Privacy Policy

TIMOTHY LUNN TUTORING

Privacy Policy

Last reviewed: 14 August 2026

1. Who we are

Timothy Lunn Tutoring is a sole-trader tutoring business based in Saffron Walden, Essex, operated by Timothy Lunn ("I", "me", "my"). I am the data controller for the personal data described in this policy — the person responsible for deciding how and why it is used.

Contact: info@timothylunntutoring.co.uk

ICO Registration Number: ZC211983

2. What personal data I collect

Depending on our relationship, I may collect:

Parent/guardian contact details — name, email, phone number, home address

Student details — name, date of birth or year group, school, subjects/exam boards, target grades

Learning-related information — academic history, SEND/EAL needs, learning style, progress notes and lesson records

Payment information — billing details and payment history (card details are handled directly by my payment provider/bank; I do not store full card numbers)

Communications — emails, messages, and call notes relating to enquiries, bookings, or ongoing tuition

Website usage data — if you visit my website, basic analytics data (e.g. pages viewed, general location, device type) may be collected via cookies or similar technologies

Safeguarding-related information — only where a concern arises, recorded and stored separately in line with my Safeguarding & Child Protection Policy

3. Why I collect it, and my legal basis

I only use personal data where I have a valid legal basis to do so under UK GDPR:

Contract — to arrange, deliver, and manage tutoring sessions and to invoice for them

Legitimate interests — to run and improve my business (e.g. responding to enquiries, keeping lesson records, sending progress updates), where this does not override your rights

Consent — for optional things such as using a testimonial, a student's first name, or session recordings in marketing; consent can be withdrawn at any time

Legal obligation — e.g. retaining financial records for HMRC, or making a safeguarding referral where required by law

Where I process special category data (health information, or data relating to SEND) this is done with explicit parental consent and only to the extent needed to tailor tuition appropriately.

4. Children's data

Because most of the students I work with are under 18, information about a child is collected from and with the consent of their parent or legal guardian. Parents can request access to, or deletion of, their child's information at any time using the contact details in Section 9.

5. Who I share data with

I do not sell personal data. I share it only where necessary, with:

My accountant, for bookkeeping and tax purposes

Tutoring agencies (e.g. Cambridge Tutoring Company), where a student is booked through that agency — limited to what is needed to deliver and manage the tuition

My bank/payment provider, to process payments

Cloud storage and software providers (e.g. Google Workspace) that I use to store lesson materials and records securely

Statutory bodies (such as the Local Authority Designated Officer or children's social care), where I have a safeguarding duty to share information

Any third party that processes data on my behalf is required to protect it to at least the same standard as I do.

6. International transfers

Some of the cloud services I use (e.g. Google Workspace) may store data on servers outside the UK. Where this happens, I only use providers that offer appropriate safeguards recognised under UK GDPR, such as the UK's International Data Transfer Agreement or an adequacy decision.

7. How long I keep data

Enquiry details that don't lead to a booking: deleted after 12 months

Active client records (contact details, lesson records, progress notes): retained for the duration of tuition plus 3 years, to support any future needs (e.g. references, resuming tuition)

Financial records (invoices, payment records): retained for 6 years, in line with HMRC requirements

Safeguarding records: retained separately and securely for longer periods where required by statutory guidance, and reviewed periodically

Marketing consents (testimonials, reviews): retained until you ask me to remove them

After these periods, data is securely deleted or anonymised.

8. How I keep data secure

Password-protected devices and accounts, with cloud-first storage rather than only local files

Access to student and family data limited to what I need personally to deliver tuition (I do not employ other staff)

Regular backups and a tested contingency plan for device loss or failure

A Data Breach Procedure setting out how any incident is contained, assessed, and reported

9. Your rights

Under UK GDPR, you (or, for a child, their parent/guardian) have the right to:

Access the personal data I hold about you

Have inaccurate data corrected

Ask for data to be deleted, where there is no overriding reason for me to keep it

Restrict or object to certain processing

Receive data you've provided in a portable format

Withdraw consent at any time, where consent is the basis for processing

To exercise any of these rights, contact me at info@timothylunntutoring.co.uk. I will respond within one month.

10. Complaints

If you're unhappy with how your data has been handled, please raise it with me directly first — I'd like the chance to put it right. You also have the right to complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint

Helpline: 0303 123 1113

11. Changes to this policy

I may update this policy from time to time, for example if my services or legal obligations change. The current version will always be available on request and, where I have a website, published there with the date it was last reviewed.