Privacy & Data Protection Notice

1. About this notice

This privacy notice explains how Fraley Tutors collects, uses, shares, and protects your personal data, and the rights you have over it. It applies to everyone who interacts with us: parents and students (including students who are under 18), people who apply to tutor for us (candidates), our tutors, and anyone who contacts us through our website or one of our free tools.

We are committed to handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We use the terminology of the Information Commissioner's Office (ICO) throughout.

This notice is written in plain English. Where a particular point applies only to one group (for example, only to job candidates, or only to under-18 students), we say so.

Version and effective date. This is version 1.0, last updated 29 August 2026, effective from the date it is first published on this page. When we change this notice, we will post the updated version here and update the date at the top of the page; for material changes we will also email active customers and tutors.

2. Who we are (the data controller)

Fraley Tutors is the data controller for the personal data described in this notice. This means we decide why and how your personal data is processed.

• Registered company name: Fraley Tutors Ltd
• Company registration number: 13649877 (registered in England and Wales)
• Registered office address: 128 City Road, London, England, EC1V 2NX

As a controller processing personal data — including children's data — we are registered with the Information Commissioner's Office (ICO) and pay the annual data protection fee. Our ICO registration (data protection fee) reference is ZC194079.

How to contact us about your data

You can contact us about your personal data — including to exercise any of the rights in Section 10 — at:

• Email: alex@fraleytutors.com
• Post: our registered office address above

We have not appointed a statutory Data Protection Officer; instead, a named person is responsible for data protection compliance and is the point of contact for the enquiries above. That person is Alexander Fraley.

3. The personal data we collect

We only collect the personal data we need to provide tutoring, run our business, and recruit and pay our tutors. The data we hold depends on your relationship with us.

3.1 Parents / billing contacts

• Name and contact details (email, phone).
• Billing name and billing email.
• Records of enquiries, lessons booked, and correspondence with us.
• Billing and payment records (invoices, payment terms, payment status). We do not store full card or bank-account numbers ourselves — payments are handled through our accounting and invoicing provider (see Section 7).

3.2 Students (including under-18s)

• Name and the email address used to access the platform.
• School year group and the exam(s) being prepared for (for example GCSE, A-level, IB, or a university entrance exam such as STEP, TMUA or ESAT).
• Subjects studied and the lessons attended.
• Academic records generated through tutoring: homework submissions (including photographs of handwritten work), homework marks and feedback, lesson notes and ratings, recorded performance on practice questions, and questions you post in the platform's Q&A area.
• Where lessons are recorded, the lesson recording (see Section 6).

A significant proportion of our students are under 18. How we handle children's data, and the role of parental consent, is set out in Section 8.

3.3 Tutors

• Name and contact details.
• Recruitment records (see Section 3.4) where you joined us as a candidate.
• Right-to-work documentation (for example passport or a gov.uk share code).
• Payroll and payment data: pay records, tax and National Insurance information, pension assessment data, bank details for payment, and payslips.
• Date of birth (needed for payroll and pension auto-enrolment assessment).
• Profile information used to run your account and, where you agree, to display you on our website (biography, qualifications, photograph, university).
• Records relating to your engagement, lessons taught, and quality reviews.

Tutor bank details are held only within our accounting and payroll provider (FreeAgent) and are not duplicated in the platform database.

3.4 Candidates (people applying to tutor for us)

• The information you submit through our careers page: name, email, phone, university, course, year of study, graduation year, subjects you can teach, availability, experience, a cover note, and confirmation of your right to work in the UK.
• Your CV, which you upload to us.
• Notes, scores, and outcomes generated during our recruitment process (including interview notes and scoring), and the status of your application.

Automated assessment of your application. When you apply, your CV and application receive an initial automated assessment to help us shortlist. This is a first-pass aid only — a person reviews your application and a person makes every recruitment decision. You can ask us to explain the outcome and to have the automated assessment reviewed by a person; see Section 5 and Section 10.

What happens to your data if you are not successful. If we do not take your application forward, we keep your recruitment data only for the limited period set out in our Data-Retention policy (see Section 9), after which it is deleted, unless you ask us to keep it on file for future opportunities. We retain it for that limited period on the basis of our legitimate interests (for example, to handle queries about the process, to demonstrate fair and non-discriminatory recruitment, and to consider you for suitable future roles).

3.5 Website leads and free-tool users

• Contact / enquiry forms on our website: name, email, phone, the student's name and year group, the subjects of interest, your preferred date, and any message you send us.
• Exam-readiness check (free, exam-style diagnostic tool): if you complete our free, exam-style readiness check and choose to share your results with us, we collect the email address you provide, your consent to be contacted, and the results of the check. You can use the readiness check itself without giving us your details; we only collect contact information at the point you ask us to send or save your results.

