Privacy Policy

Last updated: 27 September 2026

This policy explains how The GCSE Maths Mentor ("I", "me", "my") collects, uses, and protects personal data when you visit thegcsemathsmentor.com, book a session, or use my tutoring service. It applies to students, and to the parents or guardians who book and pay on a student's behalf.

1. Who I am

I'm Charlie, a sole trader operating The GCSE Maths Mentor, providing 1:1 online GCSE maths tutoring. For data protection purposes, I am the "data controller" for the personal data described in this policy.

2. What personal data I collect

• Contact details — name, email address, and (if given) phone number, for the student and/or their parent/guardian.
• Booking and scheduling information — collected via Calendly when you book the free intro call or a session.
• Academic information — exam board, tier, target grade, current level, and topics discussed, so sessions can be planned effectively.
• Session communication — messages exchanged by email about scheduling, progress, or session content.
• Payment information — session payments are processed by Calendly's payment integration. I do not store full card details myself; see Section 6.
• Technical data — if analytics are added to this website in future, anonymised or aggregated usage data (pages visited, general location by IP). This policy will be updated first if that changes.

3. How I collect it

Directly from you: through the booking/enquiry process, by email, and during intro calls and sessions. I do not buy or receive personal data about you from third parties.

4. Why I process it, and my lawful basis

5. Who I share it with

I use a small number of third-party services ("processors") to run this business. They only receive the data needed to provide their service, and are not permitted to use it for their own purposes:

• Calendly — booking, scheduling, and payment processing.
• Zoom — delivering video sessions.
• PrivateEmail — email communication.

I do not sell personal data, and I do not share it with anyone else except where required by law (for example, a safeguarding referral — see the Safeguarding Policy — or a lawful request from a public authority).

6. International data transfers

Some of the services above (such as Zoom and Calendly) may store or process data outside the UK, including in the United States. Where this happens, those providers are required to maintain appropriate safeguards, such as the UK's International Data Transfer Addendum or an adequacy decision. You can ask me for details of the safeguards in place for a specific provider.

7. How long I keep data

8. Children's privacy

Because this service is aimed at GCSE-age students, much of the personal data I process relates to under-18s. Where a student is under 13, I ask that a parent or guardian makes the booking and is the primary point of contact. For students aged 13–17, I'm happy to correspond directly with the student about session content, but booking, payment, and any safeguarding-related contact go through a parent or guardian.

9. Your rights

Under UK GDPR, you have the right to:

• Ask what personal data I hold about you, and get a copy of it (a "subject access request").
• Ask me to correct inaccurate data.
• Ask me to delete your data, where there's no legal reason for me to keep it.
• Ask me to restrict or object to certain processing.
• Ask for your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these, email info@thegcsemathsmentor.com. I'll respond within one month. If you're not satisfied with how I've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

10. Cookies

This website does not currently use cookies or tracking analytics. If that changes — for example, to add privacy-friendly analytics — this policy and the site will be updated to reflect it, with a cookie notice if required.

11. Security

I take reasonable steps to keep personal data secure, including using reputable third-party providers (Calendly, Zoom) with their own security standards, and not storing more data than needed. No online service can be guaranteed 100% secure, but I aim to minimise risk at every stage.

12. Changes to this policy

I may update this policy from time to time, for example if I start using a new tool or service. The "last updated" date at the top will always reflect the latest version.

Safeguarding Policy

Last updated: 27 September 2026

1. Statement of commitment

The welfare of every student I work with is my first priority. This policy sets out how I aim to keep students safe while using The GCSE Maths Mentor, and what I do if I have a concern about a young person's welfare. It applies to every 1:1 session, intro call, and piece of communication connected to this service.

2. Scope

This service is aimed at GCSE-age students (broadly 14–16), though I may occasionally work with slightly younger or older students. This policy applies to all of them, and to any parent or guardian involved in a student's sessions.

3. My suitability to work with young people

As a sole practitioner, I don't have an employer to carry out separate reference or vetting checks. I've listed my own qualifications and DBS status on the website transparently so parents can make an informed decision, and I welcome any questions before booking.

4. How sessions are kept safe

• Video calls only, on Zoom — sessions take place over Zoom unless a parent/guardian and I mutually agree to a different arrangement.
• Sessions are not recorded — by me or, per the Zoom account settings I use, by default for either party.
• Contact goes through the parent or guardian's email — the primary point of contact for scheduling, payment, and any concerns is always the parent/guardian, even where I correspond directly with an older student about session content.
• No contact outside agreed channels — I do not contact students via personal social media, personal phone number, or any channel not agreed with a parent/guardian in advance.
• Parents are welcome to join — the free intro call, and any session, on request. I never discourage a parent or guardian from being present.
• Professional conduct — sessions stay focused on maths tutoring. I maintain a professional tone throughout, and I won't discuss topics unrelated to the student's learning and wellbeing in a way that isn't appropriate for the relationship.

