Privacy policy

This policy explains what we do with personal information when you contact Top Tutors Scotland, book a free evaluation, take lessons with us, or apply to tutor for us.

It is written for parents and carers. We have tried to keep it short and plain. If anything here is unclear, email us and we will explain it properly.

Who we are

Top Tutors Scotland is a trading name of Toptutorsscotland Ltd, a company registered in Scotland, company number SC898863.

Registered office: 53 Menteith Place, Glasgow, South Lanarkshire, G73 5RQ

We are the data controller for the information described in this policy. That means we decide what is collected and why, and we are responsible for looking after it.

How to contact us about your information:

• Email: enquiries@toptutorsscotland.co.uk
• Phone: 07950 415740

We are registered with the Information Commissioner’s Office (ICO), registration number ZC226071. The registration runs to 17 August 2027 and is renewable annually; you can check it on the ICO’s public register of fee payers.

Who this policy is about

Two different people are usually involved in tuition with us, and the difference matters.

• The parent or carer is our customer. You contact us, you agree the terms, and you are invoiced. The contract for tuition is with you.
• The pupil is the young person we teach. Our pupils are secondary-school students, generally between 11 and 18 (S1 to S6). They are not party to the contract, but we do hold information about them.

Because most of our pupils are under 18, we treat their information as children’s personal data and give it extra care. We collect the minimum we need to teach them well, and no more.

Children and their own rights over their information

In Scotland, a young person aged 12 or over is generally presumed to be old enough to understand and exercise their own data-protection rights unless there is a reason to think otherwise. This rule is in section 208 of the Data Protection Act 2018.

In practice this means:

• A pupil aged 12 or over can ask us for a copy of their own information, ask us to correct it, or object to what we are doing with it — in their own right.
• A parent can usually make those requests on a younger child’s behalf.
• Where a pupil is 12 or over and asks us not to share something with their parent, we will think carefully about it rather than simply passing it on. We will take account of the young person’s maturity and their best interests.
• This does not override safeguarding. If we believe a child is at risk of harm, we will act on that, and we may share information without consent. The safeguarding policy explains when and how.

What we collect, why, and our legal reason for it

Under UK data protection law we have to have a specific legal reason — a “lawful basis” — for everything we do with your information. Here is each one, purpose by purpose.

1. When you ask for a free evaluation

Our booking form at /book collects:

• your name
• your email address
• your phone number (optional — only if you would rather we rang)
• your child’s first name
• the subject and the level (National 5 or Higher)
• what you would most like to improve
• when in the week is usually easiest
• anything else you choose to tell us in the notes box

Why: to arrange and run the free evaluation, and to come back to you about it.

Our lawful reason:

• For your information, as the person who would be entering into a contract with us: taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)).
• For your child’s information: our legitimate interests (Article 6(1)(f)). Your child is not a party to the contract, so we cannot rely on Article 6(1)(b) for their details. Our legitimate interest is arranging and delivering the tuition you have asked us to provide for them. We have balanced this against your child’s interests and we only take a first name, a subject, a level and what you choose to tell us.

Please do not use the notes box to tell us about your child’s health, any diagnosis, or anything else sensitive. Tell us at the evaluation instead, and we will record only what we need in order to teach them properly. See “Sensitive information” below.

2. When you send an enquiry through the contact form

Our contact form collects:

• your name
• your email address
• your phone number (optional)
• where your child is now (their level)
• the subject
• how you would like us to reply
• your message

Why: to answer your enquiry.

Our lawful reason: our legitimate interests (Article 6(1)(f)) — being able to reply to someone who has asked us a question. Where the enquiry is really about arranging tuition, we rely on taking steps at your request before entering into a contract (Article 6(1)(b)).

3. When you become a customer and lessons begin

Once you decide to go ahead, we hold:

• your contact and billing details
• your child’s first name, school year and level
• the subjects being taught and the lesson timetable
• lesson notes, written feedback, homework set and marked, and progress records
• messages between you, your child and the tutor through our channels
• invoices and payment records

We do not record lessons. No video or audio of a lesson is made or kept, so there is no footage of your child for us to hold, secure or lose.

