Privacy Policy
1. Who We Are
TutelageCo ("we", "us", "our") provides online tuition services. We are the data controller for the personal data described in this Privacy Policy. Our contact details are set out in Section 10.
2. What Data We Collect
Depending on your relationship to us (parent, guardian, or student), we may collect:
-
Contact details: name, email address, phone number, postal address.
-
Student details: name, age or date of birth, year group, subjects and level of study, relevant educational needs (e.g. SEND or EHCP information) shared with us for the purpose of tailoring tuition, and Medical Information.
-
Parent/guardian details: name and confirmation of legal relationship to the student, provided as part of our consent process.
-
Payment information: billing details and transaction history (we do not store full card details; these are processed by our payment provider, Stripe).
-
Session data: booking history, attendance, tutor notes on progress, and, where applicable, session recordings.
-
Technical data: IP address, device and browser information, collected automatically when you use our booking platform or video conferencing tools.
3. How We Use Your Data and Our Legal Basis
We use personal data for the following purposes, relying on the legal bases indicated:
-
To provide and manage tuition services (performance of a contract).
-
To communicate about bookings, scheduling, and progress (performance of a contract / legitimate interests).
-
To process payments (performance of a contract).
-
To meet safeguarding obligations, including tutor vetting and incident reporting (legal obligation / legitimate interests).
-
To send updates about our Services, where you have opted in (consent).
-
To comply with legal and regulatory obligations, such as tax record-keeping (legal obligation).
4. Children's Data
Much of the personal data we process relates to children under 18. We collect this data directly from a parent or legal guardian, or from the student with parental/guardian consent obtained through our consent process, and we only use it for the purposes of providing and improving tuition, and for safeguarding. We do not use children's data for marketing purposes.
5. Sharing Your Data
We do not sell personal data. We may share data with:
-
Tutors delivering sessions to the relevant student.
-
Service providers who support our operations, such as payment processors, video conferencing platforms, and booking or scheduling software, under appropriate data processing agreements.
-
Regulatory or safeguarding authorities, where we are legally required to do so or where necessary to protect a student's welfare.
-
Professional advisers (e.g. accountants, insurers) where necessary for our legitimate business operations.
6. Data Retention
We retain personal data only for as long as necessary for the purposes set out in this Policy, typically:
-
Student and parent/guardian contact and session records: for the duration of tuition and for the equivalent of 2 academic terms afterwards, in line with our insurance and safeguarding obligations.
-
Financial records: for 6 years in line with HMRC requirements.
We will securely delete or anonymise data once it is no longer required.
7. Data Security
​We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, including access controls, encryption where appropriate, and limiting access to personal data to those who need it.
8. International Transfers
Where any of our service providers store or process data outside the UK, we ensure appropriate safeguards are in place, such as adequacy regulations or Standard Contractual Clauses, to protect your data in line with UK GDPR requirements.
9. Your Rights
Under UK data protection law, you (or, in relation to a child's data, their parent or legal guardian) have the right to:
-
Access the personal data we hold about you or your child.
-
Request correction of inaccurate data.
-
Request deletion of data, subject to our legal and contractual obligations.
-
Object to or restrict certain processing.
-
Request a copy of your data in a portable format.
-
Withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, please contact us using the details in Section 11. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.
10. Contact Us
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes where appropriate.