Magpie Tuition provides one-to-one online tuition to school-age students across Scotland. For the purposes of UK data protection law we are the data controller for the personal data described in this policy.
| Trading name | Magpie Tuition |
|---|---|
| Legal entity | Sole trader. Magpie Tuition is not a registered company, so there is no company number. |
| Postal address | Available on request by emailing the address below. We are a home-based sole trader and do not publish a residential address; you can reach us in writing at any time and we will provide one. |
| Contact for privacy questions | sessions@magpietuition.uk |
| ICO registration | Registration with the Information Commissioner's Office is in progress. We will publish the reference here once it is issued. |
We have not appointed a Data Protection Officer. At our size this is not a legal requirement, but the contact address above reaches the person responsible for data protection.
The enquiry form on our homepage does not send anything to us over the internet. It opens a pre-filled message in your own email application, which you then choose to send. Nothing reaches us until you press send in your own mail program, and the website itself never stores or transmits what you typed.
When you do send that email, we receive: your name, your email address, the level of study you selected, and whatever you write in the message.
If you email us directly or message us on WhatsApp, we receive whatever you choose to send, along with your email address or phone number.
Bookings are handled by Microsoft Bookings. When you book you provide your name, email address, phone number where given, and your answers to the intake questions. Microsoft processes this on our behalf.
| Category | Examples |
|---|---|
| Student details | Name, year group, school where relevant, subjects and level |
| Parent or guardian details | Name, email address, phone number |
| Session records | Dates, subjects, attendance, duration, tutor assigned, progress notes |
| Work submitted | Homework, practice papers and marked work exchanged with your tutor |
| Financial records | Invoices, amounts, payment dates. We do not see or store card details — we are paid by bank transfer, so no card details exist for us to hold |
| Correspondence | Emails and messages between us |
We do not collect special category data (such as health or ethnicity) as a matter of routine. If a parent chooses to tell us about a diagnosed learning difference so we can teach appropriately, we record only what is necessary for that purpose, and only with explicit consent.
Signed-in students, parents and tutors can reach lesson materials at magpietuition.uk/portal and hand work in. Using it means we process:
| What | Detail |
|---|---|
| Your Microsoft account identity | Your name, email address and an account identifier issued by Microsoft, together with which of our groups you belong to. This is what decides which folders you can open. |
| Files you upload | Homework and other work you submit, stored in your own folder. Only you and your tutor can reach that folder; other students cannot see it, and it is not shared with anyone else. |
| A security log | Each sign-in, download and upload is recorded, along with the date and time, the file name, and the account identifier that acted. It does not record your IP address, your name or your email address. |
The security log exists so that we can answer the question “who opened this child’s work, and when”. That is a safeguarding measure. It is never used to monitor how hard a student is working, and it is not used for any commercial purpose.
Some lessons are recorded. A recording captures a child’s voice, their image where the camera is on, and their work in progress, so we treat it as one of the more sensitive things we hold.
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry | Legitimate interests — replying to someone who contacted us |
| Arranging and delivering lessons | Performance of a contract with the parent or guardian |
| Keeping session and progress records | Performance of a contract, and our legitimate interest in teaching effectively |
| Invoicing and keeping accounts | Legal obligation (tax and accounting law) |
| Safeguarding concerns and records | Legal obligation, and protecting someone's vital interests where urgent |
| Recording a lesson, where this happens | Consent, which can be withdrawn — see our Session Recording policy |
| Occasional service emails to existing clients | Legitimate interests |
| Running the member portal and deciding who may open which files | Performance of a contract with the parent or guardian |
| Keeping the portal security log | Legitimate interests — keeping children’s work secure and being able to show who accessed it — and our legal obligation to safeguard |
| Marketing emails, if we ever send them | Consent. We do not currently send marketing email |
Most of our students are under 18 and many are under 16. We take this seriously and it shapes how the service is built.
We have had regard to the Information Commissioner's Age Appropriate Design Code in designing the service, including its expectations on data minimisation, defaulting to high privacy, and not using children's data in ways that are against their interests.
We do not sell personal data, and we never will. We use a small number of established suppliers who process data on our instructions:
| Supplier | What they handle |
|---|---|
| Microsoft | Email, calendars, file storage and bookings, through Microsoft 365 |
| Cloudflare | Serves this website, protects it from attack, and stores the portal’s security log and sign-in sessions on our behalf |
| Supplies the web fonts used on this site. Your browser requests those fonts from Google, which means Google receives your IP address. See our Cookie Policy | |
| Our bank | Fees are paid by bank transfer against an invoice. There is no card processor, no payment page and no third-party checkout, so no card details are ever entered on this website or passed to anyone on our behalf. |
| Trustpilot | Only if you choose to leave a review. Reviews you write are governed by Trustpilot's own privacy policy |
We may also disclose data where the law requires it, or where there is a safeguarding concern that means we must contact the police, social services or another agency. Safeguarding disclosures do not require your consent and may be made without notifying you first, where notifying you would increase risk to a child.
Our Microsoft 365 tenant is configured in the United Kingdom region.
Cloudflare operates a global network, so a copy of this website may be served from a location outside the UK. The public pages of the website contain no personal data, so serving them from outside the UK does not involve your information.
The member portal is different, and we would rather be precise about it than reassuring. Files you upload, and the lesson materials you download, are held in our Microsoft 365 tenant in the United Kingdom. Two smaller things sit with Cloudflare instead: the sign-in session, which holds a random identifier and expires within hours, and the security log described in section 2. Those are stored in Cloudflare’s Western Europe region, so they are held in the EU rather than the UK. The EU is covered by UK adequacy regulations, which means data may be transferred there without additional safeguards.
Where any supplier transfers personal data outside the UK, that transfer is covered by the UK's approved safeguards, such as the International Data Transfer Addendum or adequacy regulations.
| Record | Kept for | Why |
|---|---|---|
| Enquiries that do not become bookings | 12 months | So we can pick up the conversation if you come back |
| Student and parent contact details | 2 years after the last lesson | Students often return for the next qualification |
| Session and progress records | 2 years after the last lesson | Continuity of teaching, and resolving any dispute |
| Work submitted and marked | 12 months after the last lesson | No reason to keep a student's homework longer |
| Portal security log — sign-ins, downloads, uploads | Retained alongside the safeguarding schedule below, since the two answer the same kind of question | Security and safeguarding |
| Invoices and accounting records | 6 years | Required by UK tax law |
| Safeguarding records | As long as our safeguarding obligations require, which is considerably longer than the periods above and is set by law and statutory guidance rather than by us | Legal obligation |
| Lesson recordings, where made | Deleted within 30 days, unless the recording is needed for a safeguarding reason, in which case it follows the safeguarding row above | Consent-based |
When a retention period ends we delete the records, or anonymise them so they can no longer identify anyone.
Under UK data protection law you can ask us to:
A child can exercise these rights themselves where they are old enough to understand what they are asking. In Scotland a child of 12 or over is generally presumed to have that understanding. Otherwise a parent or guardian may act on their behalf.
Write to sessions@magpietuition.uk and we will respond within one month. There is no charge.
This website sets no cookies and contains no analytics, advertising or tracking of any kind. Our Cookie Policy explains this in full, including the third-party content that loads only when you ask for it.
If you are unhappy with how we have handled your data, please tell us first at sessions@magpietuition.uk so we can try to put it right.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first.
If we change this policy we will update the date at the top. Where a change materially affects how we use your data, we will tell existing clients by email.