Privacy Policy

Last updated: 29 August 2026  ·  Version: 2.0  ·  Applies to: atlas-learning.co.uk and all tutoring delivered by Atlas Learning Ltd

Who we are

Atlas Learning Ltd ("Atlas Learning", "we", "us") is the data controller for the personal data described in this policy. We are a tutoring agency: we match students with tutors and deliver tuition online and in person.

• Registered office: [to be added]
• Company number: [to be added]
• ICO registration number: [to be added]
• Data protection contact: hello@atlas-learning.co.uk

We have not appointed a statutory Data Protection Officer, as we are not required to. Data protection questions are handled directly by a founder.

Much of what we handle concerns children. We have written this policy to be specific rather than reassuring — you should finish it knowing exactly what sits in our records.

Whose data we handle

• Students — the children and adults who receive tuition
• Parents and guardians — usually the person who contacts us, agrees the arrangement and pays
• Adult learners — students aged 18 or over, acting for themselves
• Tutor applicants and tutors — people who apply to teach with us, and those we engage
• Website visitors — anyone who browses this site

What we store about students

This is the section most people want, so here it is in full. Not every field applies to every student; we hold what is relevant to teaching them well.

Where it lives. Enquiry, matching and tuition records are held in our own content management system, in a password-protected database on access-controlled UK infrastructure. Correspondence is held in our business email. Nothing is kept on a tutor's personal device beyond what they need for their own students.

Who can see it. A tutor sees only the students assigned to them. Founders and administrators can see all records. Nobody else has access.

What we deliberately do not store

Being clear about the boundaries matters as much as listing the contents.

• No payment card numbers. Payments are handled by a regulated payment provider; we see the fact of a payment, not the card.
• No recordings or screenshots of lessons, and no photographs of a student, unless we have asked for and received separate written consent. Consent can be withdrawn and the material deleted.
• No school, exam board or MIS logins, and no access to a student's school systems.
• No behavioural profiles, no advertising identifiers, and no data sold or shared for marketing. Ever, to anyone.
• No location tracking, beyond the town or postcode area needed to arrange in-person tuition.
• No data collected directly from a child through this website. Our forms are written for, and expected to be completed by, an adult.

What we store about adults

Parents, guardians and adult learners: name, email, phone, the content of your enquiry and correspondence, the tuition arrangement agreed, and billing and payment records (amounts, dates, invoice references).

Tutor applicants: forename, surname, email, phone, the subjects and stages you offer, your qualifications, and your written answer on tutoring approach — all taken from the Become a Tutor form. If we take an application forward we additionally hold interview notes, references, proof of qualifications and identity, and Enhanced DBS certificate details.

Our lawful bases

Where we rely on legitimate interests, we have balanced those interests against your rights and concluded the processing is what you would reasonably expect. You can object at any time — see Your rights.

Children and consent

We do not knowingly collect personal data directly from a child through this website. Enquiries are made by a parent, guardian or adult learner, and our Find a Tutor form asks the person completing it to confirm whether they are over 18.

• For a student under 18, the parent or guardian who arranges the tuition makes decisions about their data and can exercise rights on their behalf.
• A student aged 13 or over may exercise their own rights where they understand what they are asking for. We will handle such a request sensitively, and will normally involve the parent or guardian where doing so is in the child's interests.
• We keep the amount of information about a child to what is genuinely needed to teach them well. If a form invites more than we need, tell us less.
• Records about a child are used only to plan and deliver their tuition, and are shared only with the tutor teaching them.

Special category data

Information about health, a disability, a SEND diagnosis or an EHCP is special category data under UK GDPR and carries extra protection.

We do not require it. Some families choose to share it because it helps a tutor teach effectively — knowing that a student has dyslexia, ADHD, an anxiety condition or an exam access arrangement genuinely changes how a good lesson is planned.

• We process it on the basis of your explicit consent, given when you tell us.
• We record only what is useful for teaching — the practical implications, not a clinical history.
• It is visible only to the tutor teaching that student, and to a founder.
• You can withdraw consent at any time and we will delete it, unless a safeguarding or legal obligation requires otherwise.
• Withdrawing it will not stop us teaching your child. It may make us less useful.

