Privacy Policy

1. Who We Are

WeAre Education Ltd is a tutoring agency based in Hertfordshire, providing an introductory tutoring service, tuition delivered personally by our director, and educational resources through our website at weareeducation.co.uk.

We are the data controller for the personal data described in this policy. We are a company registered in England and Wales, company number 14510731 with our registered office at The Nook, Bucks Hill, Kings Langley, WD4 9BR. We are registered with the Information Commissioner's Office (ICO), registration reference ZB564838. Our VAT number is GB 506 6762 80.

Our data protection contact is Fleur West, Director — enquiries@weareeducation.co.uk.

2. What This Policy Covers

This policy explains how we collect, use, share and protect personal data when you:

• Make an enquiry through our website, by email, or on social media
• Engage a tutor through our introduction service
• Receive tuition delivered personally by Fleur West
• Create a Learning Hub account, subscribe to it, or use it as a student
• Apply to join us as a tutor, or work with us as a tutor
• Browse our website

Where we introduce you to a self-employed tutor, that tutor decides for themselves how they handle the information you share with them during the tuition. In data protection terms they are an independent controller, not our processor, and they are responsible for their own compliance. This policy covers what we do with your data.

3. What We Collect and Why

3.1 Enquiries

When you make an enquiry we collect your name, email address, telephone number if you give it, the student's first name and year group, the subjects and level you are asking about, and anything else you choose to tell us.

We use this to respond to you, to work out whether we can help, and to match the student to a suitable tutor. Our lawful basis is our legitimate interest in responding to enquiries about our services, and where you go on to book, the performance of our contract with you.

3.2 Clients and students

Once an arrangement begins we hold: your name and contact details; billing details; the student's name, year group, school, subjects, target grades and exam board; session dates, attendance and cancellations; invoices and payment history; lesson reports written by the tutor; and correspondence between us.

We use this to arrange and administer the introduction, to run the platform, to invoice you and account for VAT, to keep the records the Employment Agencies Act 1973 and the associated Conduct Regulations require us to keep, and to meet our safeguarding responsibilities.

Our lawful bases are the performance of our contract with you, compliance with our legal obligations, and our legitimate interests in running and improving the service and in safeguarding students.

3.3 Information about a student's needs

You may choose to tell us about a student's special educational needs, a diagnosis, a health condition, or access arrangements for exams, because it affects how they should be taught and which tutor suits them.

Some of this is special category data under UK GDPR and needs additional protection. Where you share it, we rely on your explicit consent, which we will ask for and record. You can withdraw that consent at any time, though it may mean we can no longer match the student as accurately.

We share only what a tutor needs in order to teach the student well, and we do not share it with anyone else.

3.4 Lesson recordings

Sessions delivered through our tutoring platform, TutorCruncher, are recorded by default. Where the student is under 18 we treat the recording as a child's personal data and apply additional care to it.

What we hold: an audio-visual recording of the session, stored against the account holder's record.

Why we hold it: so that the student can revisit the session, and so that a record is available if a safeguarding concern or a dispute about a session arises.

Our lawful basis: legitimate interests, namely the safeguarding of students and the ability to look into concerns about a session fairly. We have assessed this and are satisfied that it does not override the rights of the student. You may object at any time and we will switch recording off for your sessions.

Who can access it: the student, the parent or guardian who holds the account, the tutor who delivered the session, and WeAre Education Ltd. Recordings are not shared with anyone else. We view them only where a safeguarding concern or a dispute is raised, and never in order to assess or direct how a tutor teaches. They are never used for marketing, advertising, or profiling.

How long we keep it: four months from the date of the session, after which the recording is deleted automatically. You may ask us to delete a recording sooner.

Where it is held: TutorCruncher acts as our data processor for recordings under a written data processing agreement.

3.5 Payments

Payment for tuition is taken through TutorCruncher, which uses a third-party payment provider to split the payment so that the tutor's fee goes to the tutor and our commission comes to us. Learning Hub subscriptions are paid through Stripe.

We do not see or store your full card number or bank details. Those are handled by TutorCruncher's payment provider and by Stripe, who are responsible for their security. We hold a record of what was paid, when, and for what, which we keep for six years to meet our obligations under tax law.

3.6 Tutors and tutor applicants

If you apply to work with us we collect your name and contact details, CV, qualifications and their evidence, references, right-to-work documents, DBS certificate details and status, self-employment and insurance details, and your bank or payment account details for the payment split.

