This notice explains how Cove Tutors collects and uses personal information. It is written to meet our duties under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, including the duty to tell people what we do with their information, whether they give it to us directly or we receive it from someone else.
If you are a pupil, there is a shorter version written for you near the end of this page.
Who we are
Cove Tutors is a trading name of Cornish Adventures Ltd, a company registered in England and Wales with company number 15788616. Our registered office address is shown in the footer of this website.
We provide live online tuition in science, maths and geography to pupils at Key Stage 3, GCSE and some A level, for families, schools, alternative provision (AP) settings and local authorities (LAs).
How to contact us about privacy
Email hello@covetutors.co.uk with any question about this notice or your personal information, or to exercise any of your rights. Please put “Privacy” in the subject line so it reaches the right person quickly.
Our founder is responsible for data protection at Cove Tutors. We are not required to appoint a data protection officer and have not done so.
If your concern is about a child’s safety, please email safeguarding@covetutors.co.uk instead.
Our two roles
The law gives different responsibilities depending on who decides how and why information is used.
When we are the controller
We are the controller, and responsible for your information, when we deal with:
- parents, carers and pupils who book private tuition with us directly
- people who enquire about our services
- tutor applicants and the tutors who work with us
- contacts at schools, AP settings and LAs, for the purpose of running our business relationship with them
- visitors to this website
When we are a processor
When a school, AP setting or LA commissions tuition for its pupils, that organisation is the controller of the pupils’ information and we are a processor. This means we use pupil information only on the commissioning organisation’s documented instructions, only to deliver and report on the programme, and under the data processing terms that form part of our terms of business.
In that case the school, AP setting or LA’s own privacy notice explains how it uses pupil information, and you should contact it first about your rights. We will help it to respond. If you contact us directly, we will pass your request to the commissioning organisation promptly and tell you we have done so.
The rest of this notice describes what we do as a controller. Where it mentions school or LA work, it describes how we handle that information on the controller’s behalf.
What we collect
Parents and carers
- Name, email address, phone number and the relationship to the pupil.
- Booking, scheduling and lesson attendance records.
- Payment records, such as what you paid, when, and invoice details. Card and bank details for payments and Direct Debits are collected and held by Stripe, our payment provider. We do not see or store your full card number.
- Messages you send us and our replies, including notes from your free introductory call.
Pupils
- Name, year group and school.
- Subjects, exam boards, targets and the results of the baseline assessment every programme starts with.
- Learning needs relevant to tuition. This may include information about special educational needs and disabilities (SEND) or health, which is special category data (see below).
- Lesson notes, work completed in lessons, progress summaries and attendance.
- What the pupil says and shows during live lessons, which the tutor sees and hears in real time. Lessons are not recorded (see “Lesson recording” below).
- Any safeguarding concerns, and the action taken.
We usually receive pupil information from the parent or carer, or from the school, AP setting or LA that commissions the tuition. We also create some of it ourselves, such as lesson notes and progress records.
Special category information about pupils
SEND and health information is sensitive, so we protect it with extra care:
- We only ask for what a tutor needs to teach the pupil safely and well, such as an access arrangement, a reading difficulty or a condition that affects concentration. We do not need diagnoses or medical records.
- It is stored only in our business Google Workspace account, with access limited to the founder and the tutor who teaches the pupil.
- It is never sent to tutors’ personal email addresses or kept on personal devices.
- It is not shared with anyone else unless the law requires it, it is needed to keep a child safe, or (for school and LA work) the commissioning organisation instructs us to.
Contacts at schools, AP settings and LAs
- Name, job title, organisation, work email address and phone number.
- Purchase orders, invoices, correspondence and records of the programmes we deliver.
Tutor applicants and tutors
Through the application form on our /apply/ page, and during our recruitment and safer recruitment checks, we collect:
- name, contact details and availability
- subjects, qualifications, teaching or tutoring experience and evidence of exam results
- Disclosure and Barring Service (DBS) status and the outcome of an enhanced DBS check with barred list (children)
- safeguarding training records
- referees’ names and contact details, and the references they give
- evidence of the right to work in the UK
- for tutors engaged with us: contractor agreement, payment and tax-related details, lesson and attendance records, and any concerns raised about their conduct
DBS information is criminal offence data and receives the same extra protection as special category data. We receive references from your referees and the DBS outcome from the DBS process.
Website visitors
This website does not use cookies, analytics or tracking. Our hosting provider, Cloudflare, processes technical information such as IP addresses to deliver the site and protect it from attacks. If you email us through a link on the site, we receive what you send.
