Elite Tutors Sussex Privacy Policy
Who we are
11858945), providing bespoke tutor–student matching and educational services.
Introduction
By providing us with your data, you warrant to us that you are over 13 years of age.
This Data Protection & Privacy Policy outlines how Elite Tutors Sussex Ltd (“we”, “us”, “our”) collects, processes, stores, and protects personal data in compliance with:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Privacy and Electronic Communications Regulations (PECR)
- EU General Data Protection Regulation (EU GDPR), where applicable
This policy applies to all personal data processed by Elite Tutors Sussex Ltd in the course of its business. It covers staff, tutors, contractors, clients, students, and third parties.
It serves as both:
- Our public privacy notice for clients and users, and
- Our internal operational policy for GDPR compliance.
Contact Details
Email: hello@elitetutorsltd.com
Address: 57 Newtown Road, Hove, East Sussex BN3 7BA
Our Data Protection Officer (DPO) is:
Fay Van der Westhuizen – Email: fay@elitetutorsltd.com
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk. However, we encourage you to contact us first so we can try to resolve the matter.
What data do we collect about you
Identity Data – name, date of birth, gender, username, marital status, title
Contact Data – address, email, phone number
Financial Data – bank details, payment card details
Transaction Data – purchases, payments, service history
Technical Data – IP address, login data, browser type/version, device information, cookies
Profile Data – login credentials, preferences, feedback, survey responses
Usage Data – how you use our website and services
Marketing & Communication Data – preferences, communication records
Special Category Data – limited health/learning needs (only with explicit consent or other valid
legal basis).
We may also process aggregated or anonymised data for statistical purposes.
We do not routinely collect sensitive data such as race, ethnicity, religion, political views, or biometric data unless strictly necessary.
- Lawful Bases for Processing – You will need to add this
We process personal data under:
- Contract (to deliver services)
- Legal obligation (e.g., safeguarding, HMRC compliance)
- Legitimate interests (business development, service improvement, fraud prevention)
- Consent (marketing, special category data, testimonials)
How we collect your personal data
- Direct interactions – forms, email, phone, post, sign-ups, account creation, feedback
- Automated technologies – cookies, server logs, analytics
- Third parties – referrals, professional partners, payment providers, analytics services (e.g., Google, Stripe)
- Public sources – Companies House, Electoral Register
How we use your personal data
- Registering you as a client/tutor
- Providing educational services
- Managing accounts, payments & invoices
- Complying with safeguarding & legal obligations
- Sending service updates and marketing (with consent or legitimate interest)
- Administering competitions, surveys, and promotions
- Improving our website and customer experience through analytics
- Ensuring business security, fraud prevention, and IT management
- Change of purpose: If we need to use your data for a new reason, we will notify you and explain the lawful basis.
- Marketing Communications
You will receive marketing communications if:
- You requested information or purchased services; or
- You registered for promotions/resources; and
- You have not opted out.
We will always obtain opt-in consent before sharing your details with third parties for marketing.
You can opt out at any time via unsubscribe links or lettig us know at hello@elitetutorsltd.com - Marketing Communications
- You will receive marketing communications if:
- You requested information or purchased services; or
- You registered for promotions/resources; and
- You have not opted out.
We will always obtain opt-in consent before sharing your details with third parties for marketing.
You can opt out at any time via unsubscribe links or by emailing hello@elitetutorsltd.com - TestimonialsWith your explicit written consent, we may use testimonials (including your name or image) for marketing on our website, social media, or printed materials.
