Privacy notice

This notice takes effect from [to be confirmed: effective date]. It explains what personal data we hold, why we hold it, who we share it with and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

1. Who we are

The data controller is Complete School Solutions Ltd, a company registered in England and Wales under company number 16984053, whose registered office is at Unit 16, Roundhouse Court, Barnes Wallis Way, Chorley, PR7 7JN, United Kingdom. We operate cts-edu.com under the trading name Complete Tutor Solutions. Our ICO registration number is [to be confirmed: ICO registration number].

For anything relating to personal data, contact us at hello@cts-edu.com.

2. The data we collect

• Parent account data — name, email address, and the details you give us when you register and manage bookings.
• Student data— the student's first name, year group, subjects, and any notes the parent adds about their learning.
• Tutor data — identity, right-to-work and vetting information, references, DBS status, profile details and rates.
• Booking and payment data — session requests, confirmations, cancellations and payment records. Card details are handled by our payment processor; we do not store full card numbers.
• Session recordings — video and audio of every session, which includes video and audio of a child.
• Support and messaging correspondence — emails and WhatsApp messages exchanged with us.

3. How we use data, and our lawful bases

• Delivering sessions and running your account — matching, booking, payment and the video rooms sessions run in. Our lawful basis is performance of a contract with the account holder.
• Safeguarding — vetting tutors, recording sessions, reviewing recordings when a concern is raised and referring matters to the authorities where appropriate. Our lawful bases are legal obligation and legitimate interests in protecting children, and — for any special category data involved — substantial public interest (safeguarding of children) under the Data Protection Act 2018.
• Where we rely on consent — for example parental consent to session recording obtained at registration — you can withdraw it at any time, although sessions cannot take place unrecorded.
• Legal and accounting obligations — keeping the records the law requires us to keep, under legal obligation.

4. Children's data

Students on CTS are under 18, so we treat their data with particular care:

• The parent is the account holder. Students use the service through their parent's account and never contract with us directly.
• Parental consent — including consent to session recording — is obtained at registration, before any session can be booked.
• We collect only the student data needed to deliver tutoring: first name, year group, subjects and the parent's notes.
• A parent can exercise any of the rights in section 9 on their child's behalf by contacting us at hello@cts-edu.com.

5. Session recordings

Every session is recorded — video and audio of both the tutor and the student. We record for two purposes only: safeguarding review and dispute resolution. Both participants see a recording notice before joining each session.

• Access is restricted to our designated safeguarding staff. Tutors cannot view recordings, and neither can other parents.
• Recordings are stored encrypted.
• Recordings are retained for [to be confirmed: recording retention period] and then deleted.

The wider safeguarding context is explained on our safeguarding page.

6. Who we share data with

We do not sell personal data. We share it only with the service providers who process it on our instructions:

• Hosting — Vercel, which hosts the platform.
• Database and authentication — Supabase, which stores account and booking data.
• Payment processing — Stripe, which handles card authorisation and payment.
• Video and recording — Daily.co, which provides the video rooms and session recording.
• Transactional email — Resend, which sends account and booking emails.
• Messaging — WhatsApp (Meta), where you choose to contact us on WhatsApp.

We may also disclose data where the law requires it, or to the relevant authorities in connection with a safeguarding concern.

7. International transfers

Some of the providers above process data outside the UK, including in the United States. Where data leaves the UK, we rely on safeguards recognised under UK GDPR — such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU standard contractual clauses — so that it remains protected to UK standards.

8. How long we keep data

We keep personal data only as long as we need it for the purposes above: account data for the life of the account and a limited period afterwards; payment records for as long as tax and accounting law requires; and session recordings for the period set out in section 5, which is [to be confirmed: recording retention period]. Where data is relevant to a safeguarding concern, we may retain it for longer, for as long as the matter requires.

9. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have data erased, where the law allows;
• restrict how we process your data;
• receive your data in a portable format;
• object to processing based on legitimate interests, including profiling.

To exercise any of these rights — for yourself or on behalf of your child — email hello@cts-edu.com. We will respond within one month. Some rights are qualified: for example, we may need to retain data connected to a safeguarding matter.

10. Complaints

If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

11. Changes to this notice

We may update this notice from time to time. If we make a material change — particularly one affecting children's data or session recordings — we will notify account holders by email before it takes effect, and the updated notice will be published on this page.

See also our terms of service and safeguarding page.