Privacy Policy

tutreo (“we”, “our”, or “us”) is committed to protecting and respecting your privacy. This privacy policy outlines how we collect, use, store and safeguard personal information provided by parents, carers and students in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

tutreo operates as a private tuition provider based in Aylesbury, UK, and is the data controller responsible for your personal data.

• Business name: tutreo
• Location: Aylesbury, Buckinghamshire, UK
• Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
• Contact email: tutreo.info@gmail.com

If you have any questions regarding this policy or our privacy practices, please contact us at the email address above.

2. What information we collect

We collect and process personal data to deliver our tutoring services, respond to enquiries and maintain operational security.

General personal and academic data

• Contact information: parent or carer and student names, email addresses and phone numbers.
• Academic details: the student’s current school, year group, subject exam boards, target grades and preferred lesson formats.
• Enquiry information: any messages or details supplied through our web forms, including a mock exam expression of interest, or by direct communication.

Special category data (health and medical)

If a student requires specific learning adjustments, we may collect information regarding health conditions, special educational needs (SEN), or access arrangements, such as extra time or a reader. This enables us to provide suitable facilities and fair adjustments during assessments.

Technical and security data

To maintain site integrity and prevent abuse, we collect one-way cryptographic hashes of IP addresses. These hashes are used only for rate-limiting and security monitoring. Raw IP addresses are not permanently stored in plaintext log files. The hash cannot be reversed to recover the original address.

3. Payment information

Payments for tuition and mock exams are made directly by bank transfer. tutreo does not collect, process or store credit or debit card details on this website. We only maintain standard financial records of payments received, for accounting and tax compliance.

4. Why we use your data, and the legal grounds

We only process personal data where we have a valid lawful basis under UK GDPR.

• Responding to enquiries. Contractual necessity or legitimate interests.
• Delivering tuition services. Performance of a contract.
• Exam access arrangements. Explicit consent.
• Financial and accounting records. Legal obligation.
• Website security and protection. Legitimate interests.

We do not sell, rent or trade personal data to third parties, and we do not use your personal information for direct marketing.

5. Children’s information

Our educational services are directed at students, many of whom are under the age of 18. We apply these safeguards:

• All formal communications, billing and administrative arrangements are conducted directly with parents or legal guardians.
• We do not knowingly collect personal data directly from children online without parental knowledge or consent.
• Information concerning minors is maintained with heightened confidentiality and access controls.

6. Who we share your information with

We share information only with service providers required to support our business operations, or when the law requires us to.

Legal and safeguarding disclosures

We may disclose personal information to external bodies, such as schools, local authorities or law enforcement, only where required by a legal obligation or a court order, or to protect the safety and welfare of a student or the public under safeguarding standards.

7. Where your information is held

Your personal information is primarily stored and processed within the United Kingdom or the European Economic Area.

If data is transferred to, or accessed by, a service provider outside the UK or the European Economic Area, we put appropriate safeguards in place. That includes an International Data Transfer Agreement or UK-approved standard contractual clauses, so that your data keeps an equivalent level of protection.

8. How we protect your information

We maintain technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure.

• Encryption. Data transmitted to and from our systems is encrypted in transit using TLS. Stored databases use encryption at rest.
• Access controls. Access to personal data is limited to people who need it to carry out their duties.
• Anonymisation. Technical identifiers such as IP addresses are cryptographically hashed, so they do not directly identify a person during security operations.

9. Data retention periods

We keep personal information only for as long as we need it for the operational or legal purpose for which it was collected.

• Non-converting enquiries, including mock exam expressions of interest that do not lead to tuition or a sitting, are erased after 24 months.
• Tuition records are retained for 6 years following the end of the financial year, to comply with UK tax obligations.
• Rate-limiting security records are automatically cleared or overwritten within 24 hours.

10. Your rights under UK GDPR

Under UK data protection law you can ask to exercise these rights over the personal information we hold:

• Access to a copy of your information.
• Rectification of information that is inaccurate.
• Erasure of information we no longer need to keep.
• Restriction of how we use your information.
• Data portability, so you can receive information you provided to us in a portable format.
• Withdrawal of consent, where we rely on your consent, including explicit consent for exam access arrangements.

To exercise any of these rights, email tutreo.info@gmail.com.

Regulatory complaints

If you believe that your personal data has been handled incorrectly, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Cookies

This website uses essential technical measures required for it to operate safely. We do not place third-party advertising, tracking or marketing cookies on your device. For the technical detail, see our Cookie Notice.

12. Changes to this privacy policy

We may update this privacy policy from time to time. When we make a material change, we will tell registered clients by email, or place a notice on this website, before the change takes effect.