Skip to content 
Last updated: [07 November 2025]
This Privacy Policy explains how GCSE Tutoring Academy (“we”, “us”, “our”) collects, uses, discloses and protects personal information when you use our website, book or attend tutoring, receive learning resources, or otherwise interact with us.
We comply with the UK GDPR, the Data Protection Act 2018, and applicable e-privacy rules.
1) Who is the data controller?
GCSE Tutoring Academy
Registered office: [insert registered address]
Email: [insert privacy email, e.g., [email protected]]
Phone (UK): [insert UK phone number]
If we appoint a Data Protection Officer (DPO) or privacy lead, contact: [insert if applicable].
2) Who this policy applies to
- Parents/Guardians (our contracting clients)
- Students (including those under 18)
- Prospective customers/website visitors
- Tutors and applicants (covered here at a high level; we may provide a separate notice during recruitment)
3) Information we collect
3.1 Information you provide directly
- Account & contact data: parent/guardian name, student name, email, phone, address.
- Student profile: year group, school year (e.g., Y9/Y10/Y11), exam board, target grade, learning goals, assessment results, homework submissions, progress notes.
- Booking & transactional data: session bookings, packages/subscriptions, payment status, invoices, support requests.
- Communications: emails, chat, feedback forms, support tickets.
- Safeguarding information: only where necessary and appropriate (see section 8).
- Recruitment data (tutors/applicants): CV, qualifications, DBS status, references.
3.2 Information we collect automatically
- Usage & technical data: IP address, device/browser, pages visited, time on site, crash logs (via cookies/analytics—see section 10).
- Session metadata: time/duration of lessons, attendance, tutor assigned, homework submitted.
3.3 Information from third parties
- Payment providers (e.g., Stripe/GoCardless) – payment confirmations, no full card numbers.
- Video/lesson platforms (e.g., Zoom, Google Meet, Microsoft Teams) – meeting IDs, basic usage metrics.
- Assessment/learning tools – scores and activity relevant to tuition.
4) Lawful bases for processing
We process personal data under one or more of the following legal bases:
- Contract – to create your account, schedule and deliver lessons, process payments, provide support.
- Legitimate interests – to improve services, manage timetables, ensure platform security, record certain sessions for quality/safeguarding, and send service-related communications.
- Consent – for optional marketing emails, certain cookies/analytics, testimonials, and use of student work. You can withdraw consent at any time.
- Legal obligation – for accounting/tax, safeguarding, responding to lawful requests.
- Vital interests – in rare circumstances to protect someone’s life (e.g., urgent safeguarding).
5) How we use personal data
- Provide and manage online tuition (1:1 and group), assessments, resources and feedback.
- Build a personalised tutoring plan and track progress against exam-board specifications.
- Administer bookings, billing, subscriptions and customer support.
- Maintain quality, training and safeguarding (including limited session recordings—see section 8).
- Improve our services, content and website through aggregated/anonymous analytics.
- Send service updates and, with your consent, optional marketing.
- Comply with legal and regulatory obligations.
We do not sell personal data.
6) Children’s data
We provide tuition to students under 18. The parent/guardian is our contracting client and is responsible for the provision of accurate information and consent. We aim to follow the Age Appropriate Design Code.
- Students under 13 should not create independent accounts.
- Parents/guardians must ensure a suitable study environment and be contactable for safeguarding matters.
7) Special category data
We generally do not collect special category data. If you voluntarily disclose relevant health or learning needs (e.g., ADHD, autism, exam access arrangements), we will process this only as necessary to support the student and only with appropriate safeguards and a valid lawful basis (usually consent or substantial public interest related to education/safeguarding).
8) Safeguarding & session recordings
For safeguarding, quality and training, some live sessions may be recorded.
- Recordings are not shared publicly.
- Access is restricted to authorised staff.
- Standard retention is up to 12 months unless a safeguarding or legal need requires longer.
- You must not record sessions without our prior written consent.
9) Data sharing (processors & partners)
We may share data with trusted third parties who act under our instructions and only as necessary to provide services:
- Payment processors (e.g., Stripe, GoCardless)
- Video/lesson platforms (e.g., Zoom, Google Meet, Microsoft Teams)
- Scheduling & CRM tools (e.g., Calendly/Google Calendar, HubSpot/Zoho)
- Learning/assessment platforms
- Analytics & error monitoring (e.g., Google Analytics, server logs)
- Cloud hosting & storage (e.g., AWS, Google Cloud, Microsoft Azure)
- Professional advisors (legal/accounting), and authorities where legally required.
We require suppliers to meet UK GDPR standards via Data Processing Agreements.
10) Cookies & analytics
We use cookies and similar technologies to run our site, keep you logged in, remember preferences, and understand usage.
Categories
- Strictly necessary – required for core functionality (no consent needed).
- Preferences/functional – remember settings.
- Analytics/performance – measure site usage (consent-based).
- Marketing – only if we run campaigns (consent-based).
You can manage cookies via our cookie banner and your browser settings. See our separate Cookie Policy for details.
11) Marketing
With your consent (or where otherwise permitted by law), we may send newsletters, tips and offers.
- You can unsubscribe via any email or by contacting us.
- We do not send marketing to students directly without appropriate consent/expectations.
12) International transfers
Some processors may store data outside the UK/EEA (e.g., US). Where this occurs, we use approved safeguards such as the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs) with UK addendum, plus additional measures where appropriate.
13) Data retention
We only keep data for as long as necessary for the purposes set out in this policy, and to meet legal obligations. Typical retention periods:
| Data type | Typical retention |
|---|---|
| Account, bookings & invoices | 6 years after contract end (tax/accounting) |
| Student progress & assessments | Up to 3 years from last activity or one academic year after GCSE completion, whichever is later |
| Session recordings | Up to 12 months, longer if required for safeguarding/legal reasons |
| Support communications | 24 months from last contact |
| Marketing consents | Until withdrawn + compliance logs (24 months) |
| Tutor/applicant records | Successful hires: per HR policy; Applicants: 12–24 months |
We may anonymise data for statistical reporting.
14) Security
We use technical and organisational measures to protect data (secure hosting, encryption in transit, access controls, staff training). No system is 100% secure; please keep your login details confidential and notify us of any suspected breach.
15) Your rights (UK GDPR)
You have the following rights (subject to conditions/exemptions):
- Right of access – obtain a copy of your data
- Right to rectification – correct inaccurate data
- Right to erasure – request deletion in certain cases
- Right to restrict processing – limit how we use data
- Right to data portability – receive data in machine-readable format (where applicable)
- Right to object – to certain processing (e.g., direct marketing or legitimate interests)
- Right to withdraw consent – where processing relies on consent
- Rights related to automated decision-making – we do not carry out solely automated decisions producing legal or similarly significant effects
How to exercise your rights
Email [insert privacy email] with your request. We may need to verify your identity and, for students, confirm we are liaising with the parent/guardian where appropriate. We aim to respond within one month.
Complaints
You can complain to the Information Commissioner’s Office (ICO):
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk • 0303 123 1113
Please contact us first so we can try to resolve your concern.
16) Third-party links
Our website may contain links to third-party sites. We are not responsible for their privacy practices; please review their privacy notices.
17) Changes to this policy
We may update this Privacy Policy from time to time. The latest version will be posted on our website with a new “Last updated” date. Material changes may be notified by email or banner.
18) Contact us
Questions about this policy or your data?
GCSE Tutoring Academy
Email: [insert privacy email]
Phone (UK): [insert number]
Address: [insert address]
