Privacy & Cookie Policy

Last updated: January 2026

Up Your Grade Ltd. (“we”, “our”, “us”) is committed to protecting the privacy and security of personal data. This policy explains how we collect, use and safeguard information about parents, students, tutors and website visitors in line with the UK GDPR and the Data Protection Act 2018.

1. Who we are (Data Controller)

Up Your Grade Ltd. is the data controller for the personal data processed in connection with our tutoring services.

We decide what personal data is collected, why it is needed, and how it is processed.

2. What data we collect

We may collect the following categories of personal data:

  • Parent and student contact details (name, email, phone, address).
  • Student academic details (year group, subjects, goals).
  • Tutor application details (CV, qualifications, DBS results, references, uploaded files).
  • Payment details (processed securely via Stripe – we do not see or store full card numbers).
  • Website usage information (cookies, log files, analytics).

3. How we use personal data

We use personal data to:

  • Match families with suitable tutors.
  • Manage lesson bookings, reports and payments.
  • Recruit, vet and onboard tutors.
  • Communicate with parents, students and tutors.
  • Comply with safeguarding, legal and financial obligations.
  • We do not sell or share personal data for third-party marketing.
  • Promote our services to individuals who have previously enquired, including through online advertising and custom audiences.
  • Measure the effectiveness of our advertising and improve our website using analytics and advertising pixels.
  • Provide downloadable resources, guides, and email content where you have requested or opted in to receive them.

4. Our service providers (Processors and Sub-processors)

To deliver our services, we work with trusted providers:

  • TutorCruncher – lesson scheduling, reports and invoicing (processor).
  • TutorOnboarder – tutor onboarding; stores tutor data and uploaded files securely on AWS (processor). AWS acts as a sub-processor. Tutors may delete their in-app profile copy, but full erasure across all systems must be requested from us.
  • Stripe – secure payments. Stripe acts as our processor for card processing but also as an independent controller for its own fraud/AML obligations and account management.
  • Brevo – email marketing platform used to store contact details and send email communications (processor).

These providers process personal data only on our instructions (except where they act as independent controllers for their own legal compliance).

5. Legal basis for processing

We process personal data on the following lawful bases:

  • Contract – to deliver tutoring services and engage tutors.
  • Legal obligation – safeguarding, tax, accounting and financial regulations.
  • Legitimate interests – running and improving our business, ensuring quality of service, promoting our services to individuals who have previously expressed interest, in line with applicable marketing regulations, and measuring advertising effectiveness.
  • Consent – for direct marketing communications (if opted in).

6. Children’s data

We provide services to children via their parents/guardians. Where consent is our lawful basis for an online service, we only accept consent directly from the child if they are 18 or over. For under-18s, we obtain and verify parental responsibility before processing.

7. Criminal-offence (DBS) data

For safer recruitment we process DBS certificate details about tutors. Our lawful basis is legitimate interests/contract, and our condition under Schedule 1 of the Data Protection Act 2018 is safeguarding of children and individuals at risk.

8. Direct marketing compliance

We only send electronic direct marketing communications, such as emails or SMS messages sent directly to you, where:

  • You have provided explicit consent, or
  • You are an existing customer and we rely on the soft opt in in accordance with UK marketing regulations.

All direct marketing communications include a clear and easy opt out option. We do not buy, sell, or use third party marketing lists.

Direct marketing refers to messages sent directly to your inbox or phone. This includes individuals who have requested downloadable resources or opted in via our website.

9. Advertising, tracking and custom audiences

We also use online advertising platforms, including Meta Platforms and Google, to promote our services.

This advertising activity is different from direct marketing and may involve two types of processing.

Custom audiences

We may use limited personal data, such as email addresses collected during enquiries or previous interactions, to create custom advertising audiences on advertising platforms.

This data is encrypted and hashed before upload and is used solely to match individuals to existing user accounts so that relevant adverts can be shown or suppressed. The platforms do not use this data for their own independent purposes, do not share it with third parties, and delete it after the matching process in line with their GDPR compliant policies.

