How we collect, use, and protect your personal data — in plain English.
Last updated: September 2026. This notice applies to all personal data collected via NarcissismKills.co.uk, including the Professionals Register and the Ident-A-Narc App subscription. If you have questions, contact us at professionals@NarcissismKills.co.uk.
The data controller and Data Protection Officer for this website is:
As the data controller and DPO, John Lyden is personally responsible for deciding how and why your personal data is processed, and for ensuring that processing remains lawful, fair, and transparent under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You may contact the DPO directly at any time using the details in Section 10.
ICO Registration: We intend to register with the Information Commissioner's Office (ICO) prior to processing personal data at scale. If you wish to verify registration status, you can search the ICO register.
We collect only the personal data necessary for the specific purpose it is collected for. The following table sets out what we collect and why:
| Data | Why We Collect It | Lawful Basis |
|---|---|---|
| First name and last name | To address you correctly in communications | Legitimate interest; Consent |
| Professional email address | To contact you about the Professionals Portal and related resources | Legitimate interest; Consent |
| Clinical role | To tailor content and resources to your clinical context | Legitimate interest |
| Registration body and number | To verify professional status (optional — number not required) | Legitimate interest |
| Organisation | To understand which services are engaging with this work | Legitimate interest |
| Years of experience | To contextualise the professional community | Legitimate interest |
| Primary interest (book / app / CPD) | To direct you to the most relevant resources | Legitimate interest |
| Consent records (with timestamp) | To demonstrate compliance with UK GDPR consent requirements | Legal obligation |
| IP address (registration event) | For security and fraud prevention only — not used for tracking | Legitimate interest |
| Voice audio (App users only) | Speech-to-text transcription via ElevenLabs Scribe API. Audio is sent securely, transcribed, and deleted immediately after the transcript is returned. Audio is not retained by ElevenLabs or by us after processing. | Consent (App subscription) |
| App subscription reference (App users only) | To manage your Ident-A-Narc App subscription via Stripe. We receive a payment reference and subscription status only — your card details are never transmitted to or stored by us. | Contract (Art. 6(1)(b)) |
| Transcripts (App users only) | STT transcripts generated by the App are stored on your device only. They are never transmitted to us or to ElevenLabs. | N/A — processed locally on your device |
⚠️ Important — App Users (Clinical Setting): Do not use the Ident-A-Narc App to record identifiable patient information. The App is designed for the observation and classification of behaviours only. Before using the speech-to-text feature, ensure your recording contains no patient names, dates of birth, NHS numbers, or other personal identifiers. Voice audio is transmitted to ElevenLabs for transcription; any audio containing special category health data (Art. 9 GDPR) must not be submitted. This responsibility rests with the clinician.
Under UK GDPR, we rely on the following lawful bases:
We have a legitimate interest in building and maintaining a professional community around clinical narcissism recognition. The professionals who register have a corresponding interest in accessing relevant CPD resources, clinical decision tools, and peer community. We have assessed that this legitimate interest is not overridden by your rights and freedoms.
Where we ask for your consent — specifically for sending you updates about new resources, research findings, and the App launch — we will only do so if you have explicitly opted in via a clear, affirmative checkbox. You may withdraw consent at any time.
We record the consent choices you make (including the timestamp) as required by UK GDPR Article 7 — to demonstrate that consent was freely given and properly recorded.
Your data will be used only for the following purposes:
We will never use your data for unrelated marketing, profiling, or automated decision-making that affects you.
We do not sell, rent, or share your personal data with third parties for their own purposes.
Your data is stored in a secure database hosted in the United Kingdom or European Economic Area. We do not currently use third-party email marketing platforms or CRMs. This site uses Google Analytics 4 (GA4, Measurement ID: G-2SL2HNW9FC) for anonymous page-view and session analytics. GA4 does not receive your name or email address. Data is processed by Google LLC under the EU–US Data Privacy Framework.
This website is hosted on a UK/EEA-based infrastructure. Any hosting provider we use is contractually bound as a data processor under UK GDPR Article 28 and may not use your data for their own purposes.