Safeguarding records

If a safeguarding concern arises, we will record it and act on it. This is one of the few areas where your rights are limited by law.

• Concerns are recorded factually, with dates, and stored separately from ordinary tuition records with restricted access.
• Where there is a risk of harm we will share information with the appropriate authority — children's social care, the police, or a school's designated safeguarding lead — without seeking consent, and normally without telling the subject in advance, where doing so would increase risk or prejudice an investigation.
• Safeguarding records are retained in line with statutory guidance and are exempt from the right to erasure.

Our approach is set out on the Safeguarding page.

Who we share data with

We do not sell personal data, and we do not share it for anyone else's marketing. We share it only with:

• The tutor teaching the student — the information they need to teach well, and no more
• Our hosting and database provider, who stores the system this site and our records run on
• Our email provider, through which correspondence passes
• Our payment provider, who processes payments and holds the card details we never see
• Our accountant, for invoicing and statutory accounts
• Authorities, where the law requires it — including safeguarding disclosures and lawful requests from HMRC, the police or a regulator

Every provider acts as our processor under a written contract that permits them to process data only on our instructions, requires appropriate security, and forbids any other use.

How long we keep it

At the end of a retention period, records are securely deleted from live systems, and from backups on the next backup rotation.

Where your data is held

Our systems are hosted on infrastructure located in the United Kingdom. Where a provider processes data outside the UK — this can happen with email and payment services — the transfer is protected by UK adequacy regulations or by the International Data Transfer Agreement, as UK GDPR requires. We will tell you which safeguard applies if you ask.

How we protect it

• Access is by individual named account, with a strong password requirement — no shared logins
• Tutors see only their own students; administrative access is limited to founders
• Data is encrypted in transit, and stored on access-controlled, password-protected database infrastructure
• Every tutor is subject to an Enhanced DBS check and has agreed in writing to our confidentiality and safeguarding terms
• Backups are taken regularly and are subject to the same access controls
• We review who has access when a tutor joins or leaves, and remove access on the day an engagement ends

No system is perfect. If a breach occurs that is likely to pose a risk to anyone's rights, we will report it to the Information Commissioner's Office within 72 hours and tell the people affected without undue delay.

Your rights

Under UK GDPR you have the right to:

• Be informed — this policy, kept accurate and current
• Access the personal data we hold about you or your child, and receive a copy
• Rectify anything inaccurate or incomplete
• Erase it, where no legal or safeguarding obligation requires us to keep it
• Restrict processing while a dispute about accuracy or lawfulness is resolved
• Object to processing based on legitimate interests
• Portability — receive the data you gave us in a structured, machine-readable format
• Withdraw consent at any time, where consent is the basis we rely on

How to exercise them. Email hello@atlas-learning.co.uk. Tell us what you want and, if you are asking on behalf of a child, your relationship to them. We may ask for proof of identity — not to obstruct you, but because handing a child's records to the wrong person would be a far worse failure.

We respond within one calendar month, free of charge. If a request is unusually complex we may extend this by up to two further months, and will tell you why within the first month.

Automated decisions and profiling

We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not profile students. Tutor matching is a judgement made by a person who has read your enquiry.

Cookies and website analytics

Full detail is in our Cookie Policy. In summary:

• Essential cookies keep the site secure and remember your cookie choices. These do not need consent.
• Functional and analytics cookies run only if you consent, and you can change your mind at any time.
• Our page-view analytics is deliberately lightweight: it uses no cookies, stores a random identifier in your browser's session storage that is destroyed when you close the tab, and respects your browser's Do Not Track setting.
• Our web server additionally keeps a short log of pages requested, the referring page and the browser's user-agent string, for 90 days, to understand which pages help and which confuse. It records no IP address and no identifier that links a request to you.

Complaints

If you are unhappy with how we have handled your data, please tell us first — email hello@atlas-learning.co.uk and a founder will reply personally. We would rather put it right than have you take it elsewhere.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this policy

We will post any change here and update the version and date at the top. Where a change materially affects how we use data about you or your child, we will tell active families directly rather than relying on you to notice.