Smart X Tutoring — Privacy Policy

Last Updated / Effective Date: 1st September 2026
Version: 2.0 (UK GDPR & Student Portal Compliant)

At Smart X Tutoring ("we", "us", or "our"), we are committed to safeguarding the privacy, personal data, and safety of our parents, students, tutors, and website visitors. This Privacy Policy explains how we collect, use, store, share, and protect your personal information in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Information Commissioner’s Office (ICO) Age-Appropriate Design Code (the Children's Code).

Please read this policy carefully to understand our practices regarding your personal data and how we treat it.

1. About Us (The Data Controller)

Smart X Tutoring is an educational provider based in London, UK, operating the website https://SmartXtutoring.uk. Under the UK GDPR, we act as the Data Controller for the personal information processed through our services, website, portals, and tutoring activities.

• Company Name: Smart X Tutoring
• General Email: admin@Smart Xtutoring.uk
• Contact Phone: +44 7356 046887 
• Registered Address/Location: London, United Kingdom 

Data Protection & Safeguarding Leadership

To ensure the highest standards of safety, compliance, and child protection, we have appointed a dedicated leader to oversee our data privacy practices.

• Data Protection Lead: Ms Anjna Karania (MA, NPQH, BSc)
• Position within Smart X: Tutor Coordinator and Data Protection Lead
• Direct Compliance Contact: admin@Smart Xtutoring.uk (Please mark subject as "FAO: Data Protection Lead") 

About Our Lead's Vetting & Experience:
Anjna Karania is a seasoned senior school leader with over twenty years of experience in UK secondary schools. Her background includes serving as a Deputy Headteacher and the designated Data Protection Lead for a community school of over 1,800 students. Furthermore, she is formally certified in Safeguarding and KCSIE (Keeping Children Safe in Education), Safer Recruitment, and  Mental Health First Aid. Her extensive background ensures that our administrative, academic, and portal structures are designed with children's safety and privacy as an absolute priority.

2. Our Lawful Bases for Processing Data

Under UK GDPR Article 6, we must have a valid legal reason (lawful basis) to process your personal data. We rely on the following bases:

1. Contractual Necessity: To provide our tutoring services, manage bookings, facilitate client accounts on our learning portal, process payments, and communicate regarding lessons.
2. Consent: For placing non-essential cookies on your browser, capturing analytics, and sending promotional or marketing communications (which can be withdrawn at any time).
3. Legitimate Interests: To maintain website security, prevent fraudulent transactions, run quality assurance on lessons, and optimize our learning platform, provided these interests do not override your fundamental rights .
4. Legal Obligation: To comply with statutory legal requirements, such as preserving financial and tax records for HMRC, or cooperating with legal mandates.
5. Vital Interests / Safeguarding: Under exceptional circumstances, we may process or share data to protect the vital interests of a child or individual, specifically to meet UK safeguarding standards and Child Protection regulations.

3. What Personal Information We Collect and How

A. Information Provided Directly by You

We collect information that you submit to us when registering, filling out forms, or communicating with us:

• Parents, Guardians, and Adult Students: Full name, billing address, contact email address, phone number, and payment card/billing details (which are processed securely by our third-party provider, Stripe).
• Students (Children): Full name, age, date of birth, current academic year/Key Stage, subjects studied, school, homework submissions, and progress tracking.
• Special Educational Needs and Disabilities (SEND) / Accessibility Information: If volunteered by a parent or guardian, we may note specific learning styles, neurodivergence (e.g., dyslexia, autism), or accessibility needs to tailor and adapt our lessons appropriately. This is classified as Special Category Data under UK GDPR, and we process it only with your explicit, affirmative consent.
• Tutors: Full name, contact details, qualifications, university degrees, teaching specialisms, payroll details, and mandatory vetting records (including Enhanced DBS checks and identification documents).

B. Information Collected Automatically

When you visit our website, we automatically collect technical details using cookies and server logs:

• Technical Data: IP address, browser type and version, operating system, time zone settings, and platform details.
• Usage Data: Information about how you navigate our website (e.g, page response times, download errors, duration of visits, and clickstream data).
• Cookies & Tracking: We use necessary cookies (such as PHPSESSID for managing browser sessions, cookieyes-consent to remember your preferences, and Stripe cookies __stripe_mid and __stripe_sid for payment processing) which do not store personal details. Any analytical, functional, or advertisement cookies are strictly optional and only load after you select "Accept All" or customize your consent on our cookie banner.

4. Children’s Privacy, Safeguarding & The Smart X Portal

Because we provide tutoring to children (KS2, KS3, GCSE, and A-Level), we hold ourselves to the highest standards of children’s data protection in alignment with the ICO’s Age-Appropriate Design Code (the Children's Code).

Furthermore, our student-facing systems are fully integrated with our safeguarding policies under the guidance of our Data Protection Lead, Ms Anjna Karania.

The Smart X Portal (Secure Student & Parent Access)

We have introduced the Smart X Portal, a secure online platform where students and parents can manage their tutoring journey and access educational materials.