When you use the Ident-A-Narc App, the following sub-processors handle data on our behalf. Each is bound by a Data Processing Agreement (DPA) under UK GDPR Article 28 and may not use your data for their own purposes.
| Sub-Processor | Purpose | Country | Transfer Mechanism | Data Retained After Processing? |
|---|---|---|---|---|
| ElevenLabs, Inc. | Speech-to-text transcription (Scribe API). Receives voice audio; returns transcript text. | USA | Standard Contractual Clauses (SCCs) under UK GDPR Article 46 | No. Audio is deleted immediately after the transcript is returned. No audio or transcript is retained by ElevenLabs. |
| Stripe, Inc. | Payment processing and App subscription management. | USA / Ireland (EEA) | EU–US Data Privacy Framework; SCCs | Stripe retains payment references and subscription status. Card data is held by Stripe only — it is never transmitted to or stored by us. |
For further information on each sub-processor’s data practices:
We may disclose data if required to do so by law, court order, or the instruction of a regulatory authority. We will not do so voluntarily.
| Data Type | Retention Period | Rationale |
|---|---|---|
| Professionals Register entries | 3 years from registration, or until you request deletion | Consistent with professional CPD record-keeping norms |
| Consent records | 6 years from the date consent was given or withdrawn | Legal obligation: evidence of lawful processing |
| IP address (registration event) | 90 days | Security — automatically purged thereafter |
| Anonymised aggregates | Indefinitely | Statistical — no personal data retained after anonymisation |
At the end of the retention period, data will be securely deleted or anonymised. We will not retain data 'just in case'.
Under UK GDPR, you have the following rights. You can exercise any of these at any time by contacting us (see Section 10).
You can request a copy of all personal data we hold about you. We will respond within one month.
If any data we hold is inaccurate or incomplete, you can ask us to correct it.
You can ask us to delete your personal data. We will comply unless we have a legal obligation to retain it.
You can ask us to stop processing your data while we resolve a dispute about it.
You can request your data in a structured, commonly used, machine-readable format (e.g. CSV).
You can object to processing based on legitimate interest. We will stop unless we can show compelling grounds.
If processing is based on consent, you can withdraw it at any time. Withdrawal does not affect prior processing.
You have the right to lodge a complaint with the ICO (ico.org.uk) if you believe we have mishandled your data.
Response time: We aim to respond to all rights requests within 28 days. For complex requests we may extend this by up to two further months and will notify you.
This site uses no advertising or marketing cookies. We use Google Analytics 4 for anonymous session analytics only — no personal data is shared with Google.
The only cookies that may be set are:
We do not use Meta Pixel, HubSpot, Mailchimp tracking, or any similar service that would share your behavioural data with third parties. We do use Google Analytics 4 (GA4) for anonymous page-view and session analytics (Measurement ID: G-2SL2HNW9FC). GA4 does not receive your name, email, or any personal identifier. You can opt out at any time via the Google Analytics opt-out browser add-on.
We take reasonable and proportionate steps to protect your personal data against unauthorised access, loss, or disclosure:
No system is perfectly secure. If you believe your data has been compromised, please contact us immediately.
Name: John Lyden
Role: Data Controller & DPO
Email:
professionals@NarcissismKills.co.uk
Subject line: Include “GDPR Request” so we can prioritise your message.
Response time: Acknowledgement within 5 working days; full response within 28 days.
If you are not satisfied with our response to a GDPR request or complaint, you have the right to escalate to the UK supervisory authority:
Information Commissioner’s Office (ICO)
Helpline: 0303 123 1113
Report a concern: ico.org.uk/make-a-complaint
We ask that you contact us first so we have the opportunity to resolve any concern directly.
We may update this privacy notice from time to time — for example, when we add new features to the Professionals Portal, change our hosting provider, or in response to changes in UK data protection law.
We will always display the "Last updated" date at the top of this page. If changes are material, we will notify registered professionals by email (if you consented to communications).
We will never make changes that weaken your rights or alter the basis on which we process your data without giving you the opportunity to review and, where required, re-consent.