Privacy Policy

1. Who we are

[QED Education legal entity name], a company registered in England and Wales (company number: [ ]), registered office at [ ]. We are the data controller for the personal data described in this policy.

Contact for privacy queries: [privacy@qededucationgroup.com or similar]. We have not currently appointed a Data Protection Officer.

2. What we collect, and why

• Get Started flow — student date of birth, current school, subjects of interest, parents’ country of residence, contact details. Used to assess enrolment eligibility and respond to your enquiry.
• Parent dashboard account — name, email, account credentials, booking history, documents, plan/hours usage. Used to perform our contract with you.
• Tutor dashboard account — name, contact details, subjects, availability, qualifications, DBS check outcome (pass/fail only). Used to perform our contract with you and meet our safeguarding obligations.
• Landing page / cookies — analytics and on-site behaviour via cookies, based on your consent except for strictly necessary cookies. See our cookie banner for the current list.

We only collect what we need for the above. We do not sell personal data.

3. Children’s data

Our tutoring service is aimed at school-age students, and the Get Started flow collects a student’s date of birth as its first step.

• If the student is under 13, we require confirmation from a holder of parental responsibility before we process their data.
• If the student is 13 or older, they may be able to consent in their own right, though a parent or guardian usually completes the enquiry.

4. Who we share data with

• Hosting and infrastructure providers, based in the UK/EU.
• Our headless CMS provider, for managing site content.
• An AI service provider used internally to help staff summarise records — restricted to Western providers hosted in a UK or EU region.
• We never share data with third parties for their own marketing purposes.

5. International transfers

Many of our families are based outside the UK and EU, including a significant number in mainland China. Where any of our own processors are based outside the UK, we put an appropriate legal safeguard in place and complete a Transfer Risk Assessment before relying on it.

6. Retention

• Enquiry data that doesn’t lead to a booking: retained for [12 months], then deleted.
• DBS check outcomes: the pass/fail result is retained only while the tutor is active or under consideration; the certificate itself is never stored.
• Account/dashboard data: retained for as long as you have an active account, plus a reasonable period afterwards.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to processing of, and request a portable copy of your data, and to complain to us or to the Information Commissioner’s Office at ico.org.uk. For a child’s data, a parent or holder of parental responsibility can generally exercise these rights on the child’s behalf.

8. Cookies

We use a cookie banner that lets you accept or reject non-essential cookies before they’re set. See the banner for the current list of cookies and their purposes.

9. Security

We use reasonable technical and organisational measures to protect your data. No system is perfectly secure, and we can’t guarantee absolute security of information transmitted over the internet.

10. Changes to this policy

We’ll update this policy as our processing changes and post the revised version here with a new version number and date.

11. Governing law

This policy is governed by the law of England and Wales.