Privacy Policy

Last updated: 3 October 2026

1. Who we are

This website and the tutoring-matching service available through it are operated by MyOxbridgeTutor Ltd, a company registered in England and Wales under company number 17300888, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

We are the “data controller” responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are registered with the Information Commissioner’s Office (ICO), registration number ZC187116.

If you have any questions about this policy or how we handle your personal data, contact us at privacy@myoxbridgetutor.com.

2. The information we collect

Depending on how you use our service, we may collect:

If you are a parent, guardian or student making an enquiry or booking tuition:

  • Your name and contact details (email address, phone number).
  • The student’s first name, year group or age, the subject(s) and exam board, and details of the support you are looking for.
  • Information you choose to give us in enquiry forms, messages or during a consultation.
  • Account details if you create an account through our tutoring platform.
  • Payment information, processed by our payment provider (we do not store full card details ourselves).

If you are, or apply to become, a tutor:

  • Your name and contact details.
  • Your educational background, qualifications, university and subject(s).
  • Information relevant to vetting and suitability, including references and criminal-records (enhanced DBS) information, and, if you have agreed, status checks on your certificate through the DBS Update Service — see section 7.
  • If you live in the UK, the information used to check your right to work in the UK, such as your passport details or a share code, and a dated copy of the check — see section 7B.
  • Payment details so we can pay you.

If lessons take place in our online classroom:

  • A video and audio recording of each lesson, made automatically for safeguarding. This includes the student, the tutor and anyone else who can be seen or heard in the lesson — see section 7A.

Everyone who uses the website:

  • Usage data, such as pages viewed and how you interact with the site, collected through cookies and similar technologies (see our Cookie Policy).
  • Technical data such as your IP address, browser type and device information.

3. Children’s privacy

Our service supports students preparing for GCSE, A-Level and university admissions, some of whom are under 18. We take the protection of children’s personal data seriously.

Enquiries and bookings for a student under 18 should be made by, or with the knowledge and consent of, a parent or guardian. Where we hold personal data about a student under 18, we limit it to what is necessary to provide tuition and we apply additional care to how it is stored, shared and retained, in line with the ICO’s standards for children’s data.

If you are under 18 and want to contact us, please ask a parent or guardian to do so on your behalf, or to be involved.

If you believe we hold information about a child without appropriate consent, contact us at privacy@myoxbridgetutor.com and we will review and, where appropriate, delete it.

4. How and why we use your information, and our legal basis

Under UK GDPR we must have a lawful basis for each way we use your data. These are set out below.

What we do Why Lawful basis
Respond to your enquiry and arrange a consultation To answer you and match you with a suitable tutor Taking steps at your request before entering a contract; our legitimate interests in responding to enquiries
Create and manage your account; deliver and administer tutoring To provide the service you’ve asked for Performance of a contract
Match students with tutors Core to the service Performance of a contract; legitimate interests in operating the marketplace
Process payments and pay tutors To run the service and meet our obligations Performance of a contract; legal obligation
Vet and verify tutors (including enhanced DBS) To help keep students safe Legal obligation; legitimate interests in safeguarding; and the conditions in section 7 for criminal-records data
Check a tutor’s right to work in the UK To meet our legal duty before a tutor starts work Legal obligation
Record lessons in our online classroom To protect students and tutors, and to look into any safeguarding concern Legitimate interests in keeping students and tutors safe (see section 7A)
Send service messages (e.g. booking confirmations, account updates) To keep you informed about your account and sessions Performance of a contract; legitimate interests
Send marketing emails and newsletters To tell you about our services Consent, or our legitimate interests where you are an existing customer and have not opted out (the “soft opt-in”)
Improve our website and understand how it is used To make the service better Consent (for non-essential cookies); legitimate interests
Keep financial and tax records To meet legal and accounting duties Legal obligation
Establish, exercise or defend legal claims To protect the business Legitimate interests

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we balance them accordingly. You can object to this processing — see section 9.

Where we rely on consent (for example marketing or non-essential cookies), you can withdraw it at any time without affecting processing already carried out.

5. Who we share your information with

We do not sell your personal data. We share it only as needed to run our service, with the following categories of recipient:

  • Tutors — when we match you, we share the information a tutor needs to contact you and prepare for sessions.
  • Our tutoring platform / CRM provider — TutorCruncher, which we use to manage accounts, bookings and payments.
  • Our online classroom and video provider — Pencil Spaces, which we use to deliver online lessons and video calls, and which stores lesson recordings on our behalf.
  • Our vetting providers — uCheck, which processes enhanced DBS applications and digital identity and right to work checks, and TrustID, which we use for some remote right to work checks. If you give us a share code, we check your right to work on the Home Office’s online service.
  • Form and automation providers — the tools that power our enquiry forms and route submissions to us.
  • Communication and productivity providers — for example Google Workspace and Google Sheets (record-keeping) and our messaging tools used for internal alerts.
  • Analytics providers — for example Google Analytics, where you have consented to analytics cookies.
  • Our payment provider — to take payments and pay tutors.
  • Professional advisers — such as accountants or lawyers, where necessary.
  • Authorities or regulators — where we are required to disclose by law, or to protect someone’s safety.

