Last Updated & Effective Date: 3 November 2026

Privacy & Cookie Policy (UK GDPR & Data Protection Act 2018)

Welcome to the Privacy & Cookie Policy of Mateusz Bajerski (https://mateuszbajerski.co.uk). We respect your privacy and are committed to protecting your personal data with full transparency and confidentiality.

This Privacy & Cookie Policy explains how we collect, use, store, and protect your personal data when you visit our website, contact us, book a free Discovery Call, or engage in 1:1 Online Hypnotherapy Services.

We process personal data in strict compliance with:

• the UK General Data Protection Regulation (UK GDPR),
• the Data Protection Act 2018 (DPA 2018),
• the Privacy and Electronic Communications Regulations 2003 (PECR), and
• where applicable to clients residing in the European Economic Area (EEA), the EU General Data Protection Regulation (EU GDPR 2016/679).

1. Data Controller Details

The Data Controller responsible for your personal data is:

Mateusz Bajerski, operating an online hypnotherapy and transformational practice based in the United Kingdom, email: hi@mateuszbajerski.co.uk (and hipnoterapia.bajerski@gmail.com), phone: +44 7760 950629 (holding qualifications: DHP Acc. Hyp., BA Philosophy-Interpersonal Communication, MA Cognitive Science, Accredited Member of the Professional Hypnotherapy Practitioner Association – PHPA in London).

2. Personal Data We Collect, Purposes, and Lawful Bases

We only collect and process personal data where we have a valid legal basis under Article 6 (and, where health-related information is shared, Article 9) of the UK GDPR / EU GDPR:

1. Booking & Providing 1:1 Online Hypnotherapy Sessions and Discovery Calls (via Cal.com & Intake Forms):
   • Data Collected: Full name, email address, phone number, time zone, booking details, payment confirmation details, and any information you voluntarily disclose in pre-session intake questionnaires (e.g., via website forms or Google Forms) or during consultations and hypnotherapy sessions (such as your personal goals, wellbeing, emotional state, relevant medical or psychological history, or contraindications).
   • Purpose: Scheduling and managing your online appointments via Cal.com (cal.com/matt-bajerski/15min and cal.com/matt-bajerski/konsultacje), screening for contraindications to ensure hypnotherapy is safe and appropriate for you, delivering tailored 1:1 online hypnotherapy sessions, and sending appointment reminders.
   • Lawful Basis (Standard Data): Article 6(1)(b) UK GDPR (processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract).
   • Lawful Basis (Special Category Health & Wellbeing Data): Article 9(2)(a) UK GDPR – your explicit consent given when submitting intake information or booking a session so that we can safely assess suitability and provide personalised hypnotherapy support. You have the right to withdraw your consent at any time, though please note that we cannot safely conduct hypnotherapy sessions without necessary suitability screening.
2. Payments, Billing, and Accounting:
   • Data Collected: Name, billing address/country, email address, transaction amount, date, and payment reference ID. We do not collect or store your credit/debit card numbers on our servers—all online payments are processed directly via PCI-DSS compliant payment gateways (such as Stripe or bank transfer).
   • Purpose: Processing session fees, issuing invoices/receipts, and maintaining statutory tax and accounting records required by HM Revenue & Customs (HMRC).
   • Lawful Basis: Article 6(1)(b) UK GDPR (performance of a contract) and Article 6(1)(c) UK GDPR (compliance with legal and tax obligations under UK law).
3. Contact Forms, Direct Enquiries & Communications:
   • Data Collected: Name, email address, phone number (optional), and the contents of your message sent via our Contact page, email, or phone.
   • Purpose: Responding to your enquiries, providing information about our online hypnotherapy services, and managing client relationships.
   • Lawful Basis: Article 6(1)(f) UK GDPR (our legitimate interest in responding to prospective and existing clients) or Article 6(1)(b) UK GDPR (pre-contractual steps at your request).
4. Website Security, Spam Prevention & Technical Operations (WP Cerber & hCaptcha):
   • Data Collected: IP address, browser type and version, operating system, login/access logs, and anti-bot verification signals (hCaptcha).
   • Purpose: Protecting our website against cyberattacks, brute-force attempts, malware, and automated spam submissions, as well as establishing, exercising, or defending legal claims.
   • Lawful Basis: Article 6(1)(f) UK GDPR (our legitimate interest in maintaining network and information security and protecting our legal rights).
5. Website Analytics & Third-Party Media (Google Analytics / YouTube):
   • Data Collected: Anonymised IP address, device information, pages visited, session duration, referral source, and cookie identifiers.
   • Purpose: Understanding how visitors interact with our website so we can improve its content, usability, and performance, and enabling embedded media (such as YouTube videos).
   • Lawful Basis: Article 6(1)(a) UK GDPR and PECR (your consent provided via our cookie settings or browser preferences).

