Your data, and your child's, handled carefully.

Who we are

Elysian Tutors is a trading name of ELEVATEOS EDUCATION LIMITED, registered in England and Wales, company no. 17329548, at Clare College (Memorial Court), Trinity Lane, Cambridge CB2 1TL. We are the data controller for the information described here. We are registered with the Information Commissioner's Office as a data controller and pay the annual data protection fee. Contact us at [email protected].

We have a Data Protection Officer, registered as such with the ICO. You can reach them directly at [email protected], and you can use that address instead of the one above for anything about your data, including a complaint about how we handled a request. Our designated safeguarding lead is Howard Chan, reachable at [email protected].

What we collect

Enquiries. If you email us, or ask us to match you with a tutor, we collect the details you give: your name, email address, optional phone number, and the subject, level and message you submit.

Account details. If you create an account we collect the parent or guardian's name and email address, and a password, which we store only as a hash and never in readable form. We also hold the name and email address of each student added to the account, and a record of the sign-in sessions on it.

Learning records. For each student we hold the academic information you and the tutor give us: the subjects and levels being studied, current and target grades, exam dates, the answers to the readiness check if you complete it, the written report the tutor files after every lesson, and the learning record that builds up from those reports over time.

Bookings and payments. We hold your booking and lesson history, and the payment record that goes with each booking: the amount, the date, the status, and any refund or cancellation. Card details are entered on Stripe's own payment page and handled by Stripe. We do not see or store your card number.

Messages and files. We hold the messages sent through the messaging system on the platform, the files you or your tutor attach to them, and any review you leave about a tutor.

Technical data. To reduce spam and abuse we process basic technical data such as your IP address when you submit a form or sign in.

Why we use it

To reply to your enquiry, to run the tutor directory and let you book, to take payment for lessons and issue refunds, to produce and share the written report after each lesson, to keep you informed about your child's lessons, to keep children safe on the platform, to handle disputes and complaints, to meet our tax and accounting obligations, and to protect the site from spam and abuse. We do not use your details for advertising, and we never sell them.

Messaging on the platform

Messages sent through the platform between tutors, students and parents are logged and can be read by Elysian staff. A parent is also copied on the threads between their child and a tutor. We do this to keep children safe and to resolve disputes, so please treat in-app messaging as monitored rather than private. For the same reason, tutors and families are asked to keep contact on the platform rather than moving to private email, phone or social media. Our lawful basis for this is our legitimate interest in safeguarding the children who use the service and in resolving disputes fairly.

Our lawful basis

Under UK GDPR we rely on: taking steps at your request before entering a contract, and performing the tutoring contract once lessons begin (Article 6(1)(b)); our legitimate interests in replying to you, safeguarding children, preventing fraud and abuse, and keeping the site secure (Article 6(1)(f)); and our legal obligations for tax and accounting records (Article 6(1)(c)). Where we rely on your consent, you can withdraw it at any time.

Who processes it

We use a small number of trusted providers to run the service. Cloudflare hosts the website and provides bot protection through its Turnstile widget; files you or your tutor upload are stored in Cloudflare R2, which is pinned to EU jurisdiction. Neon hosts our database, which holds accounts, learning records, bookings, lesson reports, messages and payment records. Stripe processes card payments and holds the payment records. Resend delivers transactional email, such as booking confirmations and password resets, and notifies our team of new enquiries. Each of them processes data on our written instructions only, under a data-processing agreement.

Where your data is processed

Our production database is hosted in the United States, on Amazon Web Services in Oregon, so the personal data we hold there, including your child's learning records, is stored in the United States. Cloudflare, Neon, Stripe and Resend are all US-owned providers. Files uploaded to the platform are stored in Cloudflare R2, which is pinned to EU jurisdiction. Every transfer outside the UK is covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so your data keeps an equivalent level of protection.

Children's data

We tutor children, so the account is held by a parent or guardian, who gives consent on behalf of a student under 18. A student can have their own login under that account, and the parent can see the student's lessons, reports and message threads. The academic information we hold about a student, including grades, target grades, exam dates and lesson reports, is personal data about a child, and it is stored in the US-hosted database described above. We keep it for as long as we keep the family's other records, which is up to seven years after the tutoring ends. A parent or guardian can ask us for a copy of their child's data, or ask us to correct or delete it, on the child's behalf.

Please do not put sensitive medical or safeguarding information into a booking form or a message thread. If you have a safeguarding concern, email [email protected]. Our designated safeguarding lead is Howard Chan.

If you apply to tutor with us

When you apply through our tutor application we collect your name, email address, phone number, university, degree subject and year, qualifications and grades, the subjects you can teach, your availability and preferred hours, your tutoring experience, your CV if you upload one, and what you tell us about your safeguarding and professional background. We also record your enhanced DBS status and your eligibility to work as an independent tutor, and the outcome of the checks we carry out to verify what you have told us, including any references or documents you provide. We use this to assess your application and your suitability to work with children, which is our legitimate interest in screening tutors and our obligation to safeguard children. If your application succeeds, this becomes part of your tutor record. If it does not, we delete the application once we no longer need it, and sooner if you ask.