3.6 Information collected automatically (website analytics and cookies)

When you use our website, we collect limited technical information through analytics and cookies — see Section 11.

4. Where we get your data from

Most of the personal data we hold comes directly from you — when you enquire, register, attend lessons, submit homework, apply to tutor, or complete our readiness check.

We also receive some data from others:

• From a parent about a student, or from a student about a parent/billing contact, when an account is set up.
• From a tutor about a student, in the form of lesson notes, marks, and feedback created during tutoring.
• From our Talent Partner (an external recruitment contractor), where we use one. The Talent Partner sources and screens candidates and passes candidate records to us. See Section 7 for how this relationship is governed.

5. Why we use your data, and our lawful bases

Under UK GDPR we must have a lawful basis for each use of your personal data. Our main uses and bases are set out below.

Automated processing and your right to a human decision. We do not make solely automated decisions that produce legal or similarly significant effects about you. Some parts of our service produce automated outputs — for example, homework is instantly marked on the platform, and recruitment applications are given an initial automated assessment — but a person remains responsible for the decisions that matter: a tutor reviews marking, and a person decides every recruitment outcome. Where an automated assessment forms part of how we shortlist candidates, you can ask us to explain the result, express your point of view, and have the assessment reviewed by a person before any decision is treated as final.

6. Lesson recordings

Some lessons may be recorded so that students can review them and so that we can support quality and training. Lessons are delivered on Google Meet. Where a lesson is recorded, we tell you in advance and you can ask us not to record.

Access to a recording is restricted to the student, their parent/guardian, the tutor, and authorised administrators, and recordings are stored securely on our business Google infrastructure. We keep recordings for the period set out in our Data-Retention policy, which is the single source of truth for retention. Our lawful basis for recording is our legitimate interests in supporting learning, quality and training, balanced against your interests, and we will always tell you in advance and give you a clear way to decline.

7. Who we share your data with (processors and sub-processors)

We do not sell your personal data. We share it only with service providers who help us run the business ("processors"), and with others where the law allows or requires it.

We use the following categories of provider:

• Cloud platform and infrastructure — Google (Google Workspace, Firebase, Google Cloud, Google Drive, and Google Meet for lessons). These services host our platform, store documents and lesson materials, run our email, and host video lessons.
• Instant homework marking and other automated text features — Google's Vertex AI service processes the content of homework and certain other text so that homework is instantly marked on the platform, and to produce suggested solutions and draft messages for our team. This processing is carried out under Google's terms as a processor acting on our instructions.
• Accounting, invoicing, and payroll — FreeAgent, which we use to invoice parents, run payroll, and keep accounting records. FreeAgent sends our invoices and billing emails to parents directly.
• Workplace pension provider — NEST, with whom we share the data needed to assess and (where applicable) enrol tutors into a workplace pension and to administer contributions.
• Email delivery — we do not use a third-party email-delivery service. Service and notification emails (for example lesson confirmations, homework feedback, and account messages) are sent from our own Google Workspace account using Google's Gmail service, so Google is the processor for that email. Invoices and billing emails are sent to you by FreeAgent, as described above.
• Recruitment (Talent Partner) — where we use one, an external recruitment contractor who sources and screens tutor candidates on our behalf and handles candidate personal data for that purpose.

Statutory and other required disclosures

Running tutoring and paying tutors creates obligations to disclose certain data to public bodies. We may share personal data:

• with HM Revenue & Customs (HMRC) — payroll, tax, and National Insurance reporting for our tutors, and accounting records;
• with The Pensions Regulator and our pension scheme provider — to meet our automatic-enrolment duties;
• where we are otherwise legally required to (for example, in response to a lawful request or court order); and
• where necessary to protect the safety of a child or another person.

International transfers

Some of our providers process personal data outside the UK. Google — which provides our cloud platform, our email, and the instant-marking service described above — operates global infrastructure, and the service behind instant marking is configured to a global endpoint, so processing may take place outside the UK. FreeAgent is based in the UK.

Where personal data is transferred outside the UK, we rely on the transfer mechanisms permitted by UK data protection law — the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, or UK adequacy regulations where they apply to the destination country — under our providers' data-processing terms.

If you would like more detail about the safeguards that apply to a particular transfer, please contact us using the details in Section 2.

8. Children's data and parental consent

We provide tutoring to many students who are under 18, and protecting their personal data is a priority. We follow the ICO's guidance, including the principles of the Children's Code (Age Appropriate Design Code).