3. Confidentiality & Who We Share Your Data With

As an accredited member of the Professional Hypnotherapy Practitioner Association (PHPA), Mateusz Bajerski upholds strict professional confidentiality. We never sell, rent, or trade your personal data to third parties.

We only share data with trusted third-party service providers ("Data Processors") who assist us in operating our online practice under strict data protection obligations:

• Appointment Scheduling: Cal.com, Inc. (cal.com) for online booking and calendar management.
• Video Conferencing Platforms: The platform used for your 1:1 online session (e.g., Zoom, Google Meet, Skype, or WhatsApp, as mutually agreed with you).
• Email & Cloud Intake Forms: Google Ireland Limited / Google LLC (Gmail and Google Forms).
• Payment Processing: Stripe Payments UK, Ltd. or your chosen banking provider.
• Security & Anti-Spam: Intuition Machines, Inc. (hCaptcha) and server-side security tools (WP Cerber).
• Website Analytics: Google Ireland Limited / Google LLC (Google Analytics).
• Legal, Tax, or Safeguarding Disclosures: We may disclose information only where strictly required by UK law (e.g., HMRC tax audits, court orders) or where there is an immediate, serious risk of harm to you or another person (in accordance with UK safeguarding principles).

4. International Data Transfers

Our practice is based in the United Kingdom. Some of our third-party technical providers (such as Cal.com, Google LLC, Stripe Inc., and Intuition Machines/hCaptcha) process data on servers located in the United States (USA) or the European Economic Area (EEA).

Whenever your personal data is transferred outside the UK, we ensure an adequate level of protection as required by UK GDPR through:

• UK Adequacy Regulations (for transfers to and from the EEA),
• Certification under the UK Extension to the EU-US Data Privacy Framework (DPF), or
• Standard Contractual Clauses (SCCs) alongside the UK International Data Transfer Addendum (IDTA) approved by the UK Information Commissioner’s Office (ICO).

5. Data Retention (How Long We Keep Your Data)

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Client Therapy & Session Records: Retained securely for up to 6 years following your final session (in accordance with the UK Limitation Act 1980 and professional indemnity insurance requirements for hypnotherapy practitioners), after which they are securely deleted.
• Financial & Billing Records: Retained for 6 years after the end of the relevant UK tax year to comply with HMRC statutory requirements.
• General Enquiries (where no session is booked): Retained for up to 24 months from the last communication and then deleted.
• Security Logs (WP Cerber): Retained for up to 90 days unless required longer to investigate a security incident.

6. Your Data Protection Rights (UK GDPR & EU GDPR)

Under UK data protection law, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you (Subject Access Request).
• Right to Rectification: Request correction of any inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no compelling legal or regulatory reason for us to continue holding it.
• Right to Restrict Processing: Request that we suspend the processing of your personal data in certain circumstances.
• Right to Data Portability: Request the transfer of data you have provided to us in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on our legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where we rely on your consent (including explicit consent for health-related information or analytics cookies), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of your rights, please email hi@mateuszbajerski.co.uk. We will respond to all legitimate requests within one month (30 days).

Right to Lodge a Complaint with a Supervisory Authority: If you have concerns about how we handle your data, we kindly ask that you contact us first so we can resolve the issue immediately. You also have the statutory right to lodge a complaint with:

• In the United Kingdom: The Information Commissioner’s Office (ICO) – Website: https://ico.org.uk, Telephone: 0303 123 1113, Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
• In the European Union / EEA: Your local data protection authority in the EU Member State of your habitual residence.

7. Cookie Policy (PECR Compliance)

Our website uses cookies—small text files placed on your device to help the site function properly and to provide anonymised analytics insights:

• Strictly Necessary & Security Cookies: Essential for website navigation, language selection (Polylang), security firewall protection (WP Cerber), and bot protection on forms (hCaptcha). These cookies do not require prior consent under PECR as the website cannot function securely without them.
• Analytics & Performance Cookies (Google Analytics): Help us count visits and traffic sources so we can measure and improve the performance of our site.
• Functional & Embedded Third-Party Cookies: Set when you interact with embedded booking widgets (Cal.com) or watch embedded videos (YouTube).

You can control, block, or delete cookies at any time through your web browser settings (Chrome, Safari, Firefox, Edge) or via our website cookie preferences. You can also opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.

8. Children’s Privacy & Updates to This Policy

Our online hypnotherapy services and website are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18 without verified parental or guardian consent. We may update this Privacy & Cookie Policy from time to time to reflect legal, technical, or operational changes.