Your interview, and how we score it

Every applicant is interviewed by a person. We record the interview and, with the transcript, we run a scoring tool that produces a mark out of 100 against a fixed set of things we are looking for, and quotes the part of your interview each mark rests on. The tool is advisory only. No decision about your application is made by that tool. A person reads the transcript and the evidence, weighs it alongside your subjects, references and checks, and decides, and only a person can record a pass or a fail.

You can ask us what your score was and what it rested on. You can tell us why you think it is wrong, and you can ask a different person to look at the decision again. Ask at [email protected] and we will answer. We keep the score and its evidence with your application, and it goes when the application goes.

How long we keep it

If you do not become a client, we delete your enquiry within 12 months of your last contact, or sooner if you ask. If your child becomes a client, we keep records for the duration of the tutoring and for up to seven years afterwards, to meet our legal, tax and accounting obligations. You can ask us to delete your data at any time, and we will do so unless we are required to keep it.

Your rights

Under UK GDPR you have all of the following. To use any of them, email [email protected]. We answer within one month and we do not charge.

• Access. Ask for a copy of the personal data we hold about you or your child.
• Rectification. Have anything inaccurate corrected, and anything incomplete completed.
• Erasure. Ask us to delete it, which we do unless the law requires us to keep it.
• Restriction. Ask us to pause using it while a dispute about accuracy or our grounds is resolved.
• Objection. Object to any use we base on legitimate interests, including our safeguarding monitoring of messages. We stop unless we can show compelling grounds that override yours.
• Portability. Receive the data you gave us in a machine-readable form, or have us send it to another provider.
• Withdraw consent. Where we relied on your consent, withdraw it at any time. That does not undo what we did before you withdrew it.
• Automated decisions. We do not make any decision about you or your child by automated means alone, and we do not profile you. Where a lesson report is drafted with AI assistance, a member of our staff reviews and approves it before you ever see it, and no decision about you or your child follows from it automatically.

If you are unhappy with how we handled a request, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You can complain to them without asking us first.

If you are in the United States

We are a UK company and UK data-protection law governs what we do, and two US rules matter to a family here.

Children under 13. Under COPPA, an account with us is opened and held by a parent or legal guardian, who provides the child's details and agrees to how we use them. We do not knowingly collect personal information directly from a child under 13 without that. A student login only exists underneath a parent's account. If you believe a child under 13 gave us information without a parent doing so, email [email protected] and we will delete it. A parent can review what we hold about their child, ask us to delete it, and refuse any further collection, at any time, using the same address.

Selling and sharing. We do not sell personal information. We run one measurement script, TikTok’s, and it loads only if you have said yes to it. Until you do, nothing is fetched from TikTok and nothing is set on your device. If you accept, that script may amount to sharing for cross-context behavioural advertising under US state privacy laws, so you can withdraw at any time with the cookies and measurement control, which asks you again from scratch. We never send TikTok your name, email address or telephone number, hashed or otherwise.

Your data is processed in the United States and in the United Kingdom. The rights listed above are given to you as a matter of our policy wherever you live, so you can use all of them from the US.

Türkiye'deyseniz

Bu bölüm 6698 sayılı Kişisel Verilerin Korunması Kanunu (KVKK) kapsamındaki aydınlatma yükümlülüğümüz içindir. Veri sorumlusu ELEVATEOS EDUCATION LIMITED'dir (Birleşik Krallık, şirket no. 17329548). İşlenen veriler, işleme amaçları ve saklama süreleri bu bildirimin yukarıdaki bölümlerinde açıklanmıştır.

Verileriniz Birleşik Krallık ve Amerika Birleşik Devletleri'nde bulunan sunucularda işlenir. KVKK madde 9 uyarınca yurt dışına aktarım açık rızanıza dayanır; bu rızayı dilediğiniz zaman [email protected] adresine yazarak geri alabilirsiniz.

KVKK madde 11 uyarınca kişisel verilerinizin işlenip işlenmediğini öğrenme, buna ilişkin bilgi talep etme, işlenme amacını öğrenme, yurt içinde veya yurt dışında aktarıldığı üçüncü kişileri bilme, eksik veya yanlış işlenmişse düzeltilmesini isteme, silinmesini veya yok edilmesini isteme, bu işlemlerin aktarıldığı üçüncü kişilere bildirilmesini isteme, münhasıran otomatik sistemlerle analiz edilmesi sonucu aleyhinize bir sonuç ortaya çıkmasına itiraz etme ve zarara uğramanız hâlinde zararın giderilmesini talep etme haklarına sahipsiniz. Başvurularınızı yukarıdaki e-posta adresine iletebilir, sonuçtan memnun kalmazsanız Kişisel Verileri Koruma Kurumu'na şikâyette bulunabilirsiniz.

Cookies

We use only what the site needs to work. When you sign in we set a strictly necessary session cookie so that you stay signed in, and a second cookie that records only which kind of account you hold, so the site shows the right menu before the page finishes loading. Neither contains anything secret about you, and both are cleared when you sign out. Cloudflare Turnstile, the bot-protection widget on our forms, may set a short-lived token to confirm you are human. We use one advertising measurement script, TikTok’s pixel, and only after you have accepted it. It sets its own cookies once loaded, it is never loaded before you answer, and declining leaves the site working exactly as it did. Your answer is remembered in your browser’s own storage rather than in a cookie, which is the only thing we keep before you choose. Change your mind at any time with the cookies and measurement control.