Starlight Tutors Privacy Policy
This Privacy Policy explains how Starlight Tutors Ltd, trading as Starlight Tutors (“we,” “us,” or “our”), collects, uses, shares, and protects personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to safeguarding the privacy and security of personal information provided to us in the course of our tutor introductions, employment agency and employment business activities.
1. Data Controller
1.1 Starlight Tutors Ltd (company number 15154793), whose registered office is at 55-56 Henley Road, Nuneham Courtenay, Oxford, OX44 9PR, is the data controller responsible for the processing of personal data collected through our tutor introductions, employment agency and employment business activities. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB743725. If you have any questions or concerns regarding the processing of your personal data, please contact us using the details provided at the end of this policy.
2. Legal Basis for Processing
2.1 We process personal data based on one or more of the following legal bases:
(a) Performance of a Contract: Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.
(b) Legitimate Interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, provided that such interests are not overridden by your interests or fundamental rights and freedoms.
(c) Compliance with Legal Obligations: Processing is necessary for compliance with a legal obligation to which we are subject.
(d) Consent: Processing is based on your consent, which you may withdraw at any time.
2.2 The main purposes for which we use personal data, and the legal basis we rely on for each, are:
(a) Introducing Tutors to Clients, supplying Tutors to Clients, arranging lessons and invoicing: performance of a contract.
(b) Vetting Tutors (identity, right to work, references and DBS checks), keeping employment agency and employment business records, and keeping tax, pay and holiday records: compliance with legal obligations.
(c) Safeguarding children: compliance with legal obligations and, for special category and criminal records data, the substantial public interest condition of safeguarding children and individuals at risk (see clause 3.2).
(d) Running and improving our services, including our internal use of AI tools (see section 7): legitimate interests.
(e) Marketing, newsletters, and using Tutor photographs on our website and social media: consent.
3. Information We Collect
3.1 We collect and process various types of information, including personal data, for the following purposes:
(a) Contact information (such as name, address, email address, and telephone number) to communicate with you regarding our tuition services, employment agency activities, and schedule sessions.
(b) Student information (such as name, age, grade level, and academic performance and, where a parent or guardian shares it, information about special educational needs (SEND) or health that is relevant to tuition, and lesson reports) to tailor tuition sessions to individual student needs and monitor progress.
(c) Tutor information (such as qualifications, experience, CV, references, proof of identity and right to work, enhanced DBS check details, feedback, photograph (only with consent) and payout or bank details) to assess suitability and identify and introduce potentially suitable tutors for tuition sessions, and facilitate employment agency introductions and employment business placements. For employment business placements, we also collect National Insurance or Unique Taxpayer Reference numbers, records of hours worked, and pay and holiday records.
(d) Communications and enquiries (such as messages sent through our website contact form, the WhatsApp groups we set up, email and TutorCruncher) to respond to enquiries and support tuition arrangements.
3.2 We collect criminal records information (through enhanced DBS checks and the Children’s Barred List) and, where relevant, information about a student’s special educational needs or health. We process this only where necessary to safeguard children, to meet our legal obligations, or with explicit consent, and we keep it secure with restricted access.
3.3 Most of the information we hold is provided directly by you. We also receive information from referees, the DBS Update Service, parents and guardians (about their children), and schools.
3.4 Where we need information to comply with the law or to enter into a contract with you (for example, vetting documents from Tutors), we will not be able to introduce or supply a Tutor, or arrange tuition, if that information is not provided.
4. Use of Information
4.1 We use the information we collect for the following purposes:
(a) To introduce or supply tutors, support tuition, and fulfil our contractual obligations towards students, parents/guardians, schools/local authorities and/or other organisations with whom we work.
(b) To communicate with students, parents/guardians, tutors, teachers (where applicable) and clients regarding tuition sessions, scheduling, updates, feedback, employment agency introductions and employment business placements (where applicable).
(c) To monitor student progress and academic performance, and provide feedback and support as necessary.
(d) To comply with legal and regulatory requirements, including record-keeping, reporting, safeguarding obligations, employment agency and employment business regulations, and tax and pay record-keeping.
(e) To improve our tuition services, develop new programs, enhance the overall learning experience, and facilitate successful tutor-client introductions, where applicable.
5. Sharing of Information
5.1 We may share personal information with the following categories of recipients:
(a) Tutors: We may share relevant Student and Client information with independent Tutors whom we introduce to Clients where this is necessary to facilitate the introduction and tuition arrangement.
(b) Parents/Guardians: We may share student information with parents/guardians to provide updates, feedback, progress reports, and employment agency introductions.
(c) Clients: We may share tutor information with clients for employment agency introductions and employment business placements, subject to consent and agreement between parties. We will never share client information with another client without the written consent of the data subject.
(d) Schools: We may share information relating to students with schools and their employees (e.g. teachers) either where the school is our client and has contracted for us to deliver tuition services to one or more of their students, or where a Parent/Guardian for the student has given us their consent, in writing, to share information with the student’s school.
(e) Service Providers: We may engage third-party service providers to assist us in providing tuition services or introductions to tutors, such as our tutoring management platform (TutorCruncher), payment processors (Stripe), communication and office tools (WhatsApp, Google and Microsoft services), our website host (Hostinger), AI tools (see section 7), our accountants, and administrative support. These providers act on our instructions under contracts that require them to protect your data.
(f) Regulatory Authorities: We may disclose information to regulatory authorities or law enforcement agencies as required by law or to protect our legal rights.