Why we use it and our lawful basis
The law requires us to have a lawful basis for each use of personal information. For special category and criminal offence data, we also need an additional condition.
| What we do | Lawful basis |
|---|---|
| Answer enquiries and hold introductory calls | Steps at your request before entering a contract; otherwise our legitimate interest in responding to people who contact us |
| Arrange, teach and report on private lessons, including baseline assessments, lesson notes and progress summaries | Performance of our contract with the parent or carer |
| Use a pupil’s SEND or health information to adapt teaching (private families) | Explicit consent from the parent or carer (or the pupil, if they are old enough to decide). You can withdraw consent at any time; we will then stop using it, though this may limit how well we can adapt lessons |
| Take payments, issue invoices and recover money owed | Performance of a contract; legitimate interests in recovering debts |
| Keep accounting and tax records | Legal obligation |
| Deliver programmes for schools, AP settings and LAs | We act as processor; the commissioning organisation sets the lawful basis. Our use of the organisation’s contacts’ details is based on performance of our contract with that organisation and our legitimate interests |
| Record and act on safeguarding concerns, including making referrals to children’s social care, the police or the local authority designated officer (LADO) | Legitimate interests and, where it applies, legal obligation or vital interests. For special category data: substantial public interest, safeguarding of children and individuals at risk (Data Protection Act 2018, Schedule 1, paragraph 18) |
| Recruit tutors, check qualifications and references, and carry out enhanced DBS checks with barred list (children) | Steps before entering a contract; legitimate interests in safer recruitment; legal obligation where it applies. For DBS information: Data Protection Act 2018, Schedule 1, paragraph 18 (safeguarding of children) |
| Manage tutors’ contracts, pay them and monitor quality | Performance of our contract with the tutor; legal obligation for tax records; legitimate interests in quality assurance and safeguarding |
| Run, secure and protect this website | Legitimate interests in keeping the site available and secure |
| Establish, exercise or defend legal claims | Legitimate interests; for special category data, the legal claims condition in Article 9(2)(f) UK GDPR |
Where we rely on legitimate interests, we have weighed our interests against yours and, for pupils, given particular weight to the fact that they are children. You can ask us for details of that assessment.
We do not send marketing emails. If we decide to in future, we will only send them to people who have agreed, with an easy way to unsubscribe in every email, and we will update this notice first.
Children’s information
Most of the pupils we teach are children. We take extra care with their information:
- We collect only what we need to teach and keep them safe.
- We explain things to young people in plain language, through the “If you are a pupil” section below, and tutors will answer questions about it in lessons.
- Young people can usually exercise their own data protection rights once they are mature enough to understand them, which is often from around the age of 12. A parent or carer can make a request on a younger child’s behalf. With older pupils, we will usually check with the pupil before acting on a parent’s request about their information, unless it is plainly in the child’s interests not to.
- We never use children’s information for marketing, profiling or advertising.
Lesson recording
We do not record lessons. The only exception is where a school, AP setting or LA commissioner and the pupil’s parent or carer have both agreed in writing, in advance, that a lesson may be recorded. In that case we will explain why it is being recorded, who can see it, where it is stored and when it will be deleted, before the lesson begins.
Who we share it with
We never sell personal information and never share it for advertising.
We use the following suppliers to run our business. They act as processors on our behalf, under contracts that require them to keep information secure and use it only on our instructions:
| Supplier | What they do for us |
|---|---|
| Google (Google Workspace) | Business email, Google Meet for live lessons, Google Drive for lesson notes and records |
| Cal.com | Online booking and diary management, once our online booking goes live. Until then, bookings are handled by email |
| Stripe | Card payments and Direct Debit collection |
| FreeAgent | Accounting and invoicing |
| Cloudflare | Website hosting and security |
Some organisations receive information in their own right and are responsible for it under their own privacy notices:
- Stripe also acts as a controller for some purposes, such as fraud prevention and meeting its own legal obligations as a payment provider.
- Mettle, our business bank, processes payment information as part of providing banking services.
- Our tutors see the information they need to teach the pupils they work with. They are bound by confidentiality and our data protection and safeguarding policies.
We may also share information:
- with the school, AP setting or LA that commissioned the tuition, as part of the agreed reporting (attendance, progress and impact reports, and welfare concerns)
- with children’s social care, the police, the LADO or other agencies when we need to protect a child or adult from harm
- with the DBS, as part of recruitment checks or where the law requires us to make a referral
- with HMRC, our accountants or professional advisers, where needed
- where the law or a court requires it
- with a buyer or successor, if the business or part of it is sold, under equivalent protections
International transfers
We aim to keep personal information in the UK. However, some of our suppliers, namely Google, Stripe, Cal.com and Cloudflare, may process personal information outside the UK, including in the European Economic Area and the United States.
Where that happens, the transfer is protected by one of the safeguards recognised under UK data protection law, such as:
- UK adequacy regulations, which allow transfers to countries the UK government has found to have adequate protection (including the countries of the European Economic Area)
- the UK Extension to the EU-US Data Privacy Framework, for transfers to US organisations certified under it
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, included in the supplier’s data processing terms
You can ask us for more information about the safeguard used for a particular supplier.