5. Online safety

Before a first session, I check that both the student and I can use Zoom's whiteboard and audio comfortably. I ask students to use a private, appropriate space for sessions where possible, and I do the same. If anything happens on a call that makes a student uncomfortable, they (or their parent/guardian) should end the call and email me straight away.

6. Recognising and responding to a concern

If, during a session or in any communication, I become concerned about a student's welfare — for example, something they say, a change in their behaviour, or something a parent shares — I will:

1. Take what I'm told seriously, and not promise to keep it secret.
2. Make a written record of what was said or observed, as close to the exact words as possible, with the date and time.
3. Where the concern suggests a child is at risk of harm, contact the student's local authority children's services (find the right one at gov.uk/report-child-abuse-to-local-council), or the NSPCC helpline on 0808 800 5000, for advice or to make a referral.
4. In an emergency, or where a child is in immediate danger, call 999.
5. Keep the parent/guardian informed unless doing so would put the student at greater risk — for example, where the concern relates to the parent/guardian themselves.

As a sole practitioner I don't have an internal safeguarding lead to escalate to, so I treat the organisations above as my external point of escalation, and I'd rather raise a concern that turns out to be nothing than stay silent.

7. If a student needs to talk to someone directly

Students can also contact Childline confidentially, any time, on 0800 1111 or at childline.org.uk.

8. Confidentiality and record-keeping

Safeguarding-related notes are kept separately from general session notes, are only ever shared with the people and organisations named in Section 6, and are kept for as long as reasonably necessary to protect the student — which may be longer than ordinary tutoring records.

9. Complaints

If a parent, guardian, or student has a concern about how a session was conducted, or about this policy itself, please email info@thegcsemathsmentor.com. I'll respond within 5 working days.

10. Review

This policy is reviewed at least once a year, or sooner if something happens that suggests it should change. Next review due: September 2027.

Data Protection & GDPR Policy

Last updated: 27 September 2026

While the Privacy Policy explains what this means for you as a visitor, student, or parent, this document sets out how I run this business's data protection practices day to day, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data protection principles

I aim to handle personal data in line with the six core principles of UK GDPR:

• Lawfulness, fairness and transparency — data is only used as described in the Privacy Policy.
• Purpose limitation — data collected for tutoring isn't reused for an unrelated purpose without telling you.
• Data minimisation — I only ask for what's actually needed to deliver sessions.
• Accuracy — I correct inaccurate data when told about it.
• Storage limitation — data isn't kept longer than the retention periods in Section 7 of the Privacy Policy.
• Integrity and confidentiality — data is protected using the measures in Section 5 below.

2. My role and registration

I act as the data controller for personal data processed through this business, and I am registered with the ICO (registration reference: C2044186) and pay the applicable annual data protection fee — see ico.org.uk/for-organisations/data-protection-fee.

3. Categories of data and lawful basis

See Section 4 of the Privacy Policy for the full breakdown of what's collected and why. In summary, the great majority of processing relies on performance of a contract (delivering the tutoring you've booked) or legitimate interests (running the business sensibly), with a legal obligation basis for tax records.

4. Processors and due diligence

Before using a third-party tool that touches personal data, I check that it has its own privacy policy, UK/EU data protection commitments, and appropriate security measures. Current processors:

5. Security measures

• Strong, unique passwords and two-factor authentication on all accounts holding personal data (email, Calendly, Zoom).
• Access to student data limited to me alone — this is a sole-practitioner business with no other staff.
• Devices used to access personal data are password/PIN-protected and kept up to date.
• Safeguarding records stored separately from general business records (see Safeguarding Policy, Section 8).

6. Handling data subject requests

Requests to access, correct, delete, or restrict personal data (see Section 9 of the Privacy Policy) are handled as follows:

1. Acknowledge the request within 5 working days.
2. Verify the identity of the requester where needed, particularly where a request relates to a child's data.
3. Respond in full within one calendar month of the request, or explain the delay if more time is genuinely needed (up to a further two months for complex requests).
4. Provide the response free of charge, unless the request is manifestly unfounded or excessive.

7. Data breach procedure

If I become aware of a personal data breach (for example, an account compromise, or data sent to the wrong person), I will:

1. Contain it as quickly as possible — for example, revoking access or resetting credentials.
2. Assess the risk to the people affected.
3. Where the breach is likely to result in a risk to people's rights and freedoms, report it to the ICO within 72 hours of becoming aware of it, via ico.org.uk/for-organisations/report-a-breach.
4. Where the breach is likely to result in a high risk to affected individuals, tell them directly and without undue delay.
5. Keep a record of every breach, its effects, and the action taken, regardless of whether it met the threshold for reporting to the ICO.

8. Data Protection Impact Assessments

Given the small scale and nature of this business, routine processing (booking and delivering tutoring) is unlikely to require a formal Data Protection Impact Assessment (DPIA). If I introduce something higher-risk in future — for example, systematic monitoring or large-scale data collection — I'll assess whether a DPIA is needed at that point.

9. Review

This policy is reviewed annually, and whenever a new tool, service, or way of working is introduced that changes how personal data is handled. Next review due: September 2027.