Optimise Privacy & Cookies Policy

Effective Date: 18th September 2026

This Privacy & Cookies Policy explains how Thinking in Colour Ltd collects, uses, stores and protects personal information when you visit the Optimise website, make an enquiry, work with Optimise, arrange Optimise services for another person, or subscribe to Optimise communications.

1. Who we are

1.1    Optimise is a trading name of Thinking in Colour Ltd, a company registered in England and Wales under company number 14318764.

1.2    Thinking in Colour Ltd is the data controller responsible for personal information processed in connection with Optimise. In this policy, “we”, “us” and “our” refer to Thinking in Colour Ltd trading as Optimise, and “Katie” refers to the founder of Optimise, who personally delivers Optimise services.

1.3    Registered office: Candle Cottage, Trinity Close, Carlton-Le-Moorland, Lincoln, LN5 9GP
Email: hello@optimiseyourjourney.com
Website: https://www.optimiseyourjourney.com
ICO registration: ZB603928

1.4    Katie is responsible for data protection matters at Optimise. If you have questions about how your personal information is used, or wish to exercise your data-protection rights, please contact us using the email address above.

2. Scope of this policy

2.1    This policy applies to visitors to our website, people who make enquiries, clients, contacts at employers or other organisations that fund or arrange our services (“Funders”), newsletter subscribers and anyone else who contacts us.

2.2    This policy does not apply to third-party websites or services that we link to, or that you choose to use to communicate with us, such as WhatsApp. Those providers have their own privacy notices.

2.3    This policy should be read together with the Optimise Terms of Service.

3. The information we may collect

3.1    The information we collect depends on how you interact with Optimise. It may include:

(a)     identity and contact information, such as your name, email address, telephone number and postal address;

(b)     enquiry information, such as what you tell us when you first get in touch or during an Initial Conversation;

(c)     client information, such as your goals for the work, relevant background you choose to share, information relevant to suitability and safety, working notes and materials created during the work;

(d)     booking and administrative information, such as appointment dates, attendance, cancellations, and records of your requests and consents;

(e)     financial information, such as invoices, payment records and the payer details shown on bank transfers;

(f)      Funder information, such as the name of the organisation, contact details for its representatives and any reporting arrangements agreed with you;

(g)     communications, such as emails and WhatsApp messages;

(h)     community information, where you join our online community platform, such as your profile, posts, comments and participation in online events;

(i)      marketing information, such as your subscription status and preferences; and

(j)      website and technical information, such as your IP address, device and browser type, pages visited and cookie choices.

3.2    We aim to collect only information that is reasonably necessary for the relevant purpose.

4. Special-category and other sensitive information

4.1    The nature of psychology-informed performance and personal-development work means that you may sometimes choose to discuss information that data-protection law regards as special-category personal data, such as information concerning physical or mental health, racial or ethnic origin, religious or philosophical beliefs, political opinions, sex life or sexual orientation.

4.2    You may also occasionally mention information about criminal allegations, proceedings or convictions. We will only record this where it is genuinely necessary.

4.3    You decide what you share. We will only record special-category or other sensitive information where it is relevant and necessary for the work, and where an appropriate condition under data-protection law applies, as explained in section 7. We take particular care to limit the collection, access and retention of this information.

4.4    During sessions you may also share information about other people, such as family members or colleagues. We treat that information with the same confidentiality and record it only where necessary.

5. Where we obtain information

5.1    Most of the information we hold is provided by you. We may also receive information from:

(a)     a Funder, such as your name, contact details and the arrangements it has agreed with us;

(b)     a person who refers you to Optimise, where you have asked them to do so;

(c)     our service providers, such as website, email-marketing and payment information; and

(d)     your device, through cookies and similar technologies, as explained in section 21.

6. How we use your information and our lawful bases

6.1    We use personal information only where we have a lawful basis under the UK GDPR. We use it for the following purposes:

(a)     to respond to enquiries and hold Initial Conversations, on the basis that this is necessary to take steps at your request before entering into a contract or, for general enquiries, our legitimate interests in responding to people who contact us;

(b)     to provide the Services, including arranging and delivering sessions, keeping proportionate working notes and managing bookings and cancellations, on the basis that this is necessary to perform our contract with you;

(c)     to invoice, keep accounting records and meet tax obligations, on the basis of legal obligation and performance of our contract;

(d)     to arrange and invoice funded work, on the basis of our contract with the Funder and our legitimate interests in administering funded Services;

(e)     to keep records needed to deal with complaints, insurance requirements and legal claims, on the basis of our legitimate interests in protecting our business and responding fairly to concerns;