We require everyone who processes data on our behalf to do so only on our instructions and to keep it secure.

6. International transfers

Some of the providers above may store or process data outside the UK (for example in the United States or EU). Where that happens, we make sure your data is protected by an appropriate safeguard recognised under UK data protection law — such as UK “adequacy” regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

7. Criminal-records (enhanced DBS) data for tutors

Where we process information about a tutor’s criminal-records check (an enhanced DBS certificate or its outcome), this is “criminal offence data” and receives extra protection under the law.

We process it only for the purpose of assessing a tutor’s suitability to work with students, including for safeguarding. We do so on the basis of our legal and safeguarding responsibilities, relying on the condition for the safeguarding of children and individuals at risk under the Data Protection Act 2018, supported by an appropriate policy document. We keep this information secure, limit access to it, and retain it only as long as necessary.

7A. Lesson recordings

Lessons in our online classroom, Pencil Spaces, are recorded automatically, and everyone in the lesson hears an announcement at the start that it is being recorded. We record lessons for safeguarding: if a concern is ever raised about a lesson, there is a record of what actually happened. This protects students and tutors alike.

  • Who can see them: Pencil Spaces stores the recordings on our behalf. Within MyOxbridgeTutor, only our Designated Safeguarding Lead can open them. We do not watch lessons live or routinely review recordings.
  • When we open one: only if a safeguarding concern is raised about a lesson, or if the police or another authority asks for it as part of an investigation.
  • Lawful basis: our legitimate interests, and those of students, parents and tutors, in keeping lessons safe.
  • How long we keep them: 7 years from the date of the lesson, then they are deleted, unless a recording is part of an open safeguarding matter, in which case we keep it until that matter is closed. We use a fixed period because we do not hold students’ dates of birth.
  • Your right to a copy: if you appear in a recording, you can ask for a copy by emailing privacy@myoxbridgetutor.com. We may need to remove other people from it first.
  • More detail: see our Safeguarding Policy at myoxbridgetutor.com/safeguarding/.

7B. Right to work checks for tutors

If you live in the UK, we must check that you have the right to work in the UK before your first lesson. Depending on your nationality and immigration status, we do this through a digital check within your enhanced DBS application, through a remote check with TrustID, or by checking a share code you give us on the Home Office’s online service. We do this because the law requires it. We keep a dated copy of the check for as long as you work with us and for 2 years after that.

8. How long we keep your data

We keep personal data only as long as we need it for the purposes above, then delete or anonymise it. Our standard periods are:

  • Enquiries that don’t lead to a booking: retained for business record-keeping and potential future follow-up.
  • Client and tutor records: for the duration of our relationship and then up to 6 years afterwards, to handle queries, disputes and our legal obligations.
  • Financial and tax records: at least 6 years, as required by HMRC.
  • Marketing preferences: until you opt out, reviewed periodically.
  • Enhanced DBS information: we keep copies of Enhanced DBS certificates on file for record-keeping, renewal tracking, and compliance purposes.
  • Lesson recordings: 7 years from the date of the lesson, then deleted, unless part of an open safeguarding matter — see section 7A.
  • Right to work checks: for as long as you work with us, and for 2 years after that — see section 7B.

9. Your rights

Under UK data protection law you have the right to:

  • Be informed about how we use your data (this policy).
  • Access the personal data we hold about you.
  • Rectification — have inaccurate or incomplete data corrected.
  • Erasure — ask us to delete your data in certain circumstances.
  • Restrict how we use your data in certain circumstances.
  • Data portability — receive certain data in a reusable format, or have it transferred to another provider.
  • Object to processing based on our legitimate interests, and to direct marketing at any time.
  • Not be subject to solely automated decisions that have a significant effect on you.
  • Withdraw consent at any time where we rely on it.

To exercise any of these, contact us at privacy@myoxbridgetutor.com. We will respond within one month. There is normally no charge.

10. Your right to complain

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put things right. You also have the right to complain to the ICO:

Information Commissioner’s Office — www.ico.org.uk — helpline 0303 123 1113.

11. Cookies

We use cookies and similar technologies on our website. Non-essential cookies (such as analytics) are only used with your consent. For full details, see our Cookie Policy.

12. Data security

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse. No system can be guaranteed completely secure, but we take reasonable steps to keep your information safe and to limit access to those who need it.

13. Changes to this policy

We may update this policy from time to time. We will post any changes here and update the “Last updated” date. Where changes are significant, we will take reasonable steps to let you know.

14. Contact us

For any questions about this policy or your personal data:

MyOxbridgeTutor Ltd 71-75 Shelton Street, Covent Garden London WC2H 9JQ

privacy@myoxbridgetutor.com