GradeLift Privacy Policy 

Free 30-minute diagnostic for every new student
GradeLift

Privacy Policy

GradeLift Ltd · Effective: 11 September 2025 · v1.0 · Data Protection contact: dpo@gradelift.co.uk

Data controller

GradeLift Ltd

Company no. 16678268
2a Oaklands Avenue, Thornton Heath, CR7 7PH

ICO registration

C1770309

UK GDPR & Data Protection Act 2018

Data Protection contact

Anees Grant-Salih, Director

dpo@gradelift.co.uk
1

Scope — who this covers
  • Students (primarily under 18), parents/carers, and enquirers
  • Tutors/contractors
  • Website visitors
2

What data we collect

Students & parents: student first name, year group, exam board; parent name, email, phone; lesson bookings, attendance, notes, homework links, progress summaries; payments (via Stripe — we do not see card numbers); optional SEN/access needs (special category data, explicit consent required).

Tutors: identity, right-to-work, DBS certificate, references, qualifications, availability, pay details, training records.

Website: technical/usage data (cookies/analytics), enquiry form data, marketing preferences.

3

How we use data & legal bases
  • Provide tutoring (scheduling, lessons, notes, homework, reports) — Contract
  • Safeguarding & QA (incident logs, recordings where consented) — Legitimate interests; Consent for recordings
  • Payments & accounts (invoices, refunds, accounting) — Legal obligation; Contract
  • Communications (service emails/WhatsApp Business via Parent-in-Thread) — Legitimate interests
  • Marketing (updates and offers, parents only) — Consent (opt-in)
  • Tutor vetting (DBS, references, right-to-work) — Legal obligation / Legitimate interests
  • SEN/health info (reasonable adjustments only, restricted access) — Explicit consent

    • Children’s data: collected via the parent/carer. For under-18s we require parent involvement throughout.

    4

    How long we keep data
  • Enquiries (no purchase): 12 months from last contact
  • Customer account (parent details): 7 years after last transaction (HMRC)
  • Lesson notes & progress reports: 3 years after last lesson
  • Safeguarding records: minimum 7 years
  • Invoices & payment logs: 7 years (tax)
  • Lesson recordings (if used): 90 days; longer only if required for an active investigation
  • Tutor HR/contract records: 6 years after engagement ends
  • Marketing consent logs: until withdrawn + 2 years audit trail
    • 5

    Lesson recordings
  • Default: lessons are not recorded.
  • When: safeguarding review, serious incident, limited QA/coaching — parental consent required for any routine recording.
  • Access: DSL/Deputy DSL, Ops lead (QA), senior management (complaints/legal). Never shared publicly or with other families.
  • Storage: company SharePoint; encrypted; access-controlled. Retention: 90 days (extended only while investigation is active).
    • 6

    Your rights
  • Access a copy of your data
  • Correct inaccurate data
  • Delete data (where we have no lawful need to keep it)
  • Restrict or object to certain processing
  • Portability (where technically feasible)
  • Withdraw consent at any time (e.g. marketing, recordings, SEN info)

    • Email dpo@gradelift.co.uk. We respond within one month.

    7

    Security
  • Role-based access; MFA on email and systems; encryption at rest.
  • No student data on personal devices outside approved, secured apps.
  • Staff and tutors trained on data protection and online safety.
  • Data breaches reported to ICO within 72 hours where required; individuals notified when at high risk.
    • 8

    Who we share data with
  • Lessons & collaboration: Microsoft Teams
  • Productivity & storage: Microsoft 365 (email, SharePoint, OneDrive)
  • Scheduling: Microsoft Bookings
  • CRM/records: Microsoft Lists
  • Email marketing: Brevo
  • Messaging: WhatsApp Business (family group threads only)
  • Payments: Stripe — we do not store card numbers

    • We do not sell personal data. We may disclose to police/children’s services in a safeguarding matter.

    9–10

    Cookies, marketing & SEN data
  • Cookies: necessary cookies for site function, and (with consent) analytics. Manage via our cookie banner.
  • Marketing: opt-in only; unsubscribe any time. Transactional/service messages are always sent.
  • SEN/health: only recorded to make reasonable adjustments; explicit parental consent required; restricted access; you can withdraw consent at any time.
    • 11

    Complaints & changes
  • Unhappy with how we handle data? Email dpo@gradelift.co.uk. You can also complain to the ICO (ico.org.uk · 0303 123 1113).
  • We may update this policy periodically. Significant changes will be communicated via email or the website.
    • Scroll to Top