown at the top.

15. Complaints and the Information Commissioner's Office

If you have concerns about how I have handled your personal information, please contact me first at karen@karenmariejohnston.com so I can try to address them.

You also have the right to raise a concern with the UK's independent data protection regulator:
Information Commissioner's Office (ICO)

Website: https://ico.org.uk/make-a-complaint/

The ICO provides information about your data protection rights and how to make a complaint.