Privacy Policy
Effective 1 September 2026 | Review date: September 2027
| Data controller | The Community Schools CIC |
|---|---|
|
Company number |
14658587 |
|
Registered office |
Office 211, Epicentre, Enterprise Way, Withersfield,
Haverhill, England CB9 7LR |
|
Privacy contact |
Claire Meadows-Smith –
claire@thecommunityschools.co.uk |
This Privacy Policy explains how The Community Schools CIC ("The Community Schools", "we", "us" or "our")
collects, uses, shares, stores and protects personal information in connection with our tutoring services and our
own online administration system. It is intended for parents/carers, students, prospective students, tutors,
applicants, schools and other clients.
1. Who we are
The Community Schools CIC is the data controller responsible for deciding how and why personal information is
processed for the purposes described in this Policy. We are a Community Interest Company providing tutoring
services through QTS-qualified teachers.
Questions about this Policy, requests to exercise data protection rights, or concerns about how personal information is used should be sent to our Privacy Contact, Claire Meadows-Smith, at claire@thecommunityschools.co.uk or to our registered office shown above.
Questions about this Policy, requests to exercise data protection rights, or concerns about how personal information is used should be sent to our Privacy Contact, Claire Meadows-Smith, at claire@thecommunityschools.co.uk or to our registered office shown above.
2. Data protection law
We process personal information in accordance with applicable UK data protection law, including the UK General
Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, as
amended from time to time.
We aim to ensure that personal information is used lawfully, fairly and transparently; collected for specified purposes; limited to what is necessary; kept accurate; retained for no longer than necessary; and protected by appropriate security measures.
We aim to ensure that personal information is used lawfully, fairly and transparently; collected for specified purposes; limited to what is necessary; kept accurate; retained for no longer than necessary; and protected by appropriate security measures.
3. The information we may collect
Depending on the relationship with us and the service being provided, we may collect:
- Parent/carer and client information, including names, addresses, email addresses, telephone numbers and account/administrative details.
- Student information, including name, date of birth or age, school/year group, subjects studied, educational history, prior attainment, examination information, learning objectives, attendance, progress, tutor reports and feedback.
- Information about SEND, health, medical needs, reasonable adjustments, welfare or safeguarding where relevant and necessary.
- Booking, timetable, attendance, communication and service records held within our own online administration system.
- Payment and transaction information required to administer fees.
- Online tuition information, including joining information, attendance and, where applicable, recordings of online tutoring sessions.
- Correspondence with parents/carers, students, schools, tutors and other clients.
- Website and technical information, such as device, browser and cookie information, where collected through our website.
- Tutor and job-applicant information, including contact details, employment history, qualifications, QTS evidence, references, safeguarding/recruitment checks and information required for recruitment and employment administration.
4. How we obtain personal information
We may obtain information directly from a Parent, Student, tutor, applicant or client; through our own online
administration system; from a school, local authority or other organisation purchasing or arranging tuition; from
referees and lawful recruitment/checking services; or from other sources where the law permits us to receive the
information. Where information about a Student is supplied by a Parent, school or other organisation, we use it only for
appropriate purposes connected with tuition, administration, welfare, safeguarding and our legal obligations.
5. Our lawful bases for using information
We only process personal information where we have a lawful basis. Depending on the circumstances, this may
include performance of a contract; our legitimate interests where these are not overridden by the individual’s rights;
compliance with a legal obligation; vital interests in limited circumstances; or consent where consent is the
appropriate basis. Consent may be withdrawn at any time. We do not make access to tutoring conditional on agreeing
to receive marketing.
6. Special category and safeguarding information
Some information, such as health information, may be special category personal data. Where we process special
category data, we identify both an Article 6 lawful basis and an appropriate additional condition under Article 9 UK
GDPR and applicable UK law. We may process health, SEND, disability, welfare or safeguarding information where
necessary to provide support, make reasonable adjustments, protect vital interests, meet safeguarding
responsibilities, establish or defend legal claims, or meet another applicable legal condition. Safeguarding information
is handled on a need-to-know basis and may be shared without consent where necessary and proportionate to protect
a child or another person, or where another lawful basis applies.
7. How we use personal information
We use personal information to respond to enquiries; process registrations; provide and organise tuition; allocate
tutors; manage timetables and attendance; communicate with families, tutors, schools and clients; monitor learning
and progress; provide reports and support; make reasonable adjustments; meet safeguarding and safer-recruitment
responsibilities; administer fees and accounts; manage tutors and applicants; maintain and secure our systems;
handle complaints and legal matters; meet legal and regulatory requirements; and send optional marketing where
permitted.