We use this to satisfy the vetting duties placed on us by the Employment Agencies Act 1973 and the Conduct Regulations, to satisfy ourselves that you are suitable to work with children, and to administer your engagement. Our lawful bases are compliance with our legal obligations, the performance of our contract with you, and, in relation to criminal records information, the safeguarding of children and vulnerable individuals as a substantial public interest condition under Schedule 1 of the Data Protection Act 2018.

We keep a record that a DBS check was carried out, its reference and its date. We do not retain a copy of the certificate itself beyond six months, in line with the DBS code of practice. Where you are on the DBS Update Service we record the date of each status check.

If your application is unsuccessful we keep your application for twelve months and then delete it.

3.7 Website visitors

When you visit the website we record which pages are viewed and which buttons and links are clicked, together with the page you came from, your screen size, your browser language and a random session number that is cleared when you close the tab. We use this only to see how the site is used and to improve it. We do not use it to identify you, we do not combine it with your account, and we do not share it with anyone. We do not use Google Analytics, advertising cookies or any other third-party tracking.

Our lawful basis is our legitimate interest in understanding how the website is used. You can switch this off at any time using the "Website statistics" switch at the bottom of every page. We delete these records after 13 months.

3.8 Marketing

We will send you information about our services, resources and availability only where you have asked us to, or where you are an existing client and the information relates to services like the ones you already use. Every message includes an unsubscribe link, and we act on unsubscribes immediately.

We do not sell your data, we do not share it with anyone for their own marketing, and we do not use it to build advertising profiles.

4. The Learning Hub

The Learning Hub is our online learning area. Parents and guardians create accounts and can invite their child to join with their own login.

4.1 What we hold

• Account details: name, email address, password (stored in encrypted form, which we cannot read), and whether you have agreed to receive marketing emails.
• Parent details you choose to add: country, time zone and preferred way to be contacted.
• Student details you or your child add: preferred name, email address for their login, year group, exam board, subjects, learning goals and any notes you add.
• Learning records: which lessons and sections have been completed, quick-check answers and scores, worksheet answers, self-ratings, reflections, notes, bookmarks and favourites.
• The study feed: posts, replies, the nickname used, "helpful" votes and any reports made.
• Questions sent to us through the Parent Hub and our replies.
• Subscription details from Stripe: whether the subscription is active, its renewal date, and Stripe's reference numbers. We do not receive card details.
• Email preferences.

4.2 Why we hold it and our lawful basis

We use this information to run the Learning Hub, to show students and parents their progress, and to give feedback. Our lawful basis is the performance of our contract with the account holder. We use the study feed records, including reports, to keep the feed safe and to deal with any misuse; our lawful basis for that is our legitimate interest in keeping students safe. We send marketing emails only to adults who have ticked the box to receive them, and never to student accounts.

4.3 Who can see it

Notes, worksheet answers, reflections and quick-check results are private to the student and can also be seen by WeAre Education's admin team (Fleur West) so that we can support the student and look into any concern. A parent can see their linked child's progress. Study feed posts can be seen by other Learning Hub students and by us, under the nickname the student chooses, never their real name.

4.4 Students

Students only join the Learning Hub through an invitation from their parent or guardian. We have written a short, plain-English version of this policy for students, which they can find in their Student Hub.

5. Children's and Young People's Data

Most of our students are children and young people, and their data is given additional protection under UK GDPR and the ICO's Age Appropriate Design Code.

Bookings and subscriptions must be set up and managed by a parent or guardian, and students join the Learning Hub only through their parent or guardian's invitation. When you sign up on behalf of a child you do so as their parent or guardian, and where consent is the basis on which we process something, you give it on their behalf.

For a student we may hold: their first name and surname, year group or academic level, school, the subjects and level they are studying, target and predicted grades, session and attendance history, lesson reports written by their tutor, recordings of their sessions, and anything you have chosen to tell us about their needs. We collect only what we need to match them to a tutor, to run their sessions and to run the Learning Hub.

We do not use children's data for advertising or profiling, we never sell it, and we do not make automated decisions about students.

As the parent or guardian you may ask to see the data we hold about your child, ask us to correct it, ask us to delete it, or withdraw a consent, by emailing enquiries@weareeducation.co.uk. A student aged 13 or over may make a request themselves, and we will consider whether they are able to understand it before we respond.