• A parent or guardian sets up the arrangement. For under-18 students, the tutoring contract is with the parent or guardian, who provides the student's details and agrees to this notice on the student's behalf where appropriate.
• We collect the minimum we need to tutor the student and track their progress, and we do not use children's data for purposes a parent would not reasonably expect.
• We do not use a student's personal data for marketing to that student, and we do not profile children beyond what is needed to support their learning.
• Parents can exercise the student's data rights (Section 10) on the student's behalf, and a student of sufficient age and understanding may also exercise their own rights.

How we obtain parental agreement. For an under-18 student, we capture and timestamp the parent or guardian's agreement to this notice at the point of registration, and we treat the parent or guardian as the person who exercises the student's data rights, applying case-by-case judgement for older, competent students.

Data Protection Impact Assessment (DPIA). Because we process children's personal data and use instant homework marking and recruitment scoring, we treat a DPIA as a priority compliance step and are completing a single DPIA covering all three processing areas.

9. How long we keep your data (retention)

We keep personal data only for as long as we need it for the purposes set out in this notice, or for as long as the law requires (for example, tax and payroll records must be kept for a statutory minimum period).

Our retention periods for each category of data — students, parents, tutors, candidates, leads, lesson recordings, and accounting records — are set out in our Data-Retention policy, which is the single source of truth for retention periods. Statutory minimums (for example, the HMRC minimum for payroll and tax records, retention of right-to-work documentation, and any employment/worker records required by the Employment Rights Act 1996) are confirmed and recorded in that policy rather than here.

10. Your rights

Under UK GDPR you have rights over your personal data. Subject to certain conditions and exemptions, you can:

• Be informed about how we use your data (this notice).
• Access the personal data we hold about you (a "subject access request").
• Rectify data that is inaccurate or incomplete.
• Erase your data ("right to be forgotten") in certain circumstances.
• Restrict how we use your data in certain circumstances.
• Object to certain processing, including processing based on our legitimate interests and any direct marketing.
• Data portability — receive certain data in a portable format.
• Withdraw consent at any time, where we rely on your consent (for example, for the free-tool results, for marketing, or for the optional cookies described in Section 11). Withdrawing consent does not affect processing carried out before you withdrew it.
• Rights relating to automated decision-making — including, where applicable, the right to obtain human intervention, to express your point of view, and to contest a decision (see Section 5).

For an under-18 student, a parent or guardian can usually exercise these rights on the student's behalf (see Section 8).

How to exercise your rights. Contact us using the details in Section 2. We will respond within one calendar month, which may be extended by up to two further months for complex or numerous requests (we will tell you if that applies). We will not charge a fee in most cases.

11. Cookies and analytics

Our website uses cookies and similar technologies. We use:

• Strictly necessary cookies and storage — needed for the site to work and to protect our public forms from automated abuse. These do not require your consent.
• Measurement cookies — including Google Analytics (GA4), which help us understand how the site is used so we can improve it. These are non-essential and are only set with your consent.
• Advertising cookies — which let us see which of our adverts brought someone to the site. These are also non-essential and are only set with your consent.

Under the Privacy and Electronic Communications Regulations (PECR), non-essential cookies (including analytics) require your consent before they are set. Our cookie banner blocks all non-essential cookies — including Google Analytics — until you opt in: the analytics script itself is not loaded until you consent. You can accept or reject them when you first visit the site, and you can change your choice at any time through Cookie settings in the footer of every page. Measurement and advertising are separate choices; you can accept one without the other. If you withdraw consent, any cookies already set for that purpose are deleted.

A full list of the cookies and similar storage we use, and what each one does, is in our cookie notice.

12. How we keep your data secure

We take appropriate technical and organisational measures to protect personal data, including access controls so that staff and tutors only see the data they need, hosting on reputable cloud infrastructure (Google Cloud / Firebase), and restricting the most sensitive records (such as payroll and recruitment data) to authorised administrators only.

No system can be guaranteed completely secure, but we work to protect your data and to detect and respond to any incident.

Personal data breaches. If a personal data breach occurs, we will assess it without delay. Where it is likely to result in a risk to people's rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to affected individuals, we will also inform those individuals without undue delay.

13. Complaints and the ICO

If you have a concern about how we handle your personal data, please contact us first using the details in Section 2, so that we can try to put things right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk
• Helpline: 0303 123 1113

14. Changes to this notice

We may update this notice from time to time. When we do, we will update the version number and date at the top of the page and post the updated notice here; for material changes we will also email active customers and tutors.