8. Our online administration system
Registration, booking, scheduling and day-to-day administration are managed through The Community Schools CIC’s
own online administration system rather than a third-party appointment-booking platform. The system may contain
Parent/Student contact information, booking and timetable information, attendance, tutor allocation,
progress/administrative notes and other information necessary to operate the tutoring service. Access is restricted
according to role and business need.
9. Online tutoring recordings
Where an online tutoring session is recorded, the recording is accessible only to the Student, their tutor and
authorised Community Schools administrators. Recordings are retained while the Student remains a current student.
When the Student ceases to be current, recordings are normally deleted within 30 days. A particular recording may be
retained for longer where reasonably necessary for safeguarding, legal, regulatory or dispute-resolution purposes;
access remains restricted and it is retained only for as long as reasonably necessary.
10. Who we may share information with
We do not sell or rent personal information to third parties for marketing. Where necessary and lawful, we may share
relevant information with the Student’s tutor and authorised staff; parents/carers; schools, local authorities or
organisations arranging tuition; IT, hosting, communications, payment and administrative service providers; insurers
and professional advisers; and safeguarding bodies, police, regulators, courts or public authorities where disclosure is
required or justified by law. Where a service provider processes information for us, we take reasonable steps to ensure
appropriate data-protection arrangements are in place.
11. International transfers
Some technology or service providers may process personal information outside the United Kingdom. Where an
international transfer occurs, we will use an appropriate lawful transfer mechanism and safeguards where required by
UK data protection law.
12. Data security
We use appropriate technical and organisational measures designed to protect personal information from accidental
loss, unauthorised access, misuse, alteration or disclosure. These may include role-based access controls, secure
passwords, multi-factor authentication where appropriate, encryption or secure transmission where appropriate,
backups, confidentiality requirements and periodic security review. Access to sensitive, safeguarding and special
category information is restricted to those who need it for their role.
13. Personal data breaches
We maintain procedures for responding to suspected personal data breaches. We will assess and contain a breach,
identify the information and people affected, mitigate risks, document our response and notify the appropriate
regulator and/or affected individuals where the law requires us to do so.
14. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and
to meet applicable safeguarding, employment, accounting, tax, insurance, legal and regulatory requirements.
Different records therefore have different retention periods. Online tutoring recordings follow the specific rule in
section 9. Other records may need to be retained after tuition ends, including financial, safeguarding, complaint and
legal records. Information may be securely deleted or anonymised when no longer required.
15. Children's information
Much of the personal information we process relates to children. Children have data protection rights over their own
information. Where privacy information is directed to a child, we aim to use clear, age-appropriate language.
Parents/carers are encouraged to explain this Policy to younger Students, and we may provide shorter or ‘just-in-time’
explanations within our online service. Depending on a child’s age, understanding and circumstances, a Parent/Carer
may exercise rights on the child’s behalf or we may need to involve the child directly.
16. Marketing
Parents/Carers may choose whether to receive optional emails or messages about relevant courses, resources, term
dates or services. Marketing preferences are separate from registration for tuition. A person can withdraw marketing
consent or object to direct marketing at any time by using an unsubscribe facility where provided or by contacting us.
17. Your data protection rights
Depending on the circumstances and subject to legal limitations and exemptions, individuals may have rights to be
informed; access their personal information; correct inaccurate information; request erasure; restrict processing;
object to processing, including direct marketing; receive certain information in a portable format; and withdraw
consent where processing is based on consent. We may need to verify identity before acting on a request. No fee is
normally charged, although the law permits a reasonable fee or refusal in certain circumstances.
18. Complaints
If you have a concern about how we use personal information, please contact us first so that we can investigate it. You
also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.
19. Keeping information accurate
Parents/Carers, tutors and other users should tell us if relevant personal information changes so that our records can
be kept accurate and up to date.
20. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in law, guidance, technology or our services. Where a change is
significant, we will take reasonable steps to bring the updated Policy to the attention of affected individuals.
21. Contact
Privacy Contact: Claire Meadows-Smith
The Community Schools CIC, Company No. 14658587
Registered office: Office 211, Epicentre, Enterprise Way, Withersfield, Haverhill, England CB9 7LR