• Individual Accounts & Separate Logins: Each student is issued their own unique, secure login credentials to access their student portal. This ensures that their learning environment is personalised and isolated. No student can access another student's portal or view another student's data.
• Parental Access & Oversight: Parents or legal guardians have complete linked access to their child's portal. Through their own parental login, parents can monitor their child's booked sessions, read detailed academic progress reports, review homework assignments, and manage billing securely.
• Information Available in the Portal: The portal holds and displays data including booked schedules, tutor feedback, learning progress metrics, and uploaded homework or study resources.

Our Safeguarding Controls

• Verifiable Parental Consent: We do not knowingly collect or process personal data from children under the age of 13 without the explicit, verifiable consent of a parent or legal guardian. Registration and billing must always be completed by an adult.
• Data Minimisation: We only collect and store the minimum amount of student information strictly necessary to conduct lessons, track academic progress, and ensure a safe, supportive environment.
• High Privacy by Default: All default settings on the Smart X Portal are set to the highest level of privacy protection for younger users.
• Online Session Security: Online sessions are conducted via secure, private links [29]. Any session notes, tutor logs, or progress files are stored securely within the portal database, accessible only to authorised administrators, the student's assigned tutor, the student, and their parent.
• Continuous Vetting: All tutors undergo mandatory Enhanced Disclosure and Barring Service (DBS) checks and Safer Recruitment training before being granted access to student profiles.

5. How We Use Your Personal Information

We process your personal information for the following specific purposes:

• Service Delivery: To register accounts, schedule and deliver live online tutoring, assign compatible tutors, track progress, and issue academic reviews.
• Billing & Payments: To process invoice transactions and manage direct debits through Stripe.
• Platform Security: To detect, investigate, and prevent unauthorised access, fraudulent transactions, or malicious activity on our site or portal
• Client Communications: To send administrative notices, booking updates, system alerts, or respond to customer service inquiries.
• Marketing (With Consent): To send newsletters, educational resources, or promotional offers about our services that we believe may interest you (fully optional; you can unsubscribe at any time).

6. How We Share Your Personal Information

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We only share information with:

• Service Providers (Processors): Trusted vendors who work on our behalf to operate our business, such as payment gateway processors (Stripe), hosting providers, and administrative tools. These processors are contractually bound to protect your data and are prohibited from using it for their own purposes.
• Our Assigned Tutors: Tutors are only given the necessary academic profiles, names, and learning targets of the students they have been contracted to teach.
• Legal and Safeguarding Authorities: If required by law, court order, or to satisfy our child protection and safeguarding obligations, we may share personal data with local authorities, the police, or regulatory bodies (e.g. to prevent harm or manage child protection concerns).

7. International Data Transfers

Smart X Tutoring operates within the United Kingdom. All personal data is stored securely on servers located within the UK or the European Economic Area (EEA).

If any of our service providers transfer data outside of the UK or the EEA, we ensure that appropriate safeguards are in place in accordance with UK GDPR. This includes transferring only to countries recognised by the UK government as having an "adequate" level of protection, or utilising UK-approved Standard Contractual Clauses (SCCs) or the International Data Transfer Agreement (IDTA). We do not transfer data internationally without these statutory protections.

8. Your Data Protection Rights

Under the UK GDPR and the DPA 2018, you have robust statutory rights regarding your personal data. You can exercise these at any time free of charge:

• The Right of Access: You can request a copy of the personal data we hold about you or your child (known as a Subject Access Request).
• The Right to Rectification: You can request that we correct any inaccurate or incomplete personal data.
• The Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data under certain circumstances (e.g., if we no longer have a lawful basis to keep it).
• The Right to Restrict Processing: You can request that we temporarily suspend processing your data while you contest its accuracy or our lawful bases.
• The Right to Object: You can object to our processing of your data based on legitimate interests or for direct marketing purposes.
• The Right to Data Portability: You can request a copy of your data in a structured, machine-readable format to transfer to another provider.
• The Right to Withdraw Consent: If we process your data based on consent, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact our Data Protection Lead at admin@Smart Xtutoring.uk.

9. Data Retention and Security

We implement strong administrative, technical, and physical security measures to protect your data from unauthorised access, loss, or alteration.

Your personal data is only kept for as long as is necessary to fulfil the purposes for which it was collected, as well as to meet statutory legal, accounting, and reporting obligations. For example:

• Financial and transactional records: Kept for 6 years in compliance with UK tax laws.
• Student and tutoring records: Retained for the duration of your active enrollment with us, and safely archived for a reasonable period thereafter in case you return or require educational references.

10. How to Lodge a Complaint

If you have any concerns or complaints about how we process your personal data, please contact us first so we can resolve the issue.

However, you have a statutory right to lodge a complaint at any time with the UK’s data protection regulator:

• Supervisory Authority: Information Commissioner’s Office (ICO)
• Website: https://ico.org.uk
• Helpline: 0303 123 1113

11. Contact Us

For any questions regarding this Privacy Policy, cookie settings, or your data rights, please contact:

Smart X Tutoring Data Team
Data Protection Lead: Ms Anjna Karania
Email: admin@Smart Xtutoring.uk
Phone: +44 7356 046887
Website contact form: https://Smart Xtutoring.uk/contact/