(f)      to respond to serious safety or safeguarding concerns, on the basis of our legitimate interests (which may include recognised legitimate interests relating to safeguarding and emergencies), to protect vital interests or to comply with a legal obligation, depending on the circumstances;

(g)     to operate and secure our website, on the basis of our legitimate interests in running a secure and functional website and, for non-essential cookies, your consent;

(h)     to send newsletters and marketing communications, on the basis of your consent or, where permitted by law for existing clients, our legitimate interests in telling you about similar services, with the option to opt out at any time;

(i)      to operate our online community platform and deliver digital content and online events to members, on the basis that this is necessary to perform our contract with you; and

(j)      to comply with legal and regulatory obligations and respond to requests to exercise your data-protection rights, on the basis of legal obligation.

6.2    Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You can contact us for more information about that assessment.

6.3    We do not use client information for unrelated purposes simply because we hold it.

7. How we process special-category information

7.1    Where we process special-category information, we rely on the following conditions in addition to a lawful basis under section 6:

(a)     Explicit consent. We will ask for your explicit consent, in writing and separately from your agreement to our Terms, before recording special-category information in your working notes and client record.

(b)     Legal claims. We may retain or use special-category information where this is necessary for the establishment, exercise or defence of legal claims, including after the work has ended.

(c)     Vital interests. We may use or disclose information where this is necessary to protect your vital interests or those of another person and you are physically or legally incapable of giving consent.

(d)     Safeguarding and confidential support. In exceptional circumstances, we may rely on the conditions in Schedule 1 to the Data Protection Act 2018 relating to the safeguarding of children and individuals at risk, or to the provision of confidential counselling, advice or support, where the requirements of those conditions are met, for example where consent cannot reasonably be obtained.

7.2    We will only process information about criminal allegations, proceedings or convictions where a condition in Schedule 1 to the Data Protection Act 2018 applies, such as your consent or the establishment, exercise or defence of legal claims.

7.3    We keep records of the conditions we rely on and of the consents we obtain.

8. Your consent and withdrawing it

8.1    Where we rely on your consent, you may withdraw it at any time by contacting us. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

8.2    If you withdraw your consent to us recording special-category information, we will stop recording that information. Because proportionate notes are part of how the work is delivered safely and effectively, Katie will discuss with you whether and how the work can continue. We may continue to retain existing records where another condition applies, for example where they are needed in connection with legal claims.

9. Whether you must provide information

9.1    You are not legally required to provide personal information to us. However, we need some information to enter into and perform our contract with you, including your contact details, payment information and information relevant to whether the work is suitable and safe. If you do not provide it, we may be unable to provide the Services. Subscribing to our newsletter is entirely optional.

10. Confidentiality

10.1  Personal information relating to your work with Optimise is treated confidentially. We do not sell client information.

10.2  Katie receives regular professional supervision. Aspects of the work may be discussed in supervision in a form that does not identify you, and supervisors are subject to obligations of confidentiality.

10.3  We only share information about you as described in sections 11, 13 and 14, or with your agreement.

11. Employer- and organisation-funded work

11.1  Where a Funder pays for or arranges your work with Optimise, funding does not give the Funder access to the content of your sessions.

11.2  We may share with the Funder the administrative information needed to arrange and invoice the work, such as your name, the Services purchased and invoice details.

11.3  Any additional reporting or information-sharing, such as attendance or progress information, will only take place if you have agreed to it in writing in advance. The agreement will set out what will be shared, and you may withdraw it for the future at any time.

11.4  The Funder is responsible, as a separate controller, for any information it receives from us.

12. Client records and working notes

12.1  Katie may make working notes and maintain records relating to your Optimise work where these are reasonably necessary. Notes are intended to be proportionate to the purpose of the work rather than a comprehensive record of everything discussed.

12.2  Working notes are created using a password-protected reMarkable device, which stores and synchronises notes using reMarkable's associated cloud service. Related business records are stored in Google Workspace.

12.3  Appropriate security measures are used to protect client records, and access is restricted to Katie and, where necessary, to service providers acting on our instructions.

12.4  You may ask for a copy of the information we hold about you, including working notes, under your right of access described in section 23. Some information may be withheld where the law allows, for example where disclosure would reveal information about another person.