Why: to teach your child, to keep you informed, and to run the business properly.

Our lawful reason:

• For your details and the contract itself: performance of a contract with you (Article 6(1)(b)).
• For your child’s lesson records, feedback and progress: our legitimate interests (Article 6(1)(f)) — delivering the tuition their parent has arranged and being able to show what was taught.
• For invoices and accounting records: a legal obligation (Article 6(1)(c)), because company and tax law requires us to keep them.

4. When you apply to tutor for us

Our form at /become-a-tutor collects:

• your name, email address and phone number
• your highest relevant qualification
• the subjects you can teach
• your PVG scheme membership status
• your availability
• your teaching experience

You then email your CV to us separately. CVs are not uploaded through the website.

Why: to consider your application, and if we take it forward, to check you are who you say you are and that you are safe to work with children.

Our lawful reason:

• Considering your application and interviewing you: taking steps at your request before entering into a contract (Article 6(1)(b)).
• Checking your right to work in the UK: a legal obligation (Article 6(1)(c)).
• Verifying your qualifications and taking up references: our legitimate interests (Article 6(1)(f)) — making sure the people who teach children are who they claim to be.
• PVG scheme membership and anything it discloses: this is criminal offence data under Article 10 of the UK GDPR. We rely on the safeguarding condition in Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018, together with our legitimate interests under Article 6(1)(f).

5. When there is a safeguarding concern

If a concern is raised about a child’s safety, we will record it and act on it. That record may contain sensitive information, including information about a child’s health, home life, or alleged criminal conduct by someone else.

Why: to protect children from harm.

Our lawful reason: our legitimate interests and, where relevant, a legal obligation (Article 6(1)(f) and 6(1)(c)). Where the record contains special category data we rely on the substantial public interest condition in Article 9(2)(g), and the safeguarding of children condition in Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018. Where it contains criminal offence data we rely on the same paragraph 18 condition.

We will not ask for consent before recording or sharing a safeguarding concern, and we do not need it. Asking could put a child at greater risk. Our safeguarding policy explains how this works.

6. When you use the website

The website is a set of static pages. It has no accounts, no login and no portal, and it does not store anything about you itself. What the forms collect is emailed to us.

• The consent cookie. If we ever switch analytics on, we will ask you first, and we store your answer in a cookie called tts-consent for 180 days. This is the only cookie we set ourselves. Our lawful reason is our legitimate interests (Article 6(1)(f)) in remembering your choice so we do not keep asking, and it is exempt from the consent requirement in the Privacy and Electronic Communications Regulations because it is strictly necessary for a service you have asked for.
• Analytics. We do not use analytics at the moment. If we do, it will only load after you have actively agreed, and our lawful reason will be your consent (Article 6(1)(a)), which you can withdraw at any time.
• The booking calendar. The optional calendar on the booking page is provided by Google. Nothing is loaded from Google Calendar until you press the button to load it. Pressing it is your consent.

The cookie policy sets all of this out in more detail.

Sensitive information

Some information gets extra protection in law. That includes information about health, disability, additional support needs, ethnicity, religion and sexual orientation.

We do not ask for any of it on our forms, and we would rather you did not put it in a free text box. But in tuition it sometimes matters — a pupil with dyslexia, an additional support need, or an anxiety that affects exams is something a tutor may need to know in order to teach well.

Where you choose to tell us something like that:

• we record only what the tutor actually needs in order to teach your child properly
• we share it only with the tutor teaching them, and with whoever needs it internally
• our legal reason is your explicit consent (Article 9(2)(a)), which you can withdraw at any time by emailing us
• if you withdraw it, we will delete it, though that may limit how well we can adapt lessons

The exception is safeguarding, which is covered above and does not run on consent.

Who we share it with

We do not sell your information. We do not share it for anyone else’s marketing.

