Privacy Policy

01 Who we are

Highmark Academics provides online GCSE and A-Level Maths and Science tuition to students across the UK. Highmark Academics is the data controller responsible for the personal data described in this notice — that means we decide what data is collected and why, and we're responsible for looking after it properly.

Highmark Academics is operated by [owner's full name to be added] as a sole trader, trading as "Highmark Academics". As a sole trader there's no separate company number — the individual named above is personally the data controller responsible for the personal data described in this notice. Business address: [PLACEHOLDER — add your business or contact address].

02 The information we collect

Information you give us directly

• When you submit an enquiry through our booking form, we collect the parent's or student's name, email address, and (optionally) phone number, along with the level, subject(s), exam board, preferred tuition format, and any notes you choose to add.
• If you contact us by email, phone, or WhatsApp, we keep a record of that correspondence so we can pick up where we left off.
• If you go on to book lessons, we collect further information needed to arrange and deliver tuition — for example, your child's year group, current attainment, target grade, and any special educational needs or access requirements you tell us about.

Information generated during tuition

• Session records, including attendance, topics covered, and tutor feedback, which we use to prepare the written progress reports described on our website.
• Messages exchanged through our official communication channels in connection with a student's tuition.

Information we don't collect

Our website does not use tracking or advertising cookies, and we don't run analytics on it at present. If that changes — for example, if we later add analytics to understand how the site is used — we'll update this notice and ask for consent through a cookie banner where the law requires it.

03 Why we use it & our legal basis

UK GDPR requires us to have a valid legal basis for every way we use personal data. Here's how that applies to what we do:

04 Children's personal data

Most of our students are under 18. Where a student is under 18, personal data is normally given to us by a parent or legal guardian, who provides the consents described in this notice on the student's behalf. We take particular care with children's data:

• Access to student records is limited to the tutor(s) working with that student and the staff who need it to run the business or handle a safeguarding concern.
• We never use a child's personal data for marketing.
• The same safeguards described in this notice apply to children's data, together with the additional protections in our Safeguarding Policy.

If you're a parent or guardian and believe we hold inaccurate information about your child, or want to exercise any of the rights in section 8 on their behalf, please get in touch — see section 10.

05 How we share information

We do not sell, rent, or share your personal data with third-party companies for their own marketing, research, or commercial purposes. Personal data collected by Highmark Academics is used only within Highmark Academics, by the people who need it to respond to your enquiry, deliver tuition, or meet a legal or safeguarding obligation.

The only circumstances in which data passes outside Highmark Academics are:

• Service providers acting on our instructions. Like most online businesses, we rely on a small number of trusted providers to help us operate — for example, an email service to send messages, a video-calling platform to host online lessons, and, if you pay online, a payment processor to handle the transaction securely. These providers only process data on our instructions, only to the extent needed to provide their service to us, and are never permitted to use your data for their own purposes. [List your specific providers here once confirmed — e.g. your email host, video-calling platform, and payment processor, if used.]
• Legal and safeguarding obligations. We may share information with the police, children's social care, or another statutory authority where we believe this is necessary to protect a child, or where we're legally required to.
• Business transfers. If Highmark Academics were ever to merge with or be acquired by another organisation, personal data may transfer as part of that process, subject to the same protections described in this notice.

We do not transfer personal data outside the UK. [Update this if any provider you use stores or processes data outside the UK, and confirm the safeguard relied on.]

06 How long we keep it

We keep personal data only for as long as necessary for the purpose it was collected. As a general guide:

• Enquiries that don't proceed to booked lessons are kept for up to 12 months from your last contact with us, after which they're deleted or anonymised.
• Records relating to students who have received tuition are kept for the duration of that relationship and for up to 6 years afterwards, to meet our contractual, accounting, and insurance obligations.
• Safeguarding records are kept securely and separately from general records, and may be retained for longer where appropriate to protect a child's welfare, in line with recognised safeguarding record-keeping practice.
• Where you've asked to receive marketing updates, we keep your details until you unsubscribe or ask us to stop.

07 How we protect it

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse — including restricting access to those who need it, using reputable and secure providers for email and data storage, and reviewing our practices as the business grows. No method of online transmission or storage is completely secure, but we work to protect your information to a high standard.

08 Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you or your child;
• Ask us to correct inaccurate or incomplete data;
• Ask us to delete data we no longer have a valid reason to keep;
• Ask us to restrict how we use your data in certain circumstances;
• Object to processing based on legitimate interests, including direct marketing;
• Request a copy of your data in a portable format, where technically feasible;
• Withdraw consent at any time, where we rely on consent (for example, marketing emails).

To exercise any of these rights, contact us using the details in section 10 — we'll respond within one month, as required by law. If you're unhappy with how we've handled your personal data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113.

09 Changes to this notice

We may update this notice from time to time — for example, if we start using a new service provider or change how the site works. We'll update the date at the top of this page whenever we do, and we'd encourage you to check back periodically.