Privacy Notice

Last updated: 10 August 2026

PBS ABA UK respects your privacy and is committed to handling personal data carefully, lawfully and transparently. This notice explains how PBS ABA UK collects, uses, stores and shares personal data when you use this website, contact PBS ABA UK, request or attend a Behaviour Clarity Session, subscribe to educational emails, apply for or purchase a service, or communicate during or after a service.

1. Who is responsible for your data

PBS ABA UK is the data controller for the personal data covered by this Privacy Notice.

Simbarashe Shamu trading as PBS ABA UK
37 Hollybush Road
North Walsham
NR28 9XT
Email: sim@pbsaba.co.uk

Please contact sim@pbsaba.co.uk if you have a question about this notice, how your information is handled, or your data protection rights.

2. What personal data I collect

The information collected depends on how you interact with PBS ABA UK. I may collect the following categories of personal data:

Identity and contact data

  • adult name
  • email address
  • telephone number where needed
  • postal address where relevant to a paid service or legal requirement

Enquiry and communication data

  • information you provide when contacting PBS ABA UK
  • email and website-form messages
  • records of correspondence and service-related communication

Behaviour Clarity Session screening and booking data

  • country and local area
  • child age range
  • broad concern category
  • a short description of what you want to clarify
  • brief answers about immediate injury risk, safeguarding or crisis concerns, and sudden change, pain or illness
  • booking date, time, adult name and adult email address
  • source information, such as whether you came from YouTube, search, an article, email, social media or a recommendation

Service and professional-record data

  • consultation notes
  • Behaviour Clarity Notes
  • intake and assessment information
  • selected behaviour or routine information
  • reports, plans, feedback and review notes
  • consent, scope, complaints, cancellation and service-administration records

Child and family information

  • information about the child, family circumstances and home routines where relevant to the requested service
  • behavioural, developmental, educational, communication, support, safety and safeguarding information that is necessary and proportionate

Special category data

  • health, disability, mental health, neurodevelopmental, medication, pain, sleep, safeguarding or other sensitive information where relevant and lawfully provided

Payment and transaction data

  • purchase and invoice records
  • payment status
  • limited billing information; full card details are processed by Stripe and are not stored by PBS ABA UK

Technical and website-use data

  • IP address
  • browser and device information
  • cookie and analytics data
  • pages visited and website interactions

Marketing data

  • whether you opted in to educational or marketing emails
  • email engagement information where enabled
  • communication preferences and unsubscribe status

3. How I collect personal data

  • directly from you when you complete a form, contact me, book or attend a session, purchase a service, or communicate with me
  • from the adult who is requesting support for a child
  • from service materials you provide, such as intake forms, selected records, brief event information or other agreed evidence
  • from your use of the website through cookies and analytics tools
  • from providers involved in website operation, email, booking, meetings, storage, payment and administration
  • from another person or professional where you have asked or authorised them to provide information, or where sharing is otherwise necessary and lawful for safety, safeguarding or legal reasons

4. How I use personal data

  • respond to enquiries and provide information you request
  • review suitability and safety information before offering a Behaviour Clarity Session or paid service
  • send the appropriate booking or review route after a suitability form is submitted
  • schedule, confirm, remind, cancel or rearrange appointments
  • deliver remote consultations and paid services
  • create and send Behaviour Clarity Notes, reports, plans and service communications
  • make and document human professional decisions about fit, scope, safety, health, safeguarding, referral and next steps
  • administer payments, contracts, complaints, records, insurance and legal obligations
  • send educational or marketing emails only where there is an appropriate legal basis and the required permission
  • operate, secure and improve the website and service systems
  • protect the rights, safety and legitimate interests of children, families, PBS ABA UK and others
  • comply with legal, regulatory, safeguarding, professional and insurance requirements

5. Lawful bases for processing

The lawful basis depends on the purpose and whose information is being processed. PBS ABA UK may rely on the following bases under Article 6 of the UK GDPR:

Steps at your request before entering into a contract and contract
For adult information needed to review an enquiry, arrange a requested consultation, enter into a service agreement or deliver a paid service.

Legitimate interests
For proportionate business administration, service quality, security, records, complaints, professional accountability and necessary child information where the child is not a party to the adult purchaser’s contract. These interests are balanced against the child’s and family’s rights, reasonable expectations and best interests.

