Legal

Privacy Policy

Last updated: 9 July 2026

This policy explains how Eugenio's Enneagram ("we", "us") collects and uses personal information when you visit eugenio.co.uk, book a session or assessment, or get in touch.

We are registered with the Information Commissioner's Office (ICO) under registration number ZC148551.

Who we are

Eugenio's Enneagram is operated by Eugenio Leijten and is the data controller for the information described here. We are based in Taunton, Somerset, United Kingdom. You can contact us about privacy matters at me@eugenio.co.uk.

What we collect

What we collect depends on how you use the site:

Enquiry details. If you email us or use the contact link, we receive your name, email address and whatever you choose to tell us.
Booking details. If you book a session or assessment, we collect your name and email address, and, for couples sessions, your partner's name and email address too.
The screening question. Before booking an assessment, we ask whether you are currently working with a mental health practitioner. See "The screening question" below for how this is used.
Payment details. Payments are processed by Stripe. We do not see or store your card details ourselves.
Session notes. Where relevant, brief notes kept for the purpose of our ongoing work together.
Assessment data. If you take an Enneagram assessment, your responses and report are generated and held on enneagramtest.co.uk, a platform we also operate, under its own terms.
Analytics data. If you accept analytics cookies, we collect anonymised information about how the site is used (pages viewed, approximate location, device type).
Technical logs. Our hosting and security provider records standard server information such as IP address and browser type to keep the site running and secure.

The screening question, why we ask, and how we use the answer

Before booking an assessment, we ask whether you are currently seeing a mental health practitioner (such as a therapist, counsellor, or psychiatrist). This is a safeguarding measure, not a barrier: if you answer yes, we recommend the assessment-plus-session option rather than assessment-only, so there is someone to talk through the results with, and we may suggest you also discuss the assessment with your existing practitioner.

This answer is information about your health, which UK GDPR treats as a special category of data requiring extra care. We ask for it, and use it, only with your explicit consent, given at the point you answer the question. We use it solely to guide our safeguarding recommendation at the point of booking, for no other purpose, and we keep it only as long as necessary to support the booking it relates to.

Why we use it, and our lawful basis

Contract. Processing necessary to deliver the session or assessment you have booked.
Consent. For the screening question (special category data), and for any marketing communications.
Legitimate interests. Improving the site, preventing fraud, maintaining security, and our legitimate interest in responding to enquiries.
Legal obligation. Retaining records for tax and accounting purposes.

Who we share it with

We do not sell your data and we do not share it for advertising. We use a small number of trusted providers who process data on our behalf:

Stripe, for payment processing.
enneagramtest.co.uk, the assessment platform we also operate, which delivers your assessment and report.
Cloudflare, our hosting and security provider.
Fastmail, our email provider, for booking and session correspondence.
Google Analytics, only if you have accepted analytics cookies.
Your partner, for couples sessions, both partners' assessment results are shared with each other as part of the joint session, as agreed when booking.

Some of these providers may process data outside the UK. Where that happens, appropriate safeguards are in place as required by UK data protection law.

How long we keep it

Screening question answers are kept only as long as needed for the booking, then deleted.
Session notes are kept for a maximum of 30 days after your final session, then securely deleted.
Assessment data is governed by enneagramtest.co.uk's own retention terms (currently: transcripts and reports deleted 30 days after completion).
Invoice and payment records are retained for 7 years in line with HMRC requirements.
Enquiry correspondence is kept only for as long as needed to deal with your enquiry, after which it is deleted.

Your rights

Under UK GDPR you have the right to access your data, to correct it, to ask us to delete it, to restrict or object to its use, and to data portability. To exercise any of these, email me@eugenio.co.uk. We will respond within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data, though we would welcome the chance to put things right first.

Security

We take appropriate technical and organisational measures to protect your data, including encrypted data transmission and secure third-party processors. No internet transmission is completely secure and we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.

This policy is provided in good faith and kept deliberately plain. If your circumstances require formal legal certainty, please seek your own professional advice.