Article 5 of the GDPR requires that personal data shall be:

• processed lawfully, fairly and in a transparent manner in relation to individuals;
• collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
• adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and
• processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.” Article 5(2) requires that: “the controller shall be responsible for, and be able to demonstrate, compliance with the principles.”

In line with the GDPR we:

• have undertaken a systematic review of all the data we have on record and addressed how we will continue to process data in accordance with this
• will review our policy and data usage annually and update it to reflect any changes in law
• endeavor to keep our data as correct and up to date as possible
• ensure that any of our employees are aware of our responsibility to comply with the GDPR
• store our data securely

Please see below for more details of what data we store, why we store it, how long it is kept for, and your rights as to this data.

• We are a small company and we store only a small amount of data, limited essentially to particulars of our clients and tutors. This enables us to supply tutors to clients. 
• Parents (and sometimes students) provide us with contact details and a brief about what it is they require. We use this to select the best tutor(s) for the job. We then pass on this information to the tutors to brief them as to what is required. They then get in touch with that family to take things forward.
• We also use the information to enable us to facilitate the day-to-day running of the company: we need to contact parents, students and tutors, brief tutors, monitor progress, invoice clients, pay tutors, collect commissions, arrange timetables and so on. 
• We are absolutely committed to protecting the personal data we hold on our tutors and our clients. We believe privacy should be respected and we only use the data we have in a professional context. 
• We are registered with the ICO under the Data Protection Register, our registration number is: ZA438207.
• The lawful basis, as per article 6 of the GDPR, under which we process data is to fulfil our contract with our clients and tutors (section b). 
• We have to provide tutors with details of students and vice versa; that is why tutors and clients provide us with the information in the first place. This is in essence the core of our job. Other than that we do not pass any data on to 3^rd parties. In addition, we do not have contracts with any third parties to process data for us unless required by law
• We will keep the information that our clients give to us until we are told to delete it. We will make clients aware of this when they provide us with the data in the first place. The reasons for this retention include: Clients return often after many years and it is good to know what we provided for them last time; students may come to us for references many years after leaving us (even after they have finished school); younger family members often come to us once their older siblings have long moved on and it is good for continuity to have family details to hand. 
• In the case of tutors, we will keep the information we are provided with until we are told by the tutor to delete it, as we often contact tutors regarding a tutoring opportunity if we think they might be interested, even if they have not worked for us recently. If a tutor has done work for us which we are not happy with then we will simply delete that tutor from our database. 
• We aim to save all email correspondence for a period of at least 5 years for professional purposes.
• We do not believe in sending out unnecessary emails, but will occasionally let clients and tutors know about courses that may well be of interest to them. In each case we will offer you the chance of being taken off the mailing list.

We will be more than happy to discuss any of this with you so please feel free to contact us if you have any issues. You do of course have a right to complain to the ICO if you think there is a problem with the way we are handling your data. If you wish to know what data we hold about you, we will comply with your request and provide you with a report. For your reference, the rights people have to their data are: the right to be informed; the right of access; the right to rectification; the right to erasure; the right to restrict processing; the right to data portability; the right to object; and the right not to be subject to automated decision-making including profiling.