How long we keep it
We keep information only for as long as we need it. When the retention period ends, we delete it securely or anonymise it.
| Information | How long we keep it |
|---|---|
| Enquiries that do not lead to tuition | 12 months from our last contact |
| Pupil lesson notes, baseline results, progress records and attendance (private families) | 1 year after tuition ends |
| Pupil information held for a school, AP setting or LA | As set out in our contract with that organisation. At the end of the programme we return or delete it as the organisation instructs |
| SEND and health information | Deleted with the pupil’s lesson records, or sooner if consent is withdrawn |
| Bookings, invoices, payment and accounting records | 6 years after the end of the financial year they relate to |
| Contracts and correspondence with schools, AP settings and LAs | 6 years after the contract ends |
| Safeguarding records | In line with the current edition of Keeping children safe in education and local safeguarding guidance. Where a record must pass to another agency or setting, we transfer it securely |
| Unsuccessful tutor applications | 6 months after we tell the applicant our decision |
| Tutor records, including safer recruitment checks | For the length of the engagement and 6 years after it ends. We record the DBS certificate number, date and outcome but do not keep copies of certificates longer than needed to make a recruitment decision |
| Records of allegations about a tutor | In line with the current edition of Keeping children safe in education |
| Website technical logs | Kept by Cloudflare for short periods, in line with its own retention policies |
We may keep information longer if it is needed for a legal claim, a safeguarding matter or a regulator’s investigation, and only for as long as that need lasts.
How we keep it secure
We protect personal information with organisational and technical measures, including:
- business Google Workspace accounts for all email, lessons and records, protected by 2-step verification
- access limited to the people who need it, so tutors see only the information for the pupils they teach
- encrypted devices with screen locks
- no personal email accounts, personal phones or social media for contact with pupils
- live lessons held only through our business Google Meet accounts, with tutors admitting only expected participants
- confidentiality duties and data protection and safeguarding training for everyone who works with us
- contracts with our suppliers requiring appropriate security
If a personal data breach happens that is likely to result in a risk to people, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell the people affected without undue delay where the risk is high. When we act as a processor, we tell the commissioning organisation without undue delay so it can meet its own duties.
Cookies
This website does not set any cookies and does not use analytics, advertising or tracking tools. Because of this, you will not see a cookie banner. If we ever change this, we will update this notice and ask for your consent first where the law requires it.
Automated decisions
We do not make decisions about anyone using only automated means, and we do not use personal information for profiling.
Your rights
You have the following rights over your personal information:
- To be informed about how we use it. This notice does that.
- To access it. You can ask for a copy of the personal information we hold about you.
- To rectification. You can ask us to correct information that is wrong or complete information that is incomplete.
- To erasure. You can ask us to delete your information in some circumstances.
- To restrict processing. You can ask us to limit how we use your information in some circumstances, for example while we check whether it is accurate.
- To data portability. Where we use information you gave us, based on consent or a contract, and by automated means, you can ask for it in a commonly used electronic format, or ask us to send it to someone else.
- To object. You can object to us using your information where we rely on legitimate interests. We will stop unless we have compelling grounds to continue or need it for a legal claim.
- Rights relating to automated decision-making and profiling. You have the right not to be subject to decisions made only by automated means that have legal or similarly significant effects. We do not make such decisions.
Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
Some rights do not apply in every case. For example, we must keep financial records for a set time, and we may not be able to delete safeguarding records. If we cannot do what you ask, we will explain why.
How to exercise your rights
Email hello@covetutors.co.uk. You do not need to use a particular form of words. We may ask for information to confirm your identity, or that you are entitled to act for a child, before we act on a request.
We will respond within one month of receiving your request, or of receiving anything we need to confirm your identity. If a request is complex, or you make several, we may extend this by up to two further months and will tell you why within the first month. We do not charge a fee, unless a request is clearly unfounded or excessive.
If your request is about tuition commissioned by a school, AP setting or LA, see “When we are a processor” above.
If you are a pupil
This part is for you if you have lessons with Cove Tutors.
- What we know about you: your name, year group, school, the subjects you study, how you are getting on, whether you came to your lessons, and notes your tutor writes after each lesson. If you have extra needs, such as needing more time or finding reading tricky, we might know about that too, so we can help you learn in a way that works for you.
- Why we have it: so your tutor can plan lessons that suit you and show you, your family and (if your school arranged the lessons) your school how you are improving.
- Who can see it: your tutor, the person who runs Cove Tutors, your parent or carer, and your school if it arranged your lessons. We never sell it and we never use it for adverts.
- Your lessons are not recorded, unless your school and your parent or carer have agreed to it in writing before the lesson.
- If we are worried about you: if something you say or do makes us think you might not be safe, we have to tell people whose job is to keep children safe. We will usually tell you first, if we can.
- You can ask questions: you can ask what information we have about you, ask us to fix anything that is wrong, or ask us to delete things. You can ask your tutor, ask a parent or carer to help, or email hello@covetutors.co.uk yourself.
- If you are not happy: tell us and we will try to put it right. You can also contact the Information Commissioner’s Office, which makes sure organisations look after people’s information properly.
How to complain
If you are unhappy with how we have handled your personal information, please contact us first at hello@covetutors.co.uk so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:
- Website: ico.org.uk
- Helpline: 0303 123 1113
Changes to this notice
We review this notice regularly and will update it if the way we use personal information changes. The date at the top of this page shows when it was last updated. If we make a significant change, such as using information for a new purpose, we will tell the people affected before the change takes effect.