This policy was prepared in good faith and reflects how the service actually works, but it has not been checked by a solicitor. Every passage highlighted like this needs a decision or a real value from Magpie Tuition before publication. Do not treat this as legal advice.
Magpie Tuition provides one-to-one online tuition to school-age students across Scotland. For the purposes of UK data protection law we are the data controller for the personal data described in this policy.
| Trading name | Magpie Tuition |
|---|---|
| Legal entity | [Sole trader or limited company — confirm, and add company number if registered] |
| Registered address | [Business address for correspondence] |
| Contact for privacy questions | hello@magpietuition.uk |
| ICO registration | [Registration number, once registered — see note in section 10] |
We have not appointed a Data Protection Officer. At our size this is not a legal requirement, but the contact address above reaches the person responsible for data protection.
The enquiry form on our homepage does not send anything to us over the internet. It opens a pre-filled message in your own email application, which you then choose to send. Nothing reaches us until you press send in your own mail program, and the website itself never stores or transmits what you typed.
When you do send that email, we receive: your name, your email address, the level of study you selected, and whatever you write in the message.
If you email us directly or message us on WhatsApp, we receive whatever you choose to send, along with your email address or phone number.
Bookings are handled by Microsoft Bookings. When you book you provide your name, email address, phone number where given, and your answers to the intake questions. Microsoft processes this on our behalf.
| Category | Examples |
|---|---|
| Student details | Name, year group, school where relevant, subjects and level |
| Parent or guardian details | Name, email address, phone number |
| Session records | Dates, subjects, attendance, duration, tutor assigned, progress notes |
| Work submitted | Homework, practice papers and marked work exchanged with your tutor |
| Financial records | Invoices, amounts, payment dates. We do not see or store card details — payments are handled by [payment provider — confirm] |
| Correspondence | Emails and messages between us |
We do not collect special category data (such as health or ethnicity) as a matter of routine. If a parent chooses to tell us about a diagnosed learning difference so we can teach appropriately, we record only what is necessary for that purpose, and only with explicit consent.
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry | Legitimate interests — replying to someone who contacted us |
| Arranging and delivering lessons | Performance of a contract with the parent or guardian |
| Keeping session and progress records | Performance of a contract, and our legitimate interest in teaching effectively |
| Invoicing and keeping accounts | Legal obligation (tax and accounting law) |
| Safeguarding concerns and records | Legal obligation, and protecting someone's vital interests where urgent |
| Recording a lesson, where this happens | Consent, which can be withdrawn — see our Session Recording policy |
| Occasional service emails to existing clients | Legitimate interests |
| Marketing emails, if we ever send them | Consent. We do not currently send marketing email |
Most of our students are under 18 and many are under 16. We take this seriously and it shapes how the service is built.
We have had regard to the Information Commissioner's Age Appropriate Design Code in designing the service, including its expectations on data minimisation, defaulting to high privacy, and not using children's data in ways that are against their interests.
We do not sell personal data, and we never will. We use a small number of established suppliers who process data on our instructions:
| Supplier | What they handle |
|---|---|
| Microsoft | Email, calendars, file storage and bookings, through Microsoft 365 |
| Cloudflare | Serves this website and protects it from attack |
| Supplies the web fonts used on this site. Your browser requests those fonts from Google, which means Google receives your IP address. See our Cookie Policy | |
| [Payment provider] | [Confirm who processes payments, then describe] |
| Trustpilot | Only if you choose to leave a review. Reviews you write are governed by Trustpilot's own privacy policy |
We may also disclose data where the law requires it, or where there is a safeguarding concern that means we must contact the police, social services or another agency. Safeguarding disclosures do not require your consent and may be made without notifying you first, where notifying you would increase risk to a child.
Our Microsoft 365 tenant is configured in the [Confirm from Microsoft 365 admin centre → Settings → Org settings → Organization profile → Data location, then state the actual region for Exchange, SharePoint and Teams] region.
Cloudflare operates a global network, so a copy of this website may be served from a location outside the UK. The website contains no personal data, so this transfer does not involve your information.
Where any supplier transfers personal data outside the UK, that transfer is covered by the UK's approved safeguards, such as the International Data Transfer Addendum or adequacy regulations.
The schedule below is a reasonable starting point, not a decision you have made. Confirm each period before publishing, and note that the financial and safeguarding rows are driven by law rather than preference.
| Record | Kept for | Why |
|---|---|---|
| Enquiries that do not become bookings | 12 months | So we can pick up the conversation if you come back |
| Student and parent contact details | 2 years after the last lesson | Students often return for the next qualification |
| Session and progress records | 2 years after the last lesson | Continuity of teaching, and resolving any dispute |
| Work submitted and marked | 12 months after the last lesson | No reason to keep a student's homework longer |
| Invoices and accounting records | 6 years | Required by UK tax law |
| Safeguarding records | [Take advice — safeguarding retention is long and is not a free choice] | Legal obligation |
| Lesson recordings, where made | [Confirm — see Session Recording policy] | Consent-based |
When a retention period ends we delete the records, or anonymise them so they can no longer identify anyone.
Under UK data protection law you can ask us to:
A child can exercise these rights themselves where they are old enough to understand what they are asking. In Scotland a child of 12 or over is generally presumed to have that understanding. Otherwise a parent or guardian may act on their behalf.
Write to hello@magpietuition.uk and we will respond within one month. There is no charge.
This website sets no cookies and contains no analytics, advertising or tracking of any kind. Our Cookie Policy explains this in full, including the third-party content that loads only when you ask for it.
If you are unhappy with how we have handled your data, please tell us first at hello@magpietuition.uk so we can try to put it right.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first.
If we change this policy we will update the date at the top. Where a change materially affects how we use your data, we will tell existing clients by email.