Tutora Tutor Privacy Notice
Last updated: 6 August 2026
This notice explains how Tutora collects, uses and protects the personal data of tutors and tutor applicants. It sits alongside our main Privacy Policy (which covers parents and students) and our Safeguarding Policy, and gives tutors a clearer picture of how we handle the extra data we need to vet and engage you — including your DBS results, which the law treats with special care (see section 4).
We've tried to keep this in plain English. If anything is unclear, email us at tutoratutoringltd@gmail.com.
1. Who we are
Tutora ("we", "us", "our") is the data controller for the personal data described in this notice.
- Trading name: Tutora
- Registered company name: Tutora Tutoring Ltd, registered in England and Wales
- Company number: 17402829
- Registered address: 217 Charlton Road, Harrow, England, HA3 9HT
- ICO registration number: ZC224608
- Contact / data queries: tutoratutoringltd@gmail.com. Tutora has not appointed a Data Protection Officer; data questions go to the founders at that address.
If you have a question about your data, this is the email to use.
2. What data we collect about tutors
When you apply to tutor with Tutora, and while you remain on the platform, we collect:
- Identity and contact details — name, email address, phone number, and (where relevant to payment or records) home/service address.
- Right-to-work and identity documents — the documents we need to confirm your identity and your right to work in the UK (e.g. passport, visa/immigration status, or other ID used in the DBS process).
- References — the references you provide and the responses we receive when we check them.
- Qualifications and experience — subjects and levels you can teach, teaching/tutoring experience, and evidence of relevant qualifications.
- DBS results — the outcome of your enhanced DBS with children's barred list check (and, if you join it, your DBS Update Service status). This is criminal-offence data and is handled under stricter rules — see section 4.
- Performance and platform data — ratings and review comments left by parents, the lesson summaries and progress scores you write, your availability, and your booking/session history.
We only collect what we need to vet you, engage you, and run the platform.
3. Why we process your data (lawful basis)
| Purpose | Data | Lawful basis (UK GDPR) |
|---|---|---|
| Assessing your application and setting you up on the platform | Identity/contact, qualifications, references | Performance of a contract (pre-contractual steps at your request) / legitimate interests (assessing suitability) |
| Confirming your identity and right to work | ID and right-to-work documents | Legal obligation, and legitimate interests in engaging suitable tutors |
| Vetting you to work with children | References, and the enhanced DBS with children's barred list check | Legal obligation / legitimate interests in safeguarding children — and, for the DBS result specifically, an Article 10 / Schedule 1 condition (see section 4) |
| Running lessons, bookings and payments | Availability, session history, payment details | Performance of a contract |
| Displaying and improving service quality | Ratings, reviews, lesson summaries | Legitimate interests (maintaining and demonstrating quality; helping parents choose) |
Our "legitimate interests" above are, in short, engaging suitable tutors and keeping children safe; we balance these against your rights and only process what is proportionate. We do not use automated decision-making or profiling that has a legal or similarly significant effect on you.
4. DBS results — criminal-offence data (special handling)
The result of an enhanced DBS with children's barred list check is criminal-offence data under Article 10 of the UK GDPR. This is not ordinary personal data, and it will be treated with extra care:
- We only process it for safeguarding. We use your DBS result solely to decide whether you can be approved to teach children online, and to keep that decision under review. We do not use it for any other purpose.
- Minimised and access-controlled. We record only what we need — typically the certificate reference, the date and the approval decision, rather than a copy of the full certificate. Access is restricted to the people responsible for approving tutors (the founders).
- Retention. In line with DBS handling guidance, we do not keep DBS certificate information longer than necessary — see section 6.
5. Who we share your data with
We use a small number of trusted service providers ("processors") to run Tutora, all bound by data processing agreements. We don't sell or rent your data to anyone.
| Processor | What they do | Location |
|---|---|---|
| Supabase | Hosts our database and handles authentication (login/password security) | EU (Ireland) region |
| Resend | Sends transactional emails (e.g. account and booking notifications) | EU (Ireland) region |
| Stripe | Processes payments and tutor payouts | EU, under Stripe's own Data Processing Agreement and standard contractual clauses |
Where data leaves the UK/EEA, appropriate safeguards apply (such as the UK's International Data Transfer Addendum or equivalent standard contractual clauses).
What parents see: parents do not see your vetting data. They see a limited public profile (such as your first name, subjects/levels, experience and qualifications, and that you are DBS-vetted) together with your ratings and reviews. Your DBS result, ID/right-to-work documents, references and contact details are never shown to parents.
We may also disclose data to external authorities — such as the DBS, the police, or the Local Authority Designated Officer (LADO) — where we are required or permitted to for safeguarding or legal reasons (see our Safeguarding Policy).
6. How long we keep your data
We keep data only for as long as it's needed:
- Active tutors: for as long as you remain approved and active on the platform.
- Deleted tutor accounts: when your account is deleted (by you or by Tutora), your data is permanently purged within 7 days, except for limited records we're required to keep for legal, safeguarding or tax purposes.
- DBS certificate information: once the approval decision is made we keep only the certificate number, its date, and the decision itself. Any fuller certificate detail we have seen is securely destroyed within 6 months of that decision, in line with the DBS Code of Practice. We re-check approved tutors at least every 3 years, or on an ongoing basis where a tutor has joined the DBS Update Service.
- Financial/tax records: kept for 6 years after the end of the tax year they relate to, as UK tax law requires.
- Backups: may persist for a short additional period in routine system backups before being overwritten. This works the same way for tutors as for everyone else — see section 8 of the Privacy Policy, which explains that the backup window is set by Supabase's terms and our plan rather than chosen by us.
7. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion ("right to be forgotten"), subject to records we must keep by law
- Restrict or object to certain processing
- Data portability (receive your data in a portable format)
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, email tutoratutoringltd@gmail.com. We'll respond within one month, as required by law.
If you're not satisfied with how we've handled your data, you have the right to complain to the UK's data protection regulator:
Information Commissioner's Office (ICO) Website: ico.org.uk Helpline: 0303 123 1113
You can complain to the ICO without first raising it with us, but we'd welcome the chance to put things right first.
8. Changes to this notice
We may update this notice from time to time, for example as the service grows or as we add new features. We'll update the "last updated" date at the top of this page and, where changes are significant, let approved tutors know by email.
9. Contact us
Questions, concerns, or requests about your data: tutoratutoringltd@gmail.com