You may withdraw consent at any time, and we will remove your testimonial from future use. - Staff & Tutor Responsibilities
- All staff/tutors must complete GDPR training
- Use secure devices/platforms only
- Avoid unencrypted storage of data
- Dispose of printed materials securely
- Ensure written records are professional & factual
| Purpose/Activity | Type of data | Lawful basis for processing |
| To register you as a new customer | (a) Identity (b) Contact | Performance of a contract with you |
| To process and deliver your order including: (a) Manage payments, fees and charges (b) Collect and recover money owed to us | (a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing & Communications | (a) Performance of a contract with you (b) Necessary for our legitimate interests to recover debts owed to us |
| To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy (b) Asking you to leave a review or take a survey | (a) Identity (b) Contact (c) Profile (d) Marketing & Communications | (a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests to keep our records updated and to study how customers use our products/services |
| To enable you to partake in a prize draw, competition or complete a survey | (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing & Communications | (a) Performance of a contract with you (b) Necessary for our legitimate interests to study how customers use our products/services, to develop them and grow our business |
| To administer and protect our business and our site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) | (a) Identity (b) Contact (c) Technical | (a) Necessary for our legitimate interests for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise (b) Necessary to comply with a legal obligation |
| To deliver relevant content and advertisements to you and measure and understand the effectiveness of our advertising | (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing & Communications (f) Technical | Necessary for our legitimate interests to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy |
| To use data analytics to improve our website, products/services, marketing, customer relationships and experiences | (a) Technical (b) Usage | Necessary for our legitimate interests to define types of customers for our products and services, to keep our site updated and relevant, to develop our business and to inform our marketing strategy |
| To make suggestions and recommendations to you about goods or services that may be of interest to you | (a) Identity (b) Contact (c) Technical | Necessary for our legitimate interests to develop our products/services and grow our business |
You will receive marketing communications from us if you have:
• requested information from us or purchased goods or services from us; or
• if you provided us with your details when you entered a competition or registered for a promotion or free resources; and
• in each case, you have not opted out of receiving that marketing.
We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.
You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by emailing us at at any time.
Where you opt out of receiving our marketing communications, this will not apply to personal data provided to us as a result of a product/service purchase, warranty registration, product/service experience or other transactions.
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to find out more about how the processing for the new purpose is compatible with the original purpose, please email us at info@elitetutorssussex.com
If we need to use your personal data for a purpose unrelated to the purpose for which we collected the data, we will notify you and we will explain the legal ground of processing.
We may process your personal data without your knowledge or consent where this is required or permitted by law.
International transfers
- UK: All processing complies with UK GDPR & Data Protection Act 2018.
- EEA: When working with EEA clients or partners, we comply with EU GDPR. Transfers between the UK and EEA are covered by the adequacy decision (June 2021).
- Worldwide: For transfers outside the UK/EEA, we use one of:
- Adequacy regulations/decisions
- SCCs or IDTAs
- Explicit consent (after informing you of risks)
- Necessity for contract/public interest
Data security
- Password-protected systems & multi-factor authentication
- Encryption for sensitive files
- Regular software and device updates
- Restricted access for authorised personnel only
- Secure shredding of printed documents
- Breach response procedures
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Data retention
- Client/tutor records: 6 years after service ends
- Financial records: 6 years (HMRC requirement)
Secure disposal methods include deletion from systems, cloud storage, and shredding of documents.
Data Subject Access Requests (DSARs)
- Must be forwarded to the Data Protection Lead immediately
- Responses must be accurate, respectful, and timely
- Unnecessary personal data should not be retained
Data Breach Management
- All suspected breaches must be reported immediately
- Assessed within 24 hours
- Serious breaches reported to ICO within 72 hours
- Affected individuals notified promptly where required
Your legal rights
- UK GDPR & Data Protection Act 2018 (ICO guidance)
- PECR (direct marketing)
- EU GDPR (when processing relates to EEA individuals)
- European Data Protection Board (EDPB) guidance
- Adequacy decisions, Standard Contractual Clauses (SCCs), International Data Transfer Agreements (IDTAs)
Sources include:
- ICO (UK)
- European Commission & EDPB (EEA)
- UK Government Department for Science, Innovation and Technology
Data Protection Principles
- Lawfulness, fairness & transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity & confidentiality
- Accountability
Policy Review
Third-party links
Cookies
