Privacy policy

1. About this policy

This policy explains how Kelden Education Group Ltd ("Kelden", "we", "us") collects, uses, shares and protects personal data when you use our services or any of the education businesses in the group, visit our websites or contact us. It is written for parents and carers, pupils, schools, tutors and anyone else whose data we handle.

We have written a short summary for young people below. If you are a parent or carer, please share it with your child where appropriate.

2. Who we are

Kelden Education Group Ltd is the data controller for personal data processed by the group and each of its brands. We are registered in England and Wales under company number [TODO: company number], and our registered office is [TODO: registered office address line 1], [TODO: town], [TODO: postcode], United Kingdom. We are registered with the Information Commissioner's Office (ICO) under number [TODO: ICO registration number].

For any question about this policy or your data, contact us at privacy@keldeneducation.co.uk or by post at our registered office, marked "Data Protection".

[TODO: if you appoint a Data Protection Officer, add their name and contact details here. A DPO is not always legally required for a business of this size; take advice.]

3. The data we collect

Parents, carers and other bill payers

• name, email address, phone number and postal address;
• billing details, payment history and invoices (card details are handled by our payment provider, not stored by us);
• correspondence with us and our brands, and notes of calls;
• your relationship to the pupil and any consents or preferences you give us.

Pupils

• name, age or date of birth, school year and school attended;
• subjects, learning goals, progress notes, work produced in sessions and assessment results;
• where you choose to tell us, information about special educational needs, disabilities, health or medical conditions relevant to their learning or safety (this is "special category data" and receives extra protection);
• for online sessions, the platform username and, where recording is used, session recordings (see section 8);
• safeguarding records, if a concern is ever raised.

Schools and organisations

• names, job titles and work contact details of staff we deal with, and contract and billing details.

Tutors, staff and applicants

• contact details, CV, qualifications, references, right-to-work documents, DBS check results, training records, bank details for payment and performance information. Applicants and staff receive a separate, more detailed privacy notice.

Website visitors

• anything you send through our contact form, and limited technical data (such as IP address) processed by our hosting and security provider to keep the site working and protected from abuse. We do not use analytics or advertising trackers. See our cookie notice.

4. How we collect it

Most data comes directly from you: when you enquire, book, pay or speak to us. Some comes from tutors during lessons (progress notes, for example), from schools that commission us, from referees and the Disclosure and Barring Service (for tutors), and from our payment provider (confirmation that a payment succeeded).

5. Why we use it and our lawful basis

Special category and criminal offence data

We process information about a pupil's health, special educational needs or disability only where it is needed to teach them safely and effectively. We rely on your explicit consent (UK GDPR Article 9(2)(a)), or, for safeguarding, on the "safeguarding of children and individuals at risk" condition in Schedule 1 of the Data Protection Act 2018. We process DBS check results for tutors and staff under the employment and safeguarding conditions in Schedule 1. We keep an appropriate policy document for this processing.

6. Children's data

We work with children, so we take extra care with their data. We collect only what we need to teach and safeguard them, we do not use children's data for marketing, profiling or automated decision-making, and we never sell it.

For pupils under 13, we deal with a parent or carer, who exercises data protection rights on the child's behalf. Young people aged 13 and over can generally exercise their own rights if they understand what that means, and we will consider their wishes. Where any of our services are offered online directly to children, we design them in line with the ICO's Age Appropriate Design Code (Children's Code).

7. Who we share data with

We share personal data only where necessary, with:

• the tutors and staff delivering your lessons, on a need-to-know basis;
• the school or organisation that commissioned the tuition, where that applies;
• our payment provider, [TODO: payment provider, e.g. Stripe or GoCardless], to process payments;
• service providers who host and run our systems (for example email, website hosting with Cloudflare, video-lesson platforms, scheduling and accounting software), under contracts that require them to protect your data and use it only on our instructions;[TODO: list your actual processors, e.g. Google Workspace or Microsoft 365, Zoom, Xero, Resend]
• our accountants, insurers and professional advisers;
• the police, local authority children's services, the Local Authority Designated Officer (LADO), the Disclosure and Barring Service or other authorities, where required by law or needed to protect a child.

We never sell personal data or share it for other companies' marketing.

8. Online lessons and recordings

[TODO: state whether online sessions are recorded. If they are, explain why (e.g. safeguarding and quality), who can access recordings, and how long they are kept. If they are not, say so.]

9. International transfers

Some of our service providers store data outside the UK. Where they do, we make sure it is protected by a UK adequacy regulation, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted by UK law.

10. How long we keep data

[TODO: confirm these retention periods with your solicitor or accountant.]

11. How we protect data

We use access controls, encryption in transit, multi-factor authentication on business systems, staff training and confidentiality obligations to protect personal data. Tutors may only access the information they need for the pupils they teach. If a data breach is likely to put you at risk, we will tell you and, where required, the ICO.

12. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you (a "subject access request");
• have inaccurate data corrected;
• have data erased, where there is no good reason for us to keep it;
• restrict or object to certain processing, including processing based on legitimate interests;
• object to direct marketing at any time;
• data portability, where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, where we rely on it.

To use any of these rights, email privacy@keldeneducation.co.uk. We may need to confirm your identity. We will respond within one month, or tell you if we need longer (up to two further months for complex requests). There is normally no charge.

13. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

14. Changes to this policy

We will update this policy when our practices change. The date at the top shows when it was last revised. Where changes are significant, we will tell customers directly.