Privacy notice

Who is responsible for your information

EduNect is the trading name used for this tutoring service and is responsible for the personal information described in this notice, acting as the data controller under UK data protection law.

EduNect has not been confirmed here as a separate registered legal entity. The legal entity details, including any company name, company number and registered address, will be added to this notice once they are confirmed.

How to contact us about privacy

Privacy contact: EduNect. Privacy email: privacy@edunect.uk.

Please use this address for privacy questions and for access, correction, deletion, restriction, objection, portability or consent withdrawal requests. We do not publish an individual person's name as the privacy contact.

What we collect

EduNect only collects information that is reasonably necessary to provide and manage tutoring services.

For learners this may include a first or preferred name, the learning stage (for example Year 11), the subjects and levels being studied, and the account and contact information needed to arrange lessons, including a parent/guardian email address so that the two accounts can be linked. We do not ask learners for their school or college. Learner profiles never display a surname publicly.

We do not collect a learner's surname or full legal name, gender, date of birth or exact age anywhere on the platform. Where we need to know the stage a learner is working at we use the year group or qualification level instead.

Learners and other account holders may optionally choose their pronouns from a short list, or enter their own. Pronouns are entirely optional, can be changed or cleared at any time, are never required to create an account, book lessons or be matched with a tutor, and are never displayed publicly. We never infer gender from a name, pronouns or anything else.

For tutors this may include name, qualifications, experience, a profile photograph, an optional teaching sample video, relevant clearance and safeguarding information, application information, and references where applicable.

CVs, DBS certificates and other private supporting documents are stored privately in restricted storage and are not publicly accessible. They are only viewable by EduNect administrators reviewing the application.

Learner and guardian information is private

Learner and guardian information is private and is never publicly displayed on EduNect. This includes names, email addresses, contact details, learner information, account details, lesson and booking information, messages, documents and payment information.

It is only shared with people who are authorised to access it and who need it to provide or manage the tutoring service. For example, a guardian may access information relating to their linked learner, and an assigned tutor may access the information they need to deliver lessons.

Learner and guardian information does not appear on public profiles, search results, marketing pages, tutor profiles, testimonials, public directories or any other publicly accessible part of the site. Learner and guardian email addresses and contact details are never displayed publicly. The only exception is a review you choose to submit yourself: it is published with the display name you enter and only after an EduNect administrator has approved it, and it never includes contact details.

Access is controlled by sign-in, role-based permissions and database-level access rules (row level security). These rules are applied in the database, so information cannot be reached by guessing a web address, an account identifier or by altering a request.

Learner and guardian account linking

EduNect requires a guardian relationship for learner accounts. A learner cannot complete registration without providing the required guardian email address, and learner and guardian accounts must use separate email addresses.

We process the information needed to establish and maintain that relationship, such as both email addresses and the link between the two accounts. Where a learner or guardian starts the registration or linking process, the other person may receive an invitation or notification. Some notifications are currently handled manually by EduNect rather than sent automatically.

A guardian does not gain access to unrelated learners, and a learner does not gain access to unrelated guardian or learner information.

Sensitive and special category information

Information about health, disability and certain special educational needs may be special category data under UK GDPR. Not every learning need or preference falls into that category, but we treat this kind of information carefully in all cases.

We only ask for it where it is genuinely relevant to supporting the learner. It is private by default and access is restricted to the people who need it for the relevant tutoring or support purpose.

Please avoid sharing unnecessary medical or highly personal details in general messages, lesson notes or profile fields. Share only what helps the learner get the right support.

Where we rely on your explicit consent for special category information, you can withdraw that consent at any time. In some situations a different lawful basis may apply, for example where information is needed to meet a legal or safeguarding obligation.

How we use information

• Creating and managing accounts
• Linking learners and guardians
• Providing tutoring
• Matching learners with tutors
• Managing tutor applications
• Managing consultations
• Managing lesson requests and bookings
• Providing lesson resources and lesson links
• Facilitating authorised communication between the people involved in a lesson
• Managing payments and payment records
• Maintaining platform security and preventing misuse
• Maintaining appropriate operational records
• Meeting legal obligations
• Establishing, exercising or defending legal claims

Lawful basis

Different activities rely on different lawful bases under UK GDPR. We do not rely on consent for everything.

Contract

Creating and running your account, arranging and delivering lessons, sharing lesson links and resources, and handling payment instructions and records for the services you have asked for.

Legitimate interests

Matching learners with suitable tutors, reviewing tutor applications and references, keeping the platform secure, preventing misuse, keeping audit and operational records, and defending legal claims. We balance these interests against your rights and interests.

Legal obligation

Keeping accounting and tax records, responding to lawful requests from regulators or authorities, and meeting safeguarding duties where they apply.

Consent

Optional items such as a teaching sample video, optional marketing messages, and certain sensitive information you choose to share. Where we rely on consent you can withdraw it at any time, and withdrawal does not affect processing that happened before.

Sharing your information

We share information only where it is necessary, and only with people or organisations who need it:

• The relevant tutor, learner and guardian involved in a lesson or request
• Technology and service providers who host and run the platform on our behalf
• Payment or accounting providers, where applicable
• Professional advisers, where necessary
• Regulators or authorities, where legally required

Payments

EduNect does not process card payments through the platform. We do not collect or store card numbers or other payment credentials.

