Privacy Policy

01About this Policy

This Privacy Policy explains how we collect, use, store, share and safeguard the personal information of website visitors, prospective students, enrolled students and the parents or guardians of those students. It applies to all personal information we process in connection with our website and the A-Level Ascension programme.

This Policy should be read alongside our Terms and Conditions. Where those documents define a term (for example, "Programme", "Student", or "Services") the same meaning applies here.

02Who we are

The data controller for personal information collected through this website and the A-Level Ascension programme is Tutorberry (JX Enterprises LTD) ("we", "us", "our"), a company registered in England and Wales.

We process personal information in accordance with the UK GDPR and the Data Protection Act 2018.

03Information we collect

We collect personal information in order to provide tutoring services safely and effectively, and to operate our marketing and advertising activity. This includes:

Information you give us directly

• Parent or guardian name and contact details (email, phone number, postal address where relevant).
• Student name, year of study, exam board and academic information.
• Information you provide through application forms, Typeform submissions, booking forms or enrolment confirmations.
• Billing and payment information (processed via a third party payment provider, see section 12).
• Lesson attendance, assessment progress and tutor notes during enrolment.
• Communications between you, the Student and our tutors or staff.

Information we collect automatically when you visit our website

• IP address (in many cases anonymised or truncated by our analytics tools).
• Browser type, device information, screen size and operating system.
• Pages visited, time spent, scroll depth and referral source.
• Click events on key actions (such as buttons, form submissions and link clicks).
• Cookies and similar tracking technologies (see section 8).

We also collect information that comes back to us from Meta, Google and other advertising platforms about how visitors interact with our adverts. See sections 6 and 7.

04How we use your information

We use your personal information to:

1. Deliver the A-Level Ascension programme to enrolled students;
2. Process and confirm enrolments and payments;
3. Communicate with parents and students about lessons, progress, scheduling and important programme updates;
4. Provide attendance and progress reports to parents;
5. Maintain safeguarding records and respond to any welfare concerns;
6. Operate and improve our website and the Platform;
7. Measure the effectiveness of our marketing and advertising activity on Meta, Google and other platforms;
8. Send marketing communications with your consent (such as updates, resources and offers);
9. Comply with our legal, accounting and regulatory obligations;
10. Prevent fraud, abuse or misuse of our services.

We do not sell your personal data.

05Our lawful bases under UK GDPR

We rely on the following lawful bases to process your personal information:

1. Performance of a contract — to deliver the Services we have agreed with you and to take steps prior to entering a contract (for example, processing an application).
2. Consent — for marketing emails, non essential cookies, advertising pixels, and where required for safeguarding monitoring.
3. Legitimate interests — to operate our website, measure marketing performance, prevent fraud and abuse, and improve our services, where these interests are not overridden by your rights.
4. Legal obligation — to meet accounting, tax, safeguarding, regulatory and other legal obligations that apply to us.
5. Vital interests — where necessary to protect the welfare of a Student in an emergency.

06Meta Pixel and Conversions API

We use the Meta Pixel and the Meta Conversions API (CAPI) on our website to measure the performance of our advertising on Facebook and Instagram, and to deliver more relevant adverts to people who may be interested in the A-Level Ascension programme.

This means that when you visit our website, the following may be shared with Meta:

1. Pages you have visited and key actions you have taken (for example, completing an application or clicking a booking link);
2. Your IP address, browser type and device information;
3. Hashed contact information you have submitted to us (such as a hashed version of your email address), used by Meta to match your activity to your Facebook or Instagram account where one exists;
4. Standardised event data (page view, lead, view content, etc.).

This processing takes place on the basis of your consent, which you may withdraw at any time by managing cookie preferences in our cookie banner, by changing your browser settings, or by adjusting the advertising settings in your Facebook or Instagram account.

Meta acts as a joint controller with us in respect of certain processing relating to the Pixel and Conversions API. Meta's privacy policy can be reviewed at facebook.com/privacy/policy/.

You can manage your Meta ad preferences at facebook.com/adpreferences.

07Google Analytics and Google Ads

We use Google Analytics 4 (GA4) to understand how visitors use our website, and Google Ads (including the Google Ads conversion tag and remarketing tag) to deliver and measure the effectiveness of our advertising on Google Search, YouTube and the Google Display Network.

This means the following may be shared with Google:

1. Pages you visit on our website and conversion events (such as completing a form);
2. Your IP address (truncated or anonymised where required);
3. Browser, device, operating system and approximate location data;
4. Click source and referral information, including the advert or search term that brought you to the site.

Google Ads may use this information to show you remarketing adverts on Google properties and partner sites. Google Analytics may use this information to give us aggregate reports on website performance.

This processing takes place on the basis of your consent, which you may withdraw at any time by managing cookie preferences in our cookie banner or browser settings.