Consent
For optional educational or marketing emails, non-essential cookies and any other processing where consent is the appropriate basis.

Legal obligation
Where processing is required by law, regulation, tax, accounting, court order or another binding duty.

Vital interests
In a limited emergency where processing is necessary to protect someone’s life and the legal conditions are met.

The basis used for one purpose may be different from the basis used for another purpose. Withdrawing marketing consent does not stop necessary service or legal communications.

6. Special category data and children’s data

Behaviour support enquiries and services may involve special category information, particularly health, disability, mental health, neurodevelopmental or safeguarding information. Special category data is processed only where there is both an Article 6 lawful basis and an additional condition under Article 9 of the UK GDPR.

For special category information that you choose to provide for suitability screening or a Behaviour Clarity Session, PBS ABA UK relies on your explicit consent under Article 9(2)(a), together with the relevant Article 6 basis. The Form records the consent wording, your identity and the date/time of your agreement. It is separate from marketing consent. You may withdraw consent at any time by contacting sim@pbsaba.co.uk; where the information is necessary to review safety or suitability or to provide the requested session, withdrawal may mean that PBS ABA UK cannot continue that part of the service.

In limited circumstances, another condition permitted by law may apply, for example where processing is necessary for legal claims, to protect life when a person cannot consent, or for a safeguarding purpose that meets the relevant legal tests. Any such use is limited to what is necessary and is documented.

Children’s information is handled with additional care. I aim to collect only what is necessary, consider the child’s best interests, and involve the child according to age, understanding, communication and context. A parent or person with parental responsibility may normally provide information and permissions for a younger child, but the child’s own rights, views, assent and capacity remain relevant.

7. Behaviour Clarity Session pathway and Google Workspace

The current Behaviour Clarity Session pathway uses the controlled PBS ABA UK Google Workspace environment:

  • Google Forms for the minimum suitability and safety questions
  • Google Sheets and Google Apps Script for restricted response handling and route-triggered emails
  • Google Calendar appointment scheduling for adult name, adult email address, appointment time and Google Meet link
  • Google Meet for the remote session
  • Gmail and restricted Google Drive files for professional communication, records and Behaviour Clarity Notes

Sensitive child, behaviour, health and safeguarding information is kept out of the public booking page. The booking page is used only for adult administrative scheduling information.

The form uses limited rule-based automation. If all three safety questions are answered “No”, an email containing the private booking link is sent. If any answer is “Yes”, “Not sure” or missing, no booking link is sent automatically and the response is flagged for human review. This automation does not make a final clinical, safeguarding, suitability or service decision. Those decisions remain with the practitioner.

8. Marketing emails and educational updates

Marketing permission is separate from service access. Completing a suitability form, booking a session or purchasing a service does not automatically add you to general marketing.

If you actively opt in, MailerLite is used to send occasional educational or marketing emails. You can unsubscribe at any time using the link in an email or by contacting sim@pbsaba.co.uk. Service-related emails, appointment messages and professional follow-up are not marketing and may be sent where necessary to provide or administer the requested service.

9. Payments

Payments are processed through Stripe. PBS ABA UK may receive information such as your name, email address, payment status, transaction reference and limited billing information needed to manage the transaction, provide the service and meet accounting obligations. PBS ABA UK does not receive or store full card details on its own systems.

10. Cookies, analytics and website tools

The website may use WordPress and website plugins, CookieYes, Google Analytics, Google Search Console, and embedded content such as YouTube or Vimeo. These tools may collect technical and usage information.

Strictly necessary technologies are used to operate and secure the website. Non-essential cookies and analytics are used only where the required consent has been obtained. Screening answers, child details and health or safeguarding information must not be placed in analytics parameters or marketing systems.

11. Service providers and who I share data with

PBS ABA UK does not sell personal data. Personal data may be shared only where necessary and proportionate with:

  • Google Workspace, including Forms, Sheets, Apps Script, Calendar, Meet, Gmail and Drive
  • WordPress, website hosting and necessary website plugins
  • CookieYes, Google Analytics, Google Search Console and embedded media providers
  • MailerLite for separately consented educational or marketing email
  • Stripe for payment processing
  • professional advisers, supervisors or consultants where appropriate and subject to confidentiality
  • insurers, regulators, courts, legal advisers or authorities where reasonably necessary
  • health, safeguarding, emergency or law-enforcement bodies where sharing is required or lawfully necessary to protect someone from serious harm

As a general rule, service information is not shared with schools, professionals, relatives or other third parties unless you request or authorise this, it is necessary for the agreed service and appropriate permissions are in place, or sharing is otherwise required or permitted by law.