6. Who We Share It With

We share personal data with:

• The tutor we introduce you to, so that they can teach the student. This includes the student's name, year group, subject and level, what they are working towards, and anything relevant you have consented to us passing on. The tutor is an independent controller of that information.
• Our service providers, who process data on our behalf under written agreements:
  • TutorCruncher — session management, video classroom, recordings and invoicing, and its payment provider for tuition payments
  • Stripe — Learning Hub subscription payments
  • Lovable (including Lovable Cloud, which runs on Supabase) — website hosting, the Learning Hub database, logins, file storage and the emails the website sends
  • Google Workspace — email and file storage
  • Anthropic (Claude) — an AI assistant we sometimes use to help draft lesson summaries and progress reports (see Artificial Intelligence Tools)
  • Calendly — booking consultations, if you choose to book one
  • MailerLite — our email newsletter, if you sign up to it
  • WhatsApp (Meta) — if you choose to message us or join a family group with your tutor
• Our accountant and, where necessary, our professional advisers, under a duty of confidentiality.
• HMRC and other regulators, including the Employment Agency Standards Inspectorate, where we are required by law to provide information.
• Safeguarding authorities, as set out in section 7.

We do not sell personal data, and we do not share it with advertisers or data brokers.

7. Safeguarding Disclosures

If we have reason to believe a child is at risk of harm, we will share information with the local authority's children's services, the local authority designated officer, the Disclosure and Barring Service, or the police, as the situation requires.

Where the law allows or requires it, we may do this without your consent and without telling you first, because a child's safety comes ahead of confidentiality. Our lawful bases are compliance with a legal obligation, the protection of the vital interests of the individual concerned, and the substantial public interest in safeguarding children.

8. Artificial Intelligence Tools

We use AI tools to help draft and format teaching resources and business documents. For these we do not use any personal data.

We sometimes use Claude, an AI assistant made by Anthropic, to help draft lesson summaries, after-lesson messages and progress reports. To do this we may include the student's first name and our notes about the lesson and their progress. We include only what is needed, Fleur reads and edits everything before it is sent, and we do not use AI to make decisions about students, tutors or applicants. Anthropic acts as our processor and is based in the United States (see International Transfers).

If you would rather we did not use an AI tool for anything involving your child, tell us at enquiries@weareeducation.co.uk and we will stop.

9. International Transfers

Some of our service providers store or process data outside the United Kingdom, mainly in the United States and the European Economic Area. This includes Lovable, Stripe, Google, Anthropic, Calendly and WhatsApp (Meta), and may include TutorCruncher's payment provider. Where personal data is transferred outside the UK, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it), the UK International Data Transfer Agreement, or the International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for more detail about the safeguard for any provider.

Where we work with international clients, we handle their data under UK GDPR in the same way as we do for UK clients.

10. How Long We Keep It

Where a retention period has passed, we delete the data or anonymise it so that it can no longer identify anyone.

11. How We Keep It Safe

We use industry-standard measures to protect personal data, including encrypted connections, access controls, two-factor authentication on our business accounts, and providers who are contractually required to maintain appropriate security. Access to student data is limited to Fleur West, the tutor working with that student and, for Learning Hub progress, the student's parent or guardian.

If a personal data breach occurs and it is likely to result in a risk to your rights, we will report it to the ICO within 72 hours and tell you without undue delay.

12. Your Rights

Under UK GDPR you have the right to:

• Be told what personal data we hold about you and why
• Ask for a copy of it
• Have inaccurate data corrected
• Ask us to delete data, where we have no continuing lawful reason to keep it
• Ask us to restrict how we use it while a concern is looked into
• Object to processing we carry out on the basis of legitimate interests, including lesson recordings and website statistics
• Withdraw a consent you have given, at any time
• Receive data you have given us in a portable format
• Not be subject to a decision made solely by automated means. We do not make such decisions.

You can delete your Learning Hub account at any time from your account page, or by emailing us.

To exercise any of these rights, email enquiries@weareeducation.co.uk. We will respond within one month. There is no charge, and we may ask you to confirm your identity first.

13. Cookies and Device Storage

The website stores a small amount of information on your device. We do not use advertising cookies or third-party tracking.

14. Changes to This Policy

We may update this policy to reflect changes in our services, our providers, or the law. The current version is always published on the website with a revised 'Last updated' date. Where a change materially affects how we use your data, we will tell active clients and tutors by email.

15. Complaints

If you have a concern about how we have handled your personal data, please tell us first at enquiries@weareeducation.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator: ico.org.uk, or 0303 123 1113. We would appreciate the chance to put things right before you do.

16. Contact

Fleur West, Director — WeAre Education Ltd
Email: enquiries@weareeducation.co.uk
Website: weareeducation.co.uk