Tutor North Kent 11+ Tuition

General Data Protection Regulation and Privacy Policy

Policy Start Date: 1^st September 2025

Review Date: 1^st September 2026

This policy applies to anyone working on behalf of

Shea-Lowe Education, including directors, paid staff, subcontractors and volunteers.

1. Introduction

1.1 Shea-Lowe Education is required to keep and process certain information about its tutors, subcontractors, pupils, clients and parents/carers in accordance with its legal obligations under the General Data Protection Regulation (GDPR).

1.2 This policy is in place to ensure that all practitioners and tutors are aware of their responsibilities and outlines how Shea-Lowe Education complies with the core principles of GDPR.

2. Legal Framework

2.1 This policy has due regard to legislation, including, but not limited to, the following:

The General Data Protection Regulation
The Freedom of Information Act 2000

3. Data Collection

3.1 We may collect the following types of personal data, depending on your interactions with Shea-Lowe Education:

Personal Identification Information: Name, email address, phone number, and other identifiers.
Usage Data: Information about how you interact with our website and services, including IP address, browser type, access times, and pages viewed.
Communication Data: Messages, enquiries, or feedback you submit through our website, company phone number, email address or contact forms.

4. How We Use Your Data

4.1 We will use your personal data for the following purposes:

Service Delivery: To provide the services or information you request, including personalising your experience.
Communication: To respond to your queries, updates, or requests for assistance.
Legal Compliance: To comply with legal obligations, including responding to legal processes or requests from authorities.
Marketing: We may send newsletters, promotional materials, or service updates.
Safeguarding: In line with our safeguarding policy, if we have a serious concern about your child’s welfare, your data may be shared accordingly with the relevant agencies.

5. Legal Basis for Processing Data

5.1 We process personal data based on the following legal grounds:

Consent: By using our services and agreeing to our terms and conditions, you have given your consent for specific uses of your personal data.
Contractual Necessity: Processing is necessary to perform a contract with you or provide requested services.
Legal Obligation: Processing is necessary to comply with legal requirements.
Legitimate Interest: Processing is necessary for our legitimate business interests, such as improving our services.

6. Sharing Your Data

6.1 We do not share your personal data with third parties unless:

It is necessary for the performance of services (e.g. payment processors or service providers).
You have given explicit consent.
It is required by law or to protect the rights, property, or safety of Shea-Lowe Education or others.
In line with our safeguarding policy, if we have a serious concern about your child’s welfare, your data may be shared accordingly with the relevant agencies.

7. Your Data Protection Rights

7.1 Under GDPR, you have the following rights:

Access: You can request access to the personal data we hold about you.
Rectification: You can request correction of any inaccurate or incomplete data.
Erasure: You have the right to request that we delete your personal data, subject to certain conditions.
Restriction: You can request that we limit the processing of your data in certain circumstances.
Objection: You have the right to object to our processing of your personal data based on legitimate interests or for direct marketing.
Portability: You can request a copy of your data in a standard, easy-to-read format.

To exercise these rights, please contact us at contactus@shealoweeducation.com. We will respond to your request within one month.

8. Applicable Data

8.1 GDPR applies to “personal data,” meaning any information that can identify a person, directly or indirectly, such as a name, ID number, location, or online identifier. The GDPR applies to both automated personal data and to manual filing systems where personal data is accessible.

8.2 The GDPR refers to sensitive personal data as “special categories of personal data”. The following categories of data are included in this definition: gender, pronouns, racial or ethnic origin, religious beliefs and data concerning health information or diagnosis.

8.3 Personal data relating to criminal convictions and offences are not included, but similar extra safeguards apply to its processing.

9. Principles

9.1 The GDPR sets out the following data protection principles:

data will be processed lawfully, fairly and in a transparent manner;
data is collected for specified, explicit and legitimate purposes and not processed further in a manner incompatible with those purposes;
data is adequate, relevant and limited to what is necessary for the purpose collected;
data is accurate and kept up to date and that inaccurate data is erased without delay;
data is kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the data is processed;

(f) data is processed in a manner which ensures appropriate security of the data, including protection against unauthorised/unlawful processing and against accidental loss, destruction or damage.

10. Accountability & Governance

10.1 Shea-Lowe Education will implement appropriate technical and organisational measures to demonstrate that data is processed in accordance with the principles of the GDPR.

11. Data Security

11.1 Confidential paper records will be kept in a locked filing cabinet. Paper records will not be left unattended anywhere with general access.

11.2 Digital data will be coded, encrypted or password-protected, both on a local hard drive and on a network drive that is regularly backed up.

