Privacy Policy | We Teach Academy

1. Introduction

We Teach Academy ("we", "us", "our") is committed to protecting your privacy and handling your personal data transparently. This Privacy Policy explains how we collect, use, store, and share your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our contact email for data protection enquiries is info@weteachacademy.co.uk.

2. Data Controller

We Teach Academy is the data controller responsible for your personal data. If you have any questions about this policy or our data practices, contact us at info@weteachacademy.co.uk.

3. Personal Data We Collect

We may collect the following categories of personal data:

Identity data: name, date of birth
Contact data: email address, phone number
Account data: login credentials (passwords are stored securely hashed, never in plain text)
Educational data: assessment results, homework submissions, progress notes, lesson records
Financial data: payment history and subscription details (full card details are processed by Stripe and never stored on our servers)
Technical data: IP address, browser type, device information, and usage data collected automatically when you visit our website
Communication data: messages sent through our platform between parents, students, and tutors

Where we process data relating to children under 13, we require verifiable parental consent in line with the Children's code (Age Appropriate Design Code) and UK GDPR Article 8.

4. How We Use Your Data

We process your personal data for the following purposes and legal bases:

Performance of a contract (Article 6(1)(b)): to provide tutoring services, manage bookings, process payments, and communicate about lessons.
Legitimate interests (Article 6(1)(f)): to improve our services, ensure platform security, prevent fraud, and send service-related communications.
Legal obligation (Article 6(1)(c)): to comply with safeguarding duties, tax obligations, and other legal requirements.
Consent (Article 6(1)(a)): where we send marketing communications or process data for purposes not covered above. You can withdraw consent at any time.

5. Data Sharing

We may share your personal data with:

Tutors: to deliver lessons and track progress (only data relevant to the student-tutor relationship)
Payment processors: Stripe processes payments on our behalf under their own privacy policy
Microsoft: we use Microsoft 365 for email communications and Teams for online lessons
Law enforcement or regulatory bodies: where required by law or to protect the safety of children

We do not sell your personal data to third parties. We do not transfer data outside the UK unless adequate safeguards are in place (such as Standard Contractual Clauses approved by the ICO).

6. Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

Encryption of sensitive data at rest and in transit (TLS/HTTPS)
Secure password hashing (bcrypt with appropriate work factors)
Encrypted storage of OAuth tokens and credentials
Role-based access controls limiting data access to authorised personnel
Regular security reviews and audit logging
DBS-checked tutors with safeguarding training

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Active accounts: data is retained for the duration of the tutoring relationship
Inactive accounts: data is retained for up to 2 years after the last lesson, then securely deleted
Financial records: retained for 6 years to comply with HMRC requirements
Safeguarding records: retained in line with statutory guidance

8. Your Rights

Under the UK GDPR, you have the following rights:

Right of access: request a copy of the personal data we hold about you
Right to rectification: request correction of inaccurate data
Right to erasure: request deletion of your data (subject to legal retention requirements)
Right to restrict processing: request that we limit how we use your data
Right to data portability: receive your data in a structured, machine-readable format
Right to object: object to processing based on legitimate interests
Rights related to automated decision-making: we do not use automated decision-making or profiling that produces legal effects

To exercise any of these rights, email us at info@weteachacademy.co.uk. We will respond within one month as required by law.

9. Cookies

Our website uses essential cookies required for authentication and security. We do not use third-party advertising or tracking cookies. Essential cookies do not require consent under the Privacy and Electronic Communications Regulations (PECR) as they are strictly necessary for the service you have requested.

10. Children's Privacy

Many of our users are children. We take extra care to protect children's data in accordance with the ICO's Age Appropriate Design Code. We collect only the minimum data necessary to provide our educational services, and parental accounts are used to manage access for children under 13.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or through our platform. The "last updated" date at the top of this page indicates when it was last revised.

12. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Helpline: 0303 123 1113

We would appreciate the opportunity to resolve your concerns directly first — please contact us at info@weteachacademy.co.uk.

13. Contact

For any questions about this Privacy Policy or to exercise your data rights, contact us at info@weteachacademy.co.uk or call 07949 370 117.