13. Service providers

13.1  We use third-party service providers to operate Optimise. These currently include:

(a)     Squarespace, for website hosting and functionality;

(b)     Google Workspace, provided by Google, for our email, calendar and business file storage;

(c)     Zoom, for online sessions;

(d)     Bilateral Base, an online platform used to support bilateral stimulation where EMDR-informed methods are used online;

(e)     Circle, for our online community platform, including digital content, community discussion and online events;

(f)      QuickBooks, provided by Intuit, for invoicing, accounting and financial administration;

(g)     reMarkable, for working notes and associated storage and synchronisation;

(h)     WhatsApp Business, for practical and administrative communications where you choose to use it; and

(i)      our bank and payment providers, for receiving payments.

13.2  Where these providers act as processors, they process personal information only on our instructions and under written terms that require them to protect it. Some providers, such as messaging services and banks, act as separate controllers for some of their processing.

13.3  We may also share information with our accountant, professional advisers and insurers where necessary. They are subject to duties of confidentiality.

13.4  We do not currently use an email-marketing platform. If we introduce one, this policy will be updated before it is used.

13.5  Other providers may be introduced or replaced as Optimise evolves. We take reasonable steps to consider data-protection and security arrangements when selecting providers, and we will update this policy where appropriate.

14. Other disclosures

14.1  Information may also be disclosed:

(a)     where required or permitted by law, or by a court, regulator or law enforcement authority;

(b)     where necessary in connection with legal proceedings or to establish, exercise or defend legal rights;

(c)     in exceptional circumstances involving a serious safety or safeguarding concern, including to emergency services; and

(d)     if the Optimise business is transferred or restructured, in which case client information would only be transferred where lawful and subject to confidentiality, and we would tell you in advance.

14.2  Where reasonably possible and appropriate, Katie will discuss any disclosure about you with you before it is made.

15. International transfers

15.1  Some service providers, or their subprocessors, may process personal information outside the UK.

15.2  Where personal information is transferred outside the UK, we take steps to ensure that the transfer is permitted under UK data-protection law. Depending on the destination and provider, this may include reliance on UK adequacy regulations, including those covering the European Economic Area, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or the International Data Transfer Agreement or International Data Transfer Addendum to the European Commission's standard contractual clauses.

15.3  You can contact us for more information about the safeguards that apply to a particular transfer.

16. Clients outside the UK

16.1  If you receive online Services while located outside the UK, information you send to us, and information we send to you, will necessarily travel between the UK and your location.

16.2  If you are in the European Union or European Economic Area and we offer Services to you there, the EU General Data Protection Regulation may also apply to our processing of your information. Where it does, you have rights equivalent to those described in section 23 and you may also complain to the data protection supervisory authority in the country where you live or work.

16.3  If you live elsewhere, local privacy laws may give you additional rights. Please contact us if you would like to exercise them.

17. How long we keep information

17.1  We retain personal information only for as long as reasonably necessary for the purposes for which it is held, taking account of legal, regulatory, insurance, accounting and legitimate business requirements. In summary:

(a)     enquiry information that does not lead to work beginning is normally kept for 12 months from our last contact;

(b)     client records and working notes are kept for up to seven years after the client relationship ends, meaning the date of the last session or the last contact about the Services, whichever is later. This period reflects the time within which legal claims relating to the Services may be brought, together with a short additional period to allow claims to be notified and dealt with. Records are reviewed when the work ends so that information no longer needed is removed;

(c)     financial and accounting records are kept for the periods required by law, which is normally six years from the end of the financial year to which they relate;

(d)     Funder administration records are kept for the duration of the arrangement and six years afterwards;

(e)     routine administrative emails and WhatsApp messages are deleted periodically once they are no longer needed, and any information that needs to be kept is moved into the client record;

(f)      marketing information is kept until you unsubscribe or it is no longer appropriate to keep it, although we keep a limited record of your unsubscribe request so that we can respect it;

(g)     complaint and legal records are kept for as long as necessary to resolve the matter and for six years afterwards, or longer if proceedings are brought;

(h)     community platform information is kept while your membership continues and for 12 months afterwards, although posts may remain visible to other members unless removed; and

(i)      cookie information is kept for the periods set out in our cookie controls.

17.2  We may keep information for a shorter or longer period where there is a specific reason, such as an ongoing complaint or claim. When information is no longer required, it is securely deleted or anonymised.

18. Security

18.1  We take appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, unauthorised access, disclosure or destruction.

18.2  These measures may include password or passcode protection, multi-factor authentication, access controls, encryption provided by relevant technology services, secure devices and careful selection of third-party providers.

18.3  No electronic system can be guaranteed to be completely secure, but security arrangements are reviewed in light of the nature and sensitivity of the information being processed.

