Privacy Policy

Riverstone & Willow (“we”, “us”, or “our”) is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

The data controller responsible for your personal data is:

We collect the following categories of personal data:

4.1 Identity & Contact Data

• Name (first name, last name)
• Email address
• Phone number (optional)
• Preferred language

4.2 Appointment Data

• Booking dates and times
• Service type selected
• Session notes (stored with your consent)
• Appointment history

4.3 Technical Data

• IP address (anonymized after 7 days)
• Browser type and version
• Device type
• Pages visited and usage patterns

4.4 Payment Data

• Transaction records
• Payment method (card details are processed by PCI-compliant payment processors and not stored by us)

4.5 Special Category Data

During counseling sessions, you may share information about your mental health, relationships, or personal circumstances. This information is treated with the highest level of confidentiality and is processed only with your explicit consent for the purpose of providing counseling services.

We process your personal data based on the following legal grounds (Art. 6 GDPR):

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide our counseling services
• Consent (Art. 6(1)(a)): For special category data and marketing communications
• Legitimate Interest (Art. 6(1)(f)): For website analytics and service improvement
• Legal Obligation (Art. 6(1)(c)): For tax and accounting requirements

Processing of special category data (health-related information) is based on your explicit consent (Art. 9(2)(a) GDPR).

We publish client reviews on our website to help prospective clients make informed decisions. The following describes how we handle data submitted through the review feature.

6.1 What We Collect When You Submit a Review

• Name (as you choose to display it)
• Email address
• IP address (stored only as a one-way hash)
• Review rating and text
• Optional content warning
• Timestamp of consent

6.2 Purpose

• Publishing the review on our website
• Contacting you about your review (e.g., sending removal links)
• Abuse prevention and moderation

6.3 Lawful Basis (GDPR Art. 6/7)

• Consent (Art. 6(1)(a)): for publication of your review on our website
• Legitimate Interest (Art. 6(1)(f)): for storing the IP hash and email to prevent abuse and to honor right-to-erasure follow-up requests

6.4 What Is Shown Publicly

Only the following is visible on the public review card: your name (according to the display preference you chose — full name, first name only, or anonymous), the rating, the review text, the content warning (if any), and the date. Your email address and IP hash are never shown publicly.

6.5 Verified vs Unverified Reviews

Reviews submitted via a personal token sent to enrolled clients after a completed session are marked as verified. Reviews submitted through the public form (without a token) are marked as unverified. The label appears on each review card so readers can weigh them appropriately.

6.6 Right to Remove Your Review

You may remove your review at any time. Visit /reviews/remove to request removal. After publication we send a removal link to the email address you provided; if you lose that link, request a new one through the same page.

6.7 Retention of Reviewer Contact Data

The review content itself remains public until you remove it. The associated guest_email and guest_ip_hash fields are automatically nulled 24 months after publication, unless the review has been reported — in which case they are retained for the duration of moderation review.

6.8 DSA Notice-and-Action

Anyone may report a review using the “Report” link on each review card. Reports are reviewed within 48 hours in accordance with the EU Digital Services Act notice-and-action requirements.

We use the following EU-compliant third-party services:

We use providers that offer GDPR-compliant data processing terms, with Standard Contractual Clauses applied to any onward transfers outside the EU/EEA where required.

We keep personal data only as long as is necessary for the purposes for which it was collected, or as long as is required by applicable law. Retention is governed by the principle of data minimisation (GDPR Art. 5(1)(c)).

Active vs. Archived: If a client has not booked a session for 12 consecutive months, their records are moved to a secure archived state — removed from day-to-day systems and held in a restricted-access vault until the applicable retention period ends.

• Account & Session Data: up to 3 years after last session (archived after 12 months of inactivity). This aligns with the general civil-law limitation period and is not a clinical-record retention; our services are non-medical and non-therapeutic.
• Invoices & Payment Records: 10 years, to comply with commercial bookkeeping and tax obligations (e.g. § 147 AO in Germany; equivalent rules apply in other EU jurisdictions).
• Technical Logs: anonymised or deleted after 7 days.
• Marketing Data: until consent is withdrawn.
• Support & Contact-Form Correspondence: up to 2 years after the last exchange, unless tied to an ongoing matter.

You may request earlier deletion under Art. 17 GDPR; records subject to legal retention (e.g. tax and bookkeeping) will remain in a minimised form until their statutory period ends.

Under GDPR, you have the following rights:

To exercise these rights, contact us at: contact@riverstonewillow.com

Right to Lodge a Complaint: You have the right to lodge a complaint with the data protection supervisory authority of your country of residence (or place of work, or place of the alleged infringement) if you consider that the processing of your personal data infringes the GDPR.

Our website uses the following types of cookies:

• Essential Cookies: Required for website functionality (no consent needed)
• Analytics Cookies: Help us understand how visitors use our site (consent required)

We use Vercel Analytics for privacy-focused website analytics. This tool is designed to be GDPR-compliant and does not use cookies for tracking visitors across websites.

We implement the following security measures to protect your data:

• TLS/SSL encryption for all data in transit (HTTPS)
• AES-256 encryption for data at rest
• Authenticated HTTPS access only for remote counsellor work — no client records stored on local devices outside the EU
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements
• Staff training on data protection

Our services are intended for individuals 18 years of age or older. We do not knowingly collect personal data from children under 16. For minors between 16-18, parental consent is required for counseling services.

We may update this Privacy Policy from time to time. Significant changes will be communicated via email or website notice. The “Last Updated” date at the top of this policy indicates when it was last revised.