Contents
This policy explains what personal data Ascera Tutoring collects, the legal basis on which we process it, how long we retain it, and the rights you have in relation to it. If you have any questions, please contact us at hello@asceratutoring.co.uk before using our services.
We do not collect special category data (such as health information, ethnicity or religion) unless it is volunteered by you and is directly relevant to the delivery of tutoring, for example where a student has a learning need that should be taken into account in session planning. Where such information is provided, we treat it with heightened care and do not use it for any purpose beyond the immediate tutoring arrangement.
The table below sets out each purpose for which we process personal data and the legal basis under the UK General Data Protection Regulation (UK GDPR) on which we rely.
| Purpose | Data involved | Legal basis |
|---|---|---|
| Delivery of tutoring services including session planning, student progress and written feedback | Parent/guardian contact info, student name/year/school, grades, subjects, session records | Performance of contract |
| Handling enquiries and arranging initial consultation calls | Parent/guardian name, email, phone number | Performance of contract and legitimate interest |
| Sending invoices and processing payments | Parent/guardian contact info, session records, payment details | Performance of contract and legal obligation (tax and accounting) |
| Communicating changes to services, fees or policies | Parent/guardian email address | Legitimate interest and performance of contract |
| Handling complaints or disputes | All relevant contact and session information | Legitimate interest and legal obligation |
| Maintaining business records and complying with financial regulations | All records associated with the tutoring arrangement | Legal obligation (HMRC, tax law) |
| Investigating or preventing fraud, abuse or breaches of our terms | All relevant information | Legitimate interest and legal obligation |
| Ensuring safeguarding and protecting welfare of minors | Relevant information disclosed during tutoring | Legal obligation and legitimate interest |
Where processing is based on legitimate interest, we have considered your interests and rights and believe our interest is not outweighed by your rights.
We do not use your data for any automated decision-making and do not carry out any profiling.
We use the following third-party providers to process personal data as data processors on our behalf:
All processors are contractually bound by data protection clauses and are required to process personal data only on our instructions, maintain appropriate security and respect data subject rights.
We may also need to disclose information in response to legal requests from law enforcement, regulatory authorities or courts. Where legally permitted, we will notify you of such requests before disclosing your data.
Where we use third-party processors (such as Google Workspace or Zoom), data may be processed outside the UK and EEA. Where this occurs, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and other mechanisms recognised as adequate under UK GDPR. You may request further details about these safeguards by contacting us.
We keep personal data only for as long as necessary for the purpose for which it was collected, or as required by law. The table below sets out retention periods for different categories of data.
| Data type | Retention period |
|---|---|
| Session notes, progress records and feedback | Until two years after the final session |
| Records following the end of a tutoring arrangement | Two years from the date of the final session |
| Financial and invoicing records | Six years, in accordance with HMRC requirements |
| Enquiries that did not result in a tutoring arrangement | Six months from the date of last communication |
| Website server logs | 90 days |
Once data reaches the end of its retention period, it is deleted promptly and securely. Where data is held in third-party systems, deletion requests are passed to those providers in accordance with our agreements with them.
Under UK GDPR, you have the following rights. You may exercise any of them by contacting us at hello@asceratutoring.co.uk. We will respond within one calendar month and may ask you to verify your identity before proceeding.
Where data relates to a student under the age of 18, these rights are exercisable by a parent or guardian. A student who has reached the age of 18 may exercise these rights directly in relation to their own data.
Our services are provided to students, many of whom are under the age of 18. We collect and process data about students solely for the purpose of delivering agreed tutoring sessions. We do not use student data for any secondary purpose, including marketing or profiling.
We collect student data on the basis that a parent or guardian has engaged our services and provided the necessary information. Parents and guardians may request access to, correction of, or deletion of their child's data at any time.
Where a student is under 13, we take particular care to ensure that the parent or guardian remains the primary point of contact for all data-related matters. We do not knowingly collect data directly from children under 13 without parental involvement.
Where a student has reached the age of 18, they may exercise their own data rights directly and independently of a parent or guardian. In the event of a conflict between a request from a parent and a request from a student who has reached 18, the student's rights take precedence in respect of their own personal data.
We do not use automated decision-making or profiling in any form that produces legal or similarly significant effects on individuals. All decisions relating to the delivery of tutoring, session planning and progress assessment are made by a human tutor.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:
No method of electronic transmission or storage is entirely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) without undue delay, and in any event within 72 hours of becoming aware of it, as required by UK GDPR.
Our website uses cookies. Cookies are small text files placed on your device when you visit a website. We use the following categories of cookie:
| Type | Purpose | Can be disabled? |
|---|---|---|
| Strictly necessary | Required for the website to function. No personal data is collected. | No — disabling these would prevent the site from working |
| Third-party (Trustpilot) | The Trustpilot widget embedded on our site may set cookies to display reviews. Trustpilot's own privacy policy applies to these cookies. | Yes — via your browser settings |
We do not use advertising cookies, tracking cookies or analytics cookies. You can manage or disable cookies through your browser settings at any time, though this may affect the functionality of certain parts of the site.
We may update this policy from time to time to reflect changes in our services, legal requirements or the third-party providers we use. The version number and date at the top of this page indicate when it was last revised. Where changes are material, active clients will be given at least 14 days' notice by email and the opportunity to raise any concerns before the updated policy takes effect. Continued use of our services after that period will indicate acceptance of the changes.
We encourage you to review this policy periodically.
If you have any questions about this policy or wish to exercise any of your rights, please contact us:
If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: