Data Protection and Processing Policy

1. Purpose

This policy sets out how EDU Archives Tutors processes personal data and the safeguards we apply, under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

We are the data controller for the personal data we process for our own purposes (candidates, clients, families, learners, website visitors). For some processing we act as a data processor on behalf of schools and local authorities — for example when handling EHCP-aligned tutoring; in those cases the school or LA is the controller.

2. Lawful basis

We process personal data on one or more of the following lawful bases under Article 6 of UK GDPR:

• Contract (6(1)(b)) — to provide and administer our recruitment and tutoring services
• Legal obligation (6(1)(c)) — for safer recruitment, safeguarding, statutory reporting and tax compliance
• Legitimate interests (6(1)(f)) — for direct marketing to schools (B2B), service improvement, and fraud prevention; balanced against the rights of individuals
• Vital interests (6(1)(d)) — for safeguarding emergencies
• Consent (6(1)(a)) — for cookies and email marketing to individuals (parents/candidates), where consent is freely given, specific, informed and unambiguous

3. Special category data

We may process special category data under Article 9 of UK GDPR — for example, information about a learner's SEND profile (health), a candidate's right to work (potentially showing nationality/ethnicity), or safeguarding records (potentially health/criminal data). Special category processing additionally relies on:

• Substantial public interest, including safeguarding of children and vulnerable adults (Article 9(2)(g), DPA 2018 Schedule 1 Part 2)
• Employment, social security and social protection law (Article 9(2)(b))
• Vital interests in life-threatening situations (Article 9(2)(c))
• Explicit consent in narrowly-defined circumstances (Article 9(2)(a))

4. Children's data

Where we process data about a child (under 18), we apply additional protections. Marketing to children is never permitted. Information services to children rely on parent/guardian consent where consent is the lawful basis. Children's data is held for no longer than is necessary, and minimum-data principles are strictly applied.

5. Data subject rights

You have the following rights under UK GDPR:

• Right of access — to know what data we hold about you (Article 15)
• Right to rectification — to correct inaccurate or incomplete data (Article 16)
• Right to erasure — to request deletion in certain circumstances (Article 17)
• Right to restriction — to restrict processing in certain circumstances (Article 18)
• Right to data portability — to receive your data in a portable format (Article 20)
• Right to object — to processing based on legitimate interests or direct marketing (Article 21)
• Rights related to automated decision-making (Article 22) — we do not use automated decision-making with legal or significant effect

6. Exercising your rights

To exercise any data subject right, contact our Data Protection lead at info@eduarchivestutor.com with DATA REQUEST in the subject line. We respond within one calendar month, or three months for complex requests with a written explanation of the delay. We do not charge for responding to most requests; manifestly unfounded or excessive requests may attract a reasonable fee.

7. Retention

Personal data is retained only as long as needed for the purpose for which it was collected, and to meet statutory retention obligations:

• Candidate records — 6 years after the end of engagement (employment and tax records)
• Safeguarding records — until the subject reaches age 25, longer where relevant
• Tutoring records — 6 years after the end of the engagement
• Financial records — 6 years after the end of the financial year
• Website analytics — anonymised after 14 months
• Marketing consent records — for the lifetime of the consent plus 2 years

8. Sharing and international transfers

We share data with: schools and parents who have commissioned a service (necessary for the service); HMRC, pension providers and payroll partners (legal obligation); the Disclosure and Barring Service; safeguarding partners; the Information Commissioner's Office on lawful request; and limited technology suppliers under written data processing agreements. We do not sell personal data.

We do not transfer personal data outside the UK or EEA unless a valid transfer mechanism is in place (Adequacy decision, Standard Contractual Clauses with appropriate safeguards, or Binding Corporate Rules).

9. Security

We apply appropriate technical and organisational measures to protect personal data: access-controlled systems, encrypted storage and transmission, role-based permissions, secure office and document destruction, multi-factor authentication for admin systems, and regular access reviews. Staff and consultants complete annual data protection training.

10. Data breaches

We have a documented data breach response procedure. Any suspected or confirmed personal data breach is reported internally within 24 hours. Where the breach is likely to result in a risk to data subjects, we report to the ICO within 72 hours and inform affected individuals where the risk is high.

11. ICO

EDU Archives Tutors is registered with the Information Commissioner's Office. If you are unhappy with how we have handled your data, you can complain to the ICO at ico.org.uk — though we'd appreciate the opportunity to put it right first.

12. Review

Reviewed annually and after any significant change in legislation or our processing activities.