5.2 We do not sell or rent personal information to third parties for marketing purposes.
6. International Transfers
6.1 Some of our service providers, and some of our Clients, are based outside the UK. Where personal data is transferred outside the UK, we make sure it is protected, either because the country has been assessed by the UK as providing adequate protection, or by using the UK’s approved contract clauses (the International Data Transfer Agreement or the UK Addendum).
6.2 Where we introduce a Tutor to a Client based outside the UK, we share the Tutor’s information with that Client only as needed for the introduction.
7. Use of Artificial Intelligence (AI) Tools
7.1 We use AI-powered tools to help us run our business efficiently, for example to draft and summarise emails and lesson reports, organise scheduling, help prepare tutor profiles, and suggest possible tutor-student matches.
7.2 We use business versions of these tools under contracts that require the provider to keep data confidential and secure and not to use it to train their AI models.
7.3 We only share the minimum personal data needed for the task. We avoid entering special category data (such as health or SEND information) or criminal records information into AI tools, and we do not use AI to assess DBS or safeguarding information.
7.4 AI does not make decisions about you. A member of our team always reviews AI-assisted output and makes the final decision on matching, introductions and anything else that significantly affects you.
7.5 Some AI providers are based outside the UK; transfers are protected as described in section 6.
7.6 Our legal basis is our legitimate interest in running an efficient, high-quality service. You can object to your data being used with AI tools by contacting us, and we will stop unless we have a compelling reason to continue.
8. Data Retention
8.1 We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. The specific retention period for personal data may vary depending on the nature of the data and the purposes for which it is processed.
8.2 In particular, we keep:
(a) records of our employment agency and employment business activities for at least one year after we last provided services to you, as required by the Conduct of Employment Agencies and Employment Businesses Regulations 2003;
(b) contracts, invoices, and accounting and tax records for six years;
(c) pay and holiday records for employment business placements for six years;
(d) DBS check details only for as long as needed to confirm suitability; where possible, we record the certificate number, date and outcome rather than keeping a copy;
(e) safeguarding records for as long as required by safeguarding guidance; and
(f) enquiries that do not lead to tuition or an introduction for 12 months.
9. Data Subject Rights
9.1 Under applicable data protection laws, you have certain rights regarding your personal data, including:
(a) Right of Access: You have the right to request access to your personal data and information about how it is processed.
(b) Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data.
(c) Right to Erasure: You have the right to request the deletion of your personal data under certain circumstances.
(d) Right to Restriction of Processing: You have the right to request the restriction of processing of your personal data under certain circumstances.
(e) Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller.
(f) Right to Object: You have the right to object to the processing of your personal data under certain circumstances, including processing for direct marketing purposes.
(g) Right to Withdraw Consent: If processing is based on your consent, you have the right to withdraw your consent at any time.
9.2 To exercise any of these rights, or if you have any questions or concerns about the processing of your personal data, please contact us using the details provided at the end of this policy.
10. Data Security
10.1 We implement appropriate technical measures and adopt relevant policies and processes, as an organisation, in order to protect the security and confidentiality of personal information. These measures include access controls (such as secure passwords and limiting who can see personal data), two-factor authentication where our service providers offer it, and using reputable service providers (such as TutorCruncher, Stripe, Google and Microsoft) that protect data with encryption. However, please note that no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
10.2 Special category data and data relating to children (under the age of 18) and vulnerable adults (“Sensitive Data”) that is collected and processed in accordance with this policy shall be stored subject to additional reviews by our internal team to ensure that we are satisfied that the storage and processing of that data is appropriate. In particular, Sensitive Data shall be subject to the following additional safeguards:
(a) We shall review where Sensitive Data is stored periodically and at least once a year to ensure that it is appropriately secured and protected.
(b) We shall maintain robust processes that govern the access to and retrieval of Sensitive Data, which shall include:
(i) Who can access Sensitive Data, and how much access they will need at any given point in time in order to discharge our duties to you or to any lawful authority;
(ii) What Sensitive Data is permitted to be used for (which shall be restricted only to that use which is reasonably necessary for us to discharge our contractual and/or statutory duties);
(iii) What processing takes place when Sensitive Data is retrieved, including guidelines about what copies might be made, what they will be used for and where they will be stored.
10.3 In the event that there was to be any data breach of any kind (either suspected or known), we will undertake to:
(a) Immediately take action to assess and mitigate the extent of any such breach.
(b) Take steps to promptly assess what data has been, or may have been, compromised.
(c) Where required by applicable data protection law, we will notify affected individuals and/or the Information Commissioner’s Office.
(d) Take any measures that may be necessary in order to prevent compromised data being used by an unauthorised third party (e.g. recommending to data subjects that they change passwords that may have been compromised).
(e) Where appropriate, we will keep data subjects informed of any change to the level of risk we assess exists as a result of any such breach.
11. Complaints
11.1 If you are unhappy with how we have handled your personal data, please contact us first at info@starlighttutors.co.uk. We will acknowledge your complaint within 30 days and keep you informed of the outcome.
11.2 You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
12. Cookies
12.1 Our website uses cookies. For details of the cookies we use and how to manage them, please see our Cookie Policy at https://starlighttutors.co.uk/cookie-policy-uk/
13. Changes to this Privacy Policy
13.1 We reserve the right to update or modify this Privacy Policy at any time. Any changes will be effective immediately upon posting the updated Privacy Policy on our website. We encourage you to review this Privacy Policy periodically for any changes.
14. Contact Us
14.1 If you have any questions or concerns about this Privacy Policy or our data practices, or if you wish to exercise your data subject rights, please contact us at:
Hijaab Khan
Founder & Director, Starlight Tutors
info@starlighttutors.co.uk
+44-7739842330
Last updated: 13/10/2026