18.4  If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay.

19. Email, messaging and online sessions

19.1  Email and WhatsApp may be used for practical and administrative communication. Clients are asked not to use these channels for substantive Optimise work or to send sensitive information unnecessarily.

19.2  Electronic communications carry inherent privacy and security risks. We therefore encourage clients to keep messages proportionate to their administrative purpose.

19.3  Neither email nor WhatsApp is continuously monitored and they must not be relied upon for urgent or crisis support.

19.4  Online sessions normally take place using Zoom. Where EMDR-informed methods are used online, we may also use Bilateral Base, a separate platform that supports bilateral stimulation. We will tell you before it is used.

19.5  Online sessions are not audio or video recorded, and transcription or artificial intelligence note-taking tools are not used, unless this has been agreed in advance in writing.

20. Marketing communications and our online community

20.1  You will only receive Optimise newsletters or marketing communications where we are permitted by law to send them. This means we will ask for your consent, unless you are an existing client, we are telling you about similar services and you were given a simple way to opt out when your details were collected and in every message.

20.2  We do not currently use an email-marketing platform, and we do not use special-category information for marketing. If we introduce an email-marketing provider, we will update this policy and tell you which provider we use before sending communications through it.

20.3  You can unsubscribe at any time using the unsubscribe link contained in marketing emails or by contacting hello@optimiseyourjourney.com.

20.4  Unsubscribing from marketing does not affect administrative communications necessary in connection with an enquiry or existing Services.

20.5  If you join our online community platform, the information you post there can be seen by other members and by us. Please share only what you are comfortable for others to see, and do not post sensitive information about yourself or others. Community information is processed on the basis of our contract with you or your consent, and is retained while your membership continues and for a short period afterwards.

21. Cookies and similar technologies

21.1  Cookies are small files placed on your device when you visit a website. Similar technologies, such as pixels and local storage, work in a comparable way. In this section, “cookies” includes those technologies.

21.2  The Optimise website, which is hosted on Squarespace, uses the following types of cookies:

(a)     Strictly necessary cookies, which are required for the website to function and remain secure. These do not require your consent.

(b)     Analytics and functionality cookies, which help us understand how the website is used and remember your choices. We use these only with your consent or, where the law allows certain technologies of this kind to be used without consent, after giving you clear information and a simple way to object.

(c)     Marketing and third-party cookies, including those set by embedded content or integrations. We use these only with your consent.

21.3  You can manage your cookie preferences through the cookie controls on our website, and change your choices at any time. You can also block or delete cookies through your browser settings, although some parts of the website may not work properly if you do.

21.4  We may update the technologies used over time and this policy will be updated where appropriate.

22. Automated decision-making and children

22.1  We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

22.2  Optimise services are provided only to adults aged 18 and over, and our website is not directed at children. If we become aware that we hold information about a child without an appropriate basis, we will delete it.

23. Your data-protection rights

23.1  Depending on the circumstances, UK data-protection law gives you the following rights:

(a)     the right of access to your personal information;

(b)     the right to have inaccurate information corrected;

(c)     the right to have your information erased;

(d)     the right to restrict how your information is used;

(e)     the right to data portability, where applicable;

(f)      the right to object, as explained in paragraph 23.2;

(g)     the right to withdraw consent where processing is based on consent; and

(h)     rights relating to automated decision-making.

23.2  Your right to object. You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. You also have the right to object at any time to the use of your information for direct marketing, in which case we will stop using it for that purpose.

23.3  These rights are not absolute, and whether a particular right applies depends on the circumstances and the lawful basis for processing.

23.4  To exercise a right or ask a question about your personal information, contact hello@optimiseyourjourney.com. We do not normally charge a fee. We will respond within one month, which may be extended by up to two further months for complex or numerous requests. We may need to verify your identity or ask you to clarify your request before responding, and the time for responding may pause while we wait for that information.

24. Complaints

24.1  If you have concerns about how we have handled your personal information, you can complain to us at hello@optimiseyourjourney.com or by letter to our registered office. We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to look into it without undue delay, keep you informed of progress and tell you the outcome.

24.2  You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. The ICO can be contacted at https://www.ico.org.uk, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. The ICO will usually expect you to have raised your complaint with us first.

25. Changes to this policy and contact

25.1  We may update this Privacy & Cookies Policy from time to time to reflect changes to Optimise, the technology and providers we use, or applicable law and regulatory guidance.

25.2  The current version will be published on the Optimise website with its Effective Date. Where changes are significant, we will take reasonable steps to tell existing clients.

25.3  Questions about this policy can be sent to hello@optimiseyourjourney.com.