Where a lesson or request has been approved for payment, guardians receive official EduNect payment instructions inside their authorised account. Payment is made outside the platform and is then checked and marked as verified by an EduNect administrator.

Payment and transaction records may be kept where necessary for accounting, contractual, legal or other legitimate purposes.

How long we keep your information

EduNect does not keep personal data indefinitely. We keep personal information only for as long as it is necessary for the purpose it was collected for, unless a longer period is required or permitted by law.

We maintain an internal retention schedule and review retention periods regularly. The periods below are EduNect policy choices for how we run the service, not universal UK GDPR requirements.

Active learner and guardian accounts

Kept while the account and tutoring relationship remain active. Inactive accounts are reviewed for deletion or anonymisation after approximately 2 years, unless information needs to be kept for another lawful reason.

Lesson and booking records

Normally up to 6 years after the tutoring relationship or related financial activity ends, where needed for accounting, contractual records or potential legal claims.

Payment and financial records

Normally 6 years, subject to applicable accounting and tax requirements.

Unsuccessful tutor applications

Normally 2 years after the application is closed, unless a different period is justified.

Approved tutor records

Kept while the tutor relationship is active and for an appropriate period afterwards where needed for legal, contractual or regulatory reasons.

References and recruitment information

Kept only for as long as reasonably necessary for the relevant application, any legitimate follow-up and any legal requirement.

Consultation requests

Normally up to 2 years after the request is closed, unless a longer period is necessary for a lawful reason.

Messages and communications

Normally up to 2 years after the relevant relationship or matter ends, unless needed for safeguarding, dispute resolution, legal claims, contractual records or another lawful purpose.

Admin notes

Kept only while necessary for the relevant operational, safeguarding, contractual or legal purpose.

Audit logs

Normally up to 6 years, where needed to demonstrate accountability and security and to show the history of important administrative actions.

Uploaded documents

Kept only while required for the relevant tutoring or operational purpose, subject to legal requirements.

DBS and safeguarding checks

DBS certificates do not have an official expiry date. EduNect may require appropriate DBS checks or status verification as part of its safeguarding process, and may review a tutor's DBS status from time to time.

We do not keep full DBS certificates indefinitely. We retain only the information that is genuinely necessary, such as a record that a check was seen and its date and reference, for an appropriate period. Certificates and other supporting documents are stored in restricted private storage and are never publicly accessible.

Reviews of sensitive information

Where you have shared sensitive information, we record when it was shared and prompt you inside your account to confirm whether it should be kept, updated or deleted after the review period has passed. Deletion at that point is carried out when you choose it, or by an administrator. Information is not deleted automatically without a review.

Your rights

You can view and update certain information yourself in Your Data and Privacy inside your account, and download a copy of the main information we hold about you. Not every item can be deleted directly in the app, so some requests need to be made to us.

You can contact us to request:

• Access to your personal information
• Correction of inaccurate information
• Deletion, where applicable
• Restriction of processing, where applicable
• Objection to certain processing, where applicable
• Data portability, where applicable
• Withdrawal of consent, where processing relies on consent

Making a data protection request

To make a request, email privacy@edunect.uk, telling us what you would like and which account it relates to. Requests are handled manually by an EduNect administrator. We may need to confirm your identity before we act.

EduNect will respond to valid data protection requests without undue delay and normally within one month. Where permitted by law, complex or numerous requests may take longer. We will explain this if an extension applies.

Children's information

EduNect processes information about learners who are under 18. We take extra care with this information, keep it to what is needed to provide tutoring, and limit access to authorised people who need it.

Where we ask a learner directly for information, we explain in simple language what it is for. Guardians can ask us about the information we hold about the learners linked to their account.

Security

We use appropriate technical and organisational measures to protect personal information, including account authentication and optional two-factor authentication, role-based permissions, database-level access rules (row level security), restricted access to private documents through time-limited secure links, careful handling of credentials, audit logging of important administrative actions, and secure deletion where appropriate.

No online service can be completely secure or risk-free. If you think your account has been accessed by someone else, contact us straight away.

Where your information is held

EduNect uses third-party hosting and infrastructure providers to run the platform. Depending on the provider and region used, some information may be processed outside the UK.

Where personal information is transferred outside the UK, we rely on the safeguards required by UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum. The specific hosting locations and safeguards for EduNect are being confirmed and will be listed here before launch.

Automated decision-making

EduNect does not make decisions about you that produce legal or similarly significant effects using solely automated processing or profiling.

Ordinary platform activity, such as a request moving from Payment Required to Confirmed after an administrator acts, is a status update reflecting a human decision, not automated decision-making of that kind.

Cookies and similar technologies

A production audit found that EduNect sets no cookies of its own. The platform uses browser storage that is necessary to run the site, keep you signed in and keep your session secure, plus one small entry that remembers your cookie choice and one that remembers your scroll position. We do not use analytics, advertising or marketing technologies.

Full details are in our cookie notice.

Data breaches

We maintain procedures for identifying, assessing and responding to personal data breaches. Where legally required, we will report a breach to the Information Commissioner's Office and tell affected individuals.

Complaints

If you have a privacy concern, please contact us first at privacy@edunect.uk so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk, or by calling their helpline on 0303 123 1113.

Changes to this notice

We may update this notice as our services or legal obligations change. Significant changes will be highlighted inside your account.