12. International transfers

Some providers or their subprocessors may store or process personal data outside the UK. PBS ABA UK does not assume that all data remains in the UK.

Where UK personal data is transferred internationally, the provider and PBS ABA UK must use an appropriate transfer mechanism where required, such as a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard. You may contact sim@pbsaba.co.uk for more information about the safeguards relevant to a particular provider or transfer.

13. How long I keep personal data

Personal data is kept only for as long as needed for the stated purpose, or longer where a documented legal, safeguarding, insurance, complaint-handling or professional reason applies. The current retention guide is:

General enquiries and contact messages
Normally up to 12 months after the last meaningful contact.

Suitability forms that do not lead to a session or service
Normally up to 6 months after submission, route closure or the last meaningful contact.

Completed free Behaviour Clarity Session records
Normally up to 12 months after the session or last meaningful contact, unless the person proceeds to a paid service or a longer period is justified for safeguarding, complaints, insurance or legal claims.

Paid service records
Normally 7 years after the end of the service. A longer period may be used only where a documented legal, safeguarding, insurance or professional reason applies, particularly where records relate mainly to a child.

Marketing subscriber data
Until you unsubscribe or withdraw consent. Inactive subscriber data may be reviewed and deleted after up to 24 months. A minimal suppression record may be kept to ensure that an unsubscribe request continues to be respected.

Payment and financial records
For the period required by tax, accounting, fraud-prevention and legal obligations.

Website analytics and cookie data
In accordance with the configured settings of the relevant tool and only for as long as reasonably necessary.

When personal data is no longer required, it is securely deleted, anonymised or put beyond ordinary use in accordance with the relevant system’s deletion process and any necessary backup cycle.

14. How I keep data secure

  • a business Google Workspace account controlled by PBS ABA UK
  • enforced two-step verification for the Workspace account
  • restricted access and no open public sharing links for client records
  • data minimisation and separation of screening, booking, marketing and payment information
  • password-protected devices and reasonable device-security controls
  • professional confidentiality, secure deletion and incident-response procedures
  • careful use of email and generic, non-sensitive appointment titles

No method of transmission or storage is completely secure. If a suspected personal-data breach occurs, PBS ABA UK will investigate, contain and document it, and notify affected people or the ICO where legally required.

15. Recording, AI and automated processing

Behaviour Clarity Sessions are not recorded or automatically transcribed by default. Recording or transcription would require a specific need, appropriate legal basis, clear information, agreement and additional safeguards.

Identifiable child or family information is not uploaded to a general-purpose AI system. AI may be used for non-identifiable, anonymised or appropriately redacted business and drafting tasks only within an approved process and with human review.

PBS ABA UK does not use solely automated decision-making or profiling that produces legal or similarly significant effects. The limited form-routing automation described in section 7 only controls which administrative email is sent and when a human review is required.

16. Your data protection rights

Depending on the circumstances and lawful basis, you may have the right to:

  • be informed about how personal data is used
  • request access to personal data
  • request correction of inaccurate or incomplete data
  • request deletion of data
  • request restriction of processing
  • object to processing based on legitimate interests or to direct marketing
  • request data portability in some circumstances
  • withdraw consent where processing is based on consent
  • complain to the Information Commissioner’s Office

These rights are not absolute and may not apply in every situation. To exercise a right, contact sim@pbsaba.co.uk. I may need to verify your identity before acting on a request.

Right to object to direct marketing: you may object at any time. PBS ABA UK will stop using your personal data for direct marketing and will retain only the minimum information needed to respect your choice.

17. Complaints

If you have a concern about how your personal data is handled, please contact sim@pbsaba.co.uk first so I have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. The ICO’s current contact and complaint information is available at ico.org.uk.

18. Third-party websites and embedded content

This website may link to or embed third-party websites, videos, forms, booking pages, payment services or other content. Those providers may process personal data under their own privacy notices and terms. PBS ABA UK is not responsible for the independent privacy practices of third-party sites.

19. Changes to this Privacy Notice

This notice may be updated when the service, technology, legal requirements or processing activities change. The latest version will be published on pbsaba.co.uk and the “Last updated” date will show when it was revised.