These adverts appear within the relevant platform and are not sent directly to you as emails or messages.

This may include individuals who have downloaded resources or submitted their details through our website forms.

Advertising pixels and conversion tracking

Our website uses advertising technologies, including the Meta pixel, to measure the effectiveness of advertising and understand how visitors interact with our website after viewing or clicking an advert.

This may involve the use of cookies or similar technologies that collect information such as pages visited, actions taken, IP address, device information, and browser data.

Where required by law, advertising cookies and tracking technologies are only activated with your consent. Consent can be managed or withdrawn through our cookie banner and browser settings.

We do not sell personal data or permit advertising platforms to use it beyond the purposes described above. This processing is carried out on the basis of legitimate interests and, where applicable, consent. You may object to this processing or withdraw consent at any time.

10. Data retention

  • Student/parent records – retained while lessons are active, plus up to 6 years for tax/legal purposes.
  • Tutor records – retained while engaged; DBS and safeguarding data retained in line with legal duties, typically up to 6 years after last engagement.
  • Website/analytics data – retained only as long as necessary (usually 12–24 months).
  • Enquiry and marketing data – retained until you unsubscribe or request deletion, or after a reasonable period of inactivity.

11. Your rights

You have the right to:

  • Access the data we hold about you.
  • Request correction of inaccurate information.
  • Request erasure (“the right to be forgotten”).
  • Restrict or object to processing.
  • Data portability (to another provider).
  • Withdraw consent at any time (where consent is the basis).

Requests should be emailed to admin@upyourgrade.co.uk. We may need to verify your identity. We aim to respond within one month.

12. Cookies, analytics and advertising technologies

Our website uses cookies and similar technologies for functionality, analytics, and advertising.

This includes

  • Analytics cookies, such as Google Analytics, to understand how visitors use our website.
  • Advertising and tracking cookies, including the Meta pixel, to measure advertising performance, understand user behaviour after viewing or clicking adverts, and support relevant advertising.

Advertising cookies are only set where you have given consent via our cookie banner. You can manage or withdraw consent at any time through the banner or your browser settings.

13. Data security and breaches

We apply appropriate technical and organisational measures to secure data, including encryption, access controls and secure servers. If a personal-data breach occurs, we assess impact and, where required, notify the ICO and affected individuals.

14. Sharing with third parties

We only share personal data where necessary to deliver our services or comply with the law. This includes:

  • Allocated tutors – we share parent and student contact details with the tutor(s) matched to you so lessons can be arranged and delivered. Tutors only receive the information necessary to carry out their role and are contractually required to handle it securely and confidentially.
  • Our processors and sub-processors – such as TutorCruncher (lesson scheduling, reporting, invoicing), TutorOnboarder (tutor onboarding), Stripe (payments), and their respective sub-processors (e.g. AWS). These providers act on our instructions, except where they are independent controllers for their own compliance (e.g. Stripe for fraud/AML).
  • Regulators or law enforcement – where we are legally required to disclose information.

We do not otherwise sell, trade, or share personal data with third parties for marketing purposes.

This may also include limited personal data processed via advertising platforms such as Meta and Google for the purposes of audience matching and conversion tracking, as described in Sections 8A and 11. These platforms process data in accordance with their own GDPR obligations.

15. DPO and updates

Andy Gardner is the designated Data Protection Officer. Contact details for privacy matters are in Section 1.
We may update this notice from time to time. The “Last updated” date reflects the latest version.

16. Lead magnets and email sign ups

When you download a guide, resource, or sign up via a form on our website, we collect your name and email address to:

  • Send you the requested resource
  • Provide follow up emails with relevant tips, updates, and offers
  • Improve our services and understand interest in our content

We only send marketing emails where you have provided consent. You can unsubscribe at any time using the link in our emails.

Your data is stored securely and processed using trusted providers, including our email platform (Brevo). We do not sell or share your personal data with third parties for marketing.

17. Complaints

If you have concerns, please contact us first at admin@upyourgrade.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO):
https://ico.org.uk/make-a-complaint/