11.3 Where data is saved on removable storage or a portable device the device will be kept in a secure and safe place when not in use.

11.4 All electronic devices will be password protected to protect the information on the device in the event of loss or theft.

11.5 Memory sticks will not be used to hold personal data unless they are password protected and fully encrypted.

11.6 All practitioners will be provided with their own secure login and password and will regularly change their passwords.

11.7 Emails containing sensitive or confidential information are password protected if there are unsecure servers between the sender and the recipient.

11.8 Circular emails to clients will be sent blind carbon copy (bcc) so that email addresses are not disclosed to other recipients via email account or booking platform.

11.9 Where personal data that could be considered private or confidential is taken off premises, either in electronic or paper format, practitioners will take extra care to follow procedures for security. The person taking the information accepts full responsibility for the security of the data.

11.10 Before sharing data all practitioners will ensure: (a) they are allowed to share it; (b) that adequate security is in place to protect it.

12. Data Breaches

12.1 A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. This includes breaches that are the result of either accidental or deliberate causes. The Shea-Lowe Education Directors will determine if the breach must be reported to the Information Commissioner’s Office (ICO). This must be judged on a case-by-case basis. To decide, the Shea-Lowe Education Directors will consider whether the breach is likely to negatively affect people’s rights and freedoms, and cause them any physical, material or non-material damage (e.g. emotional distress), including through:

loss of control over their data;
discrimination;
identify theft or fraud;
financial loss;
damage to reputation;
loss of confidentiality; or
any other significant economic or social disadvantage to the individual(s) concerned.

12.2 If a breach is likely to pose a ” high risk” to individuals’ rights and freedoms, the ICO must be notified. The Shea-Lowe Education Directors will report this via the ICO website’s “report a breach” page within 72 hours of becoming aware of the breach. As required, the Shea-Lowe Education Directors will set out:

a description of the nature of the personal data breach, including, where possible;
the categories and approximate number of individuals concerned;
the categories and approximate number of personal data records concerned;
the name and contact details of the Shea-Lowe Education Directors;
description of the likely consequences of the personal data breach; and
a description of the measures that have been, or will be taken, to deal with the breach and mitigate any possible adverse effects on the individual(s) concerned.

If all the above details are not yet known, the Shea-Lowe Education Directors will report as much as they can within 72 hours. The report will explain that there is a delay, the reasons why, and when the Shea-Lowe Education Directors expect to have further information. The Shea-Lowe Education Directors will submit the remaining information as soon as possible.

In the event that a breach is likely to result in a ‘high risk’ to the rights and freedoms of an individual, the Shea-Lowe Education Directors will notify the subject(s) of the data breach without undue delay, in writing.
Within a breach notification, the following information will be outlined:

the nature of the personal data breach, including the categories and approximate number of individuals and records concerned;
an explanation of the likely consequences of the personal data breach;
a description of the proposed measures to be taken to deal with the personal data breach;
where appropriate, a description of the measures taken to mitigate any possible adverse effects.

12.5 Following a breach, a meeting will be convened by the Shea-Lowe Education Directors to review the breach, the process to be followed and the agreement of the measures to mitigate future breaches. The Shea-Lowe Education Directors will document each breach, irrespective of whether it is reported to the ICO. For each breach, this record will include the:

facts and cause;
effects;
action taken to contain it and ensure it does not happen again (such as establishing more robust processes or providing further training for individuals).
- The Shea-Lowe Education Directors will document the decision in case of future challenges by the ICO or an affected individual and will keep a register of all data breaches and reports to the individual involved and the ICO.
- The Shea-Lowe Education Directors will ensure that all practitioners are aware of and understand what constitutes a data breach and the action they should take in the event that they become aware of a breach.

13. Photography

13.1 Shea-Lowe Education will only use client images in publications, such as on its website, social media platforms, or newsletters, if the clients, or their parents or carers, have provided consent on the permission form.

14. Data Retention & Disposal

14.1 We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. After this period, data is securely deleted or anonymised.

14.2 Paper documents will be disposed of securely and electronic data deleted, once the data should no longer be retained. This will be no longer than 10 years.

15. Our Online GDPR and Privacy

15.1 Security: We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online

Cookies: A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie does not give access to your computer or any information about you, other than the data you choose to share with us. Our website will give you the opportunity to act before cookies are set on the first visit to our site. There will be a notice warning that cookies are used and that you can block them; however, if you continue to browse, this will be deemed valid consent via affirmative action.” If you change your mind, you can reverse the process when you browse our website. If you wish to restrict or block web browser cookies which are set on your device, then you can do this through your browser settings; the Help function within your browser should tell you how. Alternatively, you may wish to visit www.aboutcookies.org, which contains comprehensive information on how to do this on a wide variety of desktop browsers.

