Privacy notice
Registered name: Julia Oertli
I am the controller of your personal data. For more information on controllers and their responsibilities please see our guidance on data protection principles, definitions, and key terms.
I am registered with the Information Commissioner’s Office. My registration number is ZB997684.
This privacy notice tells you how you can expect me to handle your personal information.
What information I collect, use, and why
In order to provide and improve services for clients and protect client welfare, I collect and use the following information:
Name and contact details
Pronouns
Address (for payments only)
Phone number (long-term clients only)
Health and wellbeing information (such as health conditions) - this information is subject to additional protection due to its sensitive nature
Session records
Payment amounts and dates
I do not share any of this data with any third parties.
Lawful bases and data protection rights
Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis I rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
Your right of access - You have the right to ask me for copies of your personal information. Read more about the right of access.
Your right to rectification - You have the right to ask me to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
Your right to erasure - You have the right to ask me to delete your personal information. Read more about the right to erasure.
Your right to restriction of processing - You have the right to ask me to limit how I can use your personal information. Read more about the right to restriction of processing.
Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
Your right to data portability - You have the right to ask that I transfer the personal information you gave me to another organisation, or to you. Read more about the right to data portability.
Your right to withdraw consent – When I use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
If you make a request, I must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact me.
Lawful bases for the collection and use of your data
The lawful basis for collecting or using personal information to provide and improve products and services for clients is:
Legitimate interests – I am collecting or using your information because it benefits you or your organisation without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interest is the following:
Clients are asked to identify sources of stress and resilience in their lives ahead of the first session. This is an integral part of the learning process and enables me to relate and adapt the practices to their specific context.
The lawful basis for collecting or using personal information to protect client welfare is:
Legitimate interests – I am collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
There are two conditions that present a contradiction for practising the Resilience Toolkit (brain implants and seizures originating from the brain stem). There are a number of other conditions that require adaptations for practising the Resilience Toolkit (such as low blood pressure, epilepsy or pregnancy). Checking for these with clients ahead of time is important for ensuring the practice is safe.
For more information on the use of legitimate interests as a lawful basis please contact me.
Where I get personal information from
Any personal information I store I receive directly from you via email or through submissions via my website.
How I protect information and how long I keep it
I take care to ensure your data is stored safely. Since I work on my own, I do not need to use any shared cloud storage in order to transfer data to other colleagues. This means I am able to keep all my records safely stored in my personal hard drive.
I work between the UK and Switzerland. Both countries are covered by General Data Protection Regulation (GDPR) provisions.
I do not use any third party services such as Mailchimp or Google Analytics to run my website. Additional steps I have taken to protect users’ data on my website, which is run by Squarespace, include:
Disabling the collection of visitors’ IP addresses
Disabling analytics, performance and and other non-essential cookies
Displaying a clear message with the option to opt out / into the use of cookies
Once we have stopped working together, I will store your personal information for three years before deleting it.
How to complain
If you have any concerns about my use of your personal data, you can make a complaint
to me using the contact details at the top of this privacy notice.
If you remain unhappy with how I have used your data after raising a complaint with me, you can also complain to the ICO:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
Last updated: September 2025