Google's privacy policy can be reviewed at policies.google.com/privacy. You can opt out of personalised Google advertising at adssettings.google.com.

08Cookies and tracking technologies

Our website uses cookies and similar tracking technologies (such as pixels and tags) for the following purposes:

1. Essential cookies — required for the website to function, such as remembering form submissions and page state. These cannot be disabled.
2. Analytics cookies — used by Google Analytics to understand how visitors interact with our website.
3. Advertising cookies — used by the Meta Pixel, Meta Conversions API, Google Ads and Google remarketing tags to measure and deliver advertising.

Where required by law, we display a cookie consent banner when you first visit the site. You may accept all cookies, reject non essential cookies, or manage your preferences at any time using the banner or your browser settings.

Rejecting non essential cookies will not prevent you from using our website, but it may limit certain functionality and means we cannot measure your interactions for advertising purposes.

09Sharing your information

We only share personal information where necessary, and only with the following categories of recipient:

1. Service providers who help us operate the business, including our website host, CRM and email platform, payment processor, and analytics providers, all under appropriate data processing agreements;
2. Advertising platforms Meta and Google, as set out in sections 6 and 7;
3. Tutors and educational staff contracted by us to deliver the Programme;
4. Regulators, authorities and law enforcement where required by law, including for safeguarding purposes;
5. Professional advisers such as our accountants, auditors and lawyers, where necessary.

We do not sell your personal data to anyone.

10International data transfers

Some of the third party services we use, including Meta and Google, are operated by companies based outside the United Kingdom and the European Economic Area. When we share data with these providers, your information may be transferred to and processed in countries that do not have the same level of data protection law as the UK.

Where this happens, we rely on appropriate safeguards required under UK GDPR, including the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other approved transfer mechanisms.

You may contact us if you would like more information about the safeguards in place for any specific transfer.

11Safeguarding and students' data

Because our services involve work with young people, we take additional steps to protect the personal information of students.

1. Communications between tutors, staff and students may be stored, monitored and reviewed for safeguarding purposes;
2. Live Sessions may be recorded and stored for safeguarding and quality assurance, in line with section 10 of our Terms and Conditions;
3. Tutors and staff with direct contact with students hold valid Enhanced DBS certificates where required;
4. Safeguarding information is retained only for as long as necessary to meet our legal and welfare obligations.

We do not knowingly use student data for advertising purposes. The Meta Pixel and Google Ads tracking described in sections 6 and 7 is targeted at parents and prospective parents who visit our website, not at enrolled students within the Platform.

Parents or guardians consent to safeguarding monitoring by enrolling a Student. Where we are concerned about the welfare of a Student, we may share relevant information with the appropriate authorities without prior consent, where the law permits.

12Payment processing

Payments are processed by trusted third party providers, including Stripe and our bank. We do not store full card details on our servers.

Payment providers process your data under their own privacy policies and industry security standards (including PCI DSS). We share with them only the information required to process the payment.

Records of transactions are retained for the period required by accounting and tax law.

13Data retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to:

1. Deliver the Services to enrolled students;
2. Meet safeguarding and welfare obligations;
3. Comply with our accounting, tax and regulatory obligations;
4. Resolve any disputes or enforce our agreements.

Where data is no longer needed, it is securely deleted or anonymised. You may request earlier deletion of your personal information at any time (see section 14), although we may need to retain certain records to meet our legal obligations.

14Your rights under UK GDPR

You have the following rights in relation to your personal information:

1. Right of access — to request a copy of the personal information we hold about you;
2. Right to rectification — to ask us to correct any inaccurate or incomplete information;
3. Right to erasure — to ask us to delete your information, subject to our legal obligations;
4. Right to restriction — to ask us to limit how we use your information;
5. Right to object — to object to processing based on our legitimate interests, including direct marketing;
6. Right to withdraw consent — where we rely on consent (for example, marketing and advertising cookies);
7. Right to data portability — to ask us to provide your information in a structured, commonly used format.

To exercise any of these rights, please contact us in writing. We will respond within the timeframe required by law (typically one calendar month).

You also have the right to complain to the UK Information Commissioner's Office (ICO) if you are unhappy with how we have handled your personal information. The ICO can be contacted at ico.org.uk.

15Security

We take reasonable technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, alteration and disclosure. This includes encrypted connections (HTTPS), access controls, secure password requirements, and limited internal access on a need to know basis.

No method of transmission over the internet or method of electronic storage is fully secure. While we strive to protect your information, we cannot guarantee absolute security.

16Policy updates

We may update this Privacy Policy from time to time to reflect changes in law, regulatory requirements, or how we operate. The latest version will always be available on our website, with the date last updated shown at the top.

Where any change materially affects your rights, we will take reasonable steps to notify you, for example by email or via a notice on our website.