We share it with:

Our tutors. Tutors are self-employed contractors engaged under a contract for services. They see only what they need to teach your child: first name, level, subject, what you have told us about how to help, and their own lesson records. Their contract requires them to keep it confidential, to use our channels, and to follow this policy and our safeguarding policy.

Companies that provide services to us, acting on our instructions as our processors:

Others, where we have to:

• Police Scotland, the local council’s social work service, or another agency, where we believe a child is at risk of harm
• Disclosure Scotland, where we have a duty to refer someone
• HMRC, our accountant, our insurers, or our professional advisers
• anyone else where the law requires it

We currently manage invoicing internally and receive payment by bank transfer. We do not currently give customer records to separate bookkeeping software or an external accountant. If that changes, we will update this policy before sharing the information.

Sending information outside the UK

Two of the services above are based in the United States.

Google provides the optional booking calendar on our booking page, through Google Calendar’s appointment scheduling. It is the same Google account that provides our email, our lessons and our homework, so it is covered by the same agreement rather than being a separate company holding your details. Nothing at all is sent to Google from that page until you press the button to load the calendar — the page does not contact them before that.

Form submissions go straight to our own inbox. What you type into a form on this website, and the CV you attach if you attach one, is delivered by Google Workspace — the same Google account that provides our email — and is not passed through any other company on the way. There is no separate form provider holding a copy.

Google Analytics, if we switch it on, involves a transfer to Google in the United States, and only after you have agreed.

Where information goes outside the UK, we make sure it is protected to the standard UK law requires, using either:

• the UK Extension to the EU–US Data Privacy Framework, where the company is certified under it, or
• the UK’s International Data Transfer Agreement, or the international data transfer addendum to the European Commission’s standard contractual clauses, backed by a transfer risk assessment

How long we keep it

We do not keep things indefinitely. These are the periods we propose.

We review the mailbox at least every three months. Enquiries that did not become tuition are deleted 12 months after the last contact, unsuccessful tutor applications after six months, and customer, tutor, accounting and safeguarding emails according to the relevant period above. We delete earlier where there is no continuing reason to keep something.

Your rights

You can ask us to:

• give you a copy of the information we hold about you
• correct it if it is wrong or incomplete
• delete it, where we do not have a good reason to keep it
• stop or limit what we are doing with it
• hand it over to you or another provider in a portable format, where it was given to us electronically on the basis of consent or a contract
• stop relying on legitimate interests, if you object and we cannot show a strong enough reason to continue

Where we are relying on your consent, you can withdraw it at any time. That does not affect anything we did before you withdrew it.

We do not make any decisions about you by automated means, and we do not profile you.

To exercise any of these, email enquiries@toptutorsscotland.co.uk. We will reply within one month. If a request is complicated we may take up to two further months, and we will tell you if so. It is free, unless a request is clearly excessive or repetitive.

We may ask you to confirm who you are first. That is to stop us handing a child’s information to the wrong person.

Complaints

If you are unhappy with how we have handled your information, please tell us first — email enquiries@toptutorsscotland.co.uk and we will look into it.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator. You do not have to come to us first.

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 www.ico.org.uk/make-a-complaint

The ICO also has an office in Scotland: 45 Melville Street, Edinburgh, EH3 7HL

Keeping information safe

We keep what we hold to a minimum, and only the people who need it can see it. Tutors see only their own pupils. Access to our Google Workspace email and files is protected by strong passwords and two-factor authentication.

If something goes wrong and personal information is lost or exposed, we will assess it, and where the law requires it we will report it to the ICO within 72 hours of becoming aware. Where there is a high risk to you or your child, we will tell you directly.

One thing worth knowing: if our online form submission is not connected, the site falls back to opening your own email app with your answers filled in. That email is sent by your own email provider in the ordinary way, and it is not encrypted end to end. It is the same as any other email you send.

Changes to this policy

If we change this policy we will update the date at the top. If the change is significant — a new processor, a new purpose, a new transfer — we will tell customers by email.

---