Privacy Policy

Last updated: April 2026  ·  Lewin Paro Ltd

This Privacy Policy explains how Lewin Paro Ltd ("we", "us", "our") collects, uses, and protects your personal data when you use our website at lewinparo.com or any of our services. We are committed to protecting your privacy and handling your data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who We Are

Lewin Paro Ltd is a corporate psychology and wellbeing service registered in England and Wales. For any data-related queries, contact us at: [email protected]

What Data We Collect

We may collect the following categories of personal data when you use our website or services:

• Identity data — your name
• Contact data — email address, phone number
• Account data — login credentials for your member account
• Transaction data — subscription and payment records (payment processing is handled by Kajabi and Stripe; we do not store full card details)
• Session data — notes and progress records from psychological support sessions (treated as sensitive data)
• Technical data — IP address, browser type, device information, and usage analytics collected via cookies
• Marketing data — your preferences regarding communications

How We Use Your Data

We use your personal data for the following purposes and under the following lawful bases:

• Providing our services (contract) — to create and manage your account and deliver psychological support sessions
• Processing payments (contract) — to manage subscriptions and billing
• Service communications (contract/legitimate interests) — to send you session confirmations, reminders, and support updates
• Improving our service (legitimate interests) — to analyse usage and improve the platform
• Marketing (consent) — to send newsletters or promotional emails where you have opted in. You can withdraw consent at any time.
• Legal compliance (legal obligation) — to meet our obligations under applicable law

Confidentiality of Session Data

Session notes and psychological support records are treated as strictly confidential. This information is never shared with your employer, insurer, or any third party without your explicit consent, except where we are legally compelled to do so (e.g. a court order or immediate risk of harm).

Who We Share Your Data With

We may share your data with trusted third-party providers who help us deliver our services:

• Kajabi — our website and membership platform (data may be processed in the USA; Kajabi is Privacy Shield certified)
• Stripe — payment processing
• Google Analytics — anonymised website analytics
• Email service providers — for transactional and marketing emails

We do not sell your personal data to any third party.

International Data Transfers

Some of our third-party providers (including Kajabi and Stripe) may process your data outside the UK. Where this occurs, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses — as required under UK GDPR.

Cookies

Our website uses cookies to improve your experience and analyse traffic. These include:

• Essential cookies — required for the website and your account to function
• Analytics cookies — to understand how visitors use our site (e.g. Google Analytics)
• Marketing cookies — only set with your consent

You can manage or withdraw cookie consent at any time through your browser settings.

How Long We Keep Your Data

We retain your personal data only for as long as necessary:

• Account and contact data — for the duration of your membership plus 2 years
• Session records — 5 years from your last session, in line with standard professional practice
• Transaction data — 7 years for financial and legal compliance

Your Rights

Under UK GDPR you have the following rights regarding your personal data:

• Right to access — request a copy of the data we hold about you (Subject Access Request)
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data in certain circumstances
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a portable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (SSL/TLS), access controls, and regular security reviews of our platform.

Changes to This Policy

We may update this Privacy Policy from time to time. Any significant changes will be communicated to you by email or via a notice on our website. The "last updated" date at the top of this page will always reflect the most recent version.

Complaints

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's data protection authority:

• Website: ico.org.uk
• Telephone: 0303 123 1113