Last updated: 12 October 2026
This policy sets out how Reverie handles personal data in line with the EU General Data Protection Regulation (GDPR) and, where it applies, the UK GDPR. It complements our Privacy Policy, which explains in plain terms what we collect and why.
The purpose of this policy is to make sure that personal data about clients, enquirers, website visitors and anyone else we deal with is handled lawfully, fairly and securely. It applies to all personal data we hold, in any form, including email, notes, recordings, documents and the materials we create with clients.
Reverie is operated by Leila Simpson, based in Madeira, Portugal, who is the data controller and is responsible for compliance with this policy. We are a very small practice and are not required to appoint a Data Protection Officer. Anyone who helps us in future, as a contractor or volunteer, will be required to keep personal data confidential.
Contact: leila@reverie.care
We follow the seven principles set out in Article 5 of the GDPR. Personal data must be:
Before using personal data we identify the lawful basis that applies: your consent, a contract or steps you ask us to take before one, a legal obligation, or our legitimate interests (where these are not outweighed by your rights). The bases we rely on for each purpose are listed in our Privacy Policy.
Because our work is about death, dying and loss, we may be told about someone’s health, medical wishes, family circumstances or beliefs. This is special category data. We process it only with the person’s explicit consent, which we obtain and keep a record of before work begins, and we try to collect no more of it than is needed to help.
We keep client records after our work together ends on the basis of our legitimate interests and, for sensitive information, the establishment, exercise or defence of legal claims (Article 9(2)(f)), so that we can resolve any complaint or legal matter.
Where we rely on consent, it is freely given, specific, informed and unambiguous. We keep a record of when and how it was given, make it as easy to withdraw as to give, and stop the relevant processing promptly when it is withdrawn.
What clients tell us is confidential. We share personal data with other people only when:
We share only what is necessary for the purpose.
We keep personal data only for as long as we need it, then delete it. Our usual maximum periods are:
| Type of data | Retention period |
|---|---|
| Enquiries and booking details where no services follow | Up to 12 months after last contact |
| Client records (contact details, session notes, plans) | 7 years after our work together ends |
| Invoices and financial records | 10 years, as required by Portuguese tax and accounting law |
| Recordings of sessions (only by agreement) | Deleted within 60 days |
We keep client records for this period in case we need them to resolve a complaint or a legal matter. After these periods we delete the data.
If someone asks us to delete their data, we do so without undue delay unless we have a legal reason to keep it, in which case we will explain.
We protect personal data with appropriate technical and organisational measures that are proportionate to the risk. In practice this includes restricting access to the people who need it, using password-protected accounts and devices, and using an encrypted (HTTPS) connection to this website. We ask people not to put sensitive information in the website contact form.
We use only service providers that offer appropriate data protection commitments, and we limit what they can do with personal data to what we instruct. Our current providers are listed in the Privacy Policy. Google acts as our processor under its Cloud Data Processing Addendum, which we have accepted. Where personal data is transferred outside the European Economic Area, we make sure an appropriate safeguard is in place, such as the EU-US Data Privacy Framework or Standard Contractual Clauses.
People have rights to access, correct, erase, restrict and port their data, to object to processing, and to withdraw consent. To make a request, email leila@reverie.care. We will:
If personal data is lost, stolen or accessed without permission, we will act quickly to contain it, assess the risk to the people affected, and keep a record of what happened and what we did. Where the law requires it, we will report a breach to the Comissão Nacional de Proteção de Dados (CNPD) within 72 hours of becoming aware of it, and tell the people affected without undue delay.
We keep appropriate records of the personal data we process and why. We review this policy from time to time, and whenever our services or the law change.
Questions about this policy, or concerns about how we handle personal data: leila@reverie.care. You also have the right to complain to a data protection authority, as described in our Privacy Policy.
