Privacy Policy

Who is responsible for your data

I am a sole trader trading as Zep Tuition, and I am the data controller for the personal data described here. I am registered with the Information Commissioner’s Office (ICO) for data protection under registration number ZC222332.

For anything in this policy, including any request about your data, email gianni@zeptuition.co.uk.

What I collect

• Enquiry details: the name, email address and phone number you give me, plus whatever you choose to tell me about the student and what they need.
• Student details: first name, year group, exam board, target grade, school (if you tell me), and notes on what we have covered and where the gaps are.
• Session records: dates, times, attendance, homework set, whiteboard files and any work you send me to mark.
• Payment records: the amount, date and reference for each payment. I never see or hold your full card number. My payment processor handles the card details.
• Website usage: the page you looked at, where you arrived from, your country and rough area, and your device and browser type. No cookies, and nothing stored on your device. See the cookie policy. There is no advertising or cross-site tracking on this site.

I do not ask for, and would rather you did not send me, medical records, financial details beyond what a payment needs, or anything else that is not relevant to teaching the student.

Data about students under 18

Most of my students are children, so this section matters more than any other on the page.

• A parent or guardian arranges tuition and gives the details. I do not sign up under-18s directly.
• Communication about a student under 18 goes to the parent or guardian, not to the student, unless the parent has explicitly agreed otherwise.
• I keep the minimum I need to teach well: first name, year group, exam board, and notes on the work. I do not need a home address unless sessions are in person, or a date of birth at all.
• I never use a child’s data for marketing, and I never add a child to a mailing list.
• A student’s work is used to teach that student. It is not published, shared or used as an example without the parent’s written permission.

Why I am allowed to use it

UK GDPR requires a lawful basis for each use. Mine are:

Contract

Arranging, delivering, invoicing and keeping records of tuition you have booked.

Legitimate interests

Replying to an enquiry, keeping brief teaching notes so sessions build on each other, and keeping records of what was agreed. I balance this against the privacy of the people involved, and it never extends to profiling or selling data.

Legal obligation

Keeping the financial records HMRC requires, and acting on a safeguarding disclosure where the law or statutory guidance requires it.

Who else sees it

I do not sell personal data, and I do not share it for anyone else’s marketing. A small number of service providers process data on my instructions:

• A payment processor, to take card payments and issue receipts.
• An email provider, to send and receive messages about tuition.
• A website host, which keeps standard server logs, counts page views without cookies, and is told when an enquiry is sent. That last message carries the page you came from and your IP address, and none of what you typed.
• An accountant, if one is engaged, for tax purposes only.
• WhatsApp (Meta), if you choose to message me there.

Some of these providers operate outside the UK. Where that happens, transfers rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum. Beyond those providers, I would only disclose data where the law requires it, or where a safeguarding concern means a child may be at risk of harm. See the Safeguarding Statement.

Messaging me on WhatsApp

The WhatsApp buttons on this site do not send anything anywhere. They open WhatsApp on your own device with my number filled in; nothing leaves this website, and I do not know you tapped one unless you go on to send a message.

If you do message me, WhatsApp is run by Meta, not by me. Meta handles the message in transit and applies its own privacy terms alongside this policy. The conversation is then stored on your phone and on mine, which makes it different from the enquiry form on the contact page: that form keeps no copy of anything at all, and a WhatsApp thread is a lasting record I hold.

For that reason, please keep WhatsApp for arranging things: times, subjects, questions about how tuition works. If you need to tell me about a diagnosis, an EHCP, a health matter or anything else sensitive about your child, email is better, and it is entirely fine to tell me only as much as you think I need.

How long I keep it

• Enquiries that do not become bookings: deleted within 6 months.
• WhatsApp conversations: deleted within 6 months if tuition does not go ahead, and within 12 months of the last session if it does.
• Teaching notes and session records: kept while I am teaching the student, then deleted within 12 months of the last session.
• Financial records: kept for 6 years after the end of the relevant tax year, because HMRC requires it.
• Safeguarding records, in the rare event one is created: kept securely for as long as statutory guidance requires.

How it is kept safe

Records are held on password-protected, encrypted devices and reputable services with two-factor authentication enabled. Access is limited to me.

If a breach happens that is likely to put anyone at risk, I will report it to the ICO within 72 hours and tell the people affected without undue delay.

Your rights

You can:

• Ask for a copy of the personal data I hold about you or your child.
• Have inaccurate data corrected.
• Ask for data to be erased where I no longer need it.
• Object to, or ask me to restrict, how I use it.
• Ask for the data you gave me in a portable format.

Email gianni@zeptuition.co.uk and I will respond within one month. There is no charge. A parent or guardian can exercise these rights on behalf of a child, and an older child may exercise them for themselves where they are able to understand what is involved.

Complaints

Please raise it with me first. Most things are quickest to fix directly.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or by calling their helpline, at any time.

Changes to this policy

If this policy changes materially, I will update the date at the top of the page and, where the change affects you directly, tell you by email.