Cookies on the SHEA-LOWE EDUCATION site:

Session cookies – We use a session cookie to remember your login for you when logging into our Client Area. You can learn more about session cookies and what they are used for at http://www.allaboutcookies.org/cookies/session-cookies-used-for.html

Google Analytics – we use this to understand how the SHEA-LOWE EDUCATION site is being used in order to improve the user experience. Your user data is all anonymous. You can find out more about Google’s position on privacy as regards its analytics service at http://www.google.co.uk/intl/en/analytics/privacyoverview.html

Google AdWords: Using Google AdWords code, we are able to see which pages helped lead to contact form submissions. This allows us to make better use of our paid search budget.

Facebook Advertising: We use Facebook advertising conversion tracking and re-targeting pixels, which allow us to collect or receive information from your website and elsewhere on the internet and use that information to provide measurement services and target advertising.

DoubleClick: We use remarketing codes to log when users view specific pages, allowing us to provide targeted advertising in the future.

Other information we may collect:

Social buttons. On many of the pages of the SHEA-LOWE EDUCATION site, you will see ‘social buttons’. These enable users to share or bookmark the web pages. There are buttons for: Twitter, Google +1, Facebook ‘Like’, and LinkedIn ‘Share’. In order to implement these buttons and connect them to the relevant social networks and external sites, there are scripts from domains outside of SHEA-LOWE EDUCATION. You should be aware that these sites are likely to be collecting information about what you are doing all around the internet, including on the SHEA-LOWE EDUCATION site. So if you click on any of these buttons, these sites will be registering that action and may use that information. In some cases, these sites will be registering the fact that you are visiting SHEA-LOWE EDUCATION, and the specific pages you are on, even if you don’t click on the button, if you are logged into their services, like Google and Facebook. You should check the respective policies of each of these sites to see how exactly they use your information and to find out how to opt out or delete such information.

External web services. We use a number of external web services on the SHEA-LOWE EDUCATION, mostly to display content within our web pages. For example, to display slideshows, we sometimes use SlideShare; to show videos, we use YouTube and Vimeo. This is not an exhaustive or complete list of the services we use, or might use in the future, when embedding content, but these are the most common. As with the social buttons, we cannot prevent these sites, or external domains, from collecting information on your usage of this embedded content. If you are not logged in to these external services, then they will not know who you are, but are likely to gather anonymous usage information e.g. number of views, plays, loads, etc.

Email tracking. Some emails that we send you have no tracking at all, for example, personal correspondence or emails with invoices attached. Other emails we send we put in tracking so that we can tell how much traffic those emails send to our site, and we can track, at an individual level, whether the user has opened and clicked on the email. We rarely use the latter information at a personal level; rather, we use it to understand open and click rates on our emails to try and improve them. Sometimes we do use the personal information e.g. to re-email people who didn’t click the first time. If you want to be sure that none of your email activity is tracked, then you should unsubscribe from the SHEA-LOWE EDUCATION newsletter.

15.5 Links to other websites:

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

15.6: Controlling your personal information:

You may choose to restrict the collection or use of your personal information in the following ways:

Whenever you are asked to fill in a form on the website, look for the box that you can click to indicate that you do not want the information to be used by anybody for direct marketing purposes
If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by writing to or emailing us at contactus@shealoweeducation.co.uk.
We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so. We may use your personal information to send you promotional information about third parties which we think you may find interesting, if you tell us that you wish this to happen.

You may request details of personal information which we hold about you under the Data Protection Act 1998. If you would like a copy of the information held on you, please email SHEA-LOWE EDUCATION at contactus@shealoweeducation.co.uk.

If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible at the above address. We will promptly correct any information found to be incorrect.

Disclaimer

The material on our site is given for general information only, and does not constitute professional advice. You should take specific advice before taking a course of action, as we do not accept directly or indirectly any responsibility for loss arising directly or indirectly from reliance on information on this site.

Given that the Internet uses an open system, we cannot warrant that the site and downloads reach you virus-free. You must, therefore, take all appropriate precautions for your own safety.

17. Changes to This Policy

15.1 We may update this GDPR Privacy Policy periodically to reflect changes in our data practices or legal obligations. Updates will be posted here, and significant changes will be communicated directly to you.

18. Contact Us

16.1 If you have any questions about this GDPR Privacy Policy or our data handling practices, please contact us at: Email: contactus@shealoweeducation.com Phone: 07754167335