Privacy notice for parents and pupils
How UPrep uses your family's information when your child has lessons with us.
The short version (please read this part)
- UPrep is run by Abdulrehman Shaker. We use your family's information to teach your child, arrange lessons and take payment.
- Within UPrep, only your child's tutor and Abdulrehman see it. Outside UPrep, we share it only where section 5 says: for example with the services that run our email and website, with HMRC for tax, or to keep a child safe. We never sell it or use it for marketing.
- Outside lessons, we contact you, not your child. Lesson arrangements go through you. In lessons, your child's tutor talks with them directly.
- Learning needs and health: we only keep a note if you agree first. When lessons start we ask every family the same short question, and you don't have to tell us anything to answer it. If you agree, we talk about the need in a call and keep one short note of what the tutor should do. Please don't send health details in messages. If you send us health details without being asked, we don't record them, we delete the message within 2 working days, and we'll ask whether you'd like us to keep a note.
- Keeping children safe comes first. If we're worried a child may be at risk of harm, we may share information with children's services, the police or others who protect children, without asking first, where asking could put the child at risk. For the same reason, we may not tell a parent everything about a safety concern if that could put a child or someone else at risk. The law allows this.
- Your child's information belongs to your child. You, and your child once they understand, can ask to see it, correct it, or object to how we use it. Complaints go to us first (uprep.tutors@gmail.com), and you can always contact the ICO.
The full details follow.
1. Who we are
UPrep is run by Abdulrehman Shaker as a sole trader. Abdulrehman decides how your information is used (the "controller") and is our Designated Safeguarding Lead. Contact: uprep.tutors@gmail.com · 07305 601684. We don't have a Data Protection Officer, because a business of our size and type doesn't need one.
Who this is for: parents and carers who arrange lessons with UPrep, and the pupils we teach. Your child has their own short version, which we'll give you to share with them.
2. What we collect, and why
| What | Why | Our legal basis |
|---|---|---|
| About you: your name, phone number, email, and your address or the lesson location if lessons are at home | To arrange and run lessons, and keep in touch about them | Contract: our agreement with you to provide lessons |
| Invoices and payments | To charge for lessons | Contract; legal obligation to keep tax records |
| About your child: first name, year group, school stage, subjects, level, exam board and target exams | To plan lessons that suit your child | Legitimate interests: teaching your child the lessons you've arranged (we've written an assessment you can ask to see) |
| Your child's work: lesson log, homework, marks, practice-test results and progress notes | To track progress and tell you how it's going | Legitimate interests, as above |
| A learning-needs note, only if you (or your child, if old enough to decide) agreed first: what the tutor should do differently, and the need only where the tutor must know it | So the tutor can adapt lessons | Legitimate interests (as above) and your explicit consent, which you can withdraw at any time |
| A record that you agreed: who agreed, when, how, and which version of our consent note. Not your own words about your child | To show your agreement existed | As above, for as long as we keep the note |
| Messages in the WhatsApp group for your family, and emails | To arrange lessons and send updates | Contract (your messages); legitimate interests (your child's details in them) |
| A portal login, if we give you one: your email, name, and the progress information we show you there | To let you see your child's progress online | Contract; legitimate interests for your child's progress data |
| Safeguarding records, only if a concern arises: what was seen or said, and what was done | To protect children | A record about a child's safety, including what it says about others such as family members: recognised legitimate interest in safeguarding (a basis the law sets out for this). A concern about an adult who works with our pupils, such as a tutor: legitimate interests in protecting children (assessment written). Sensitive details, if any: DPA 2018 Schedule 1 paragraph 18 (safeguarding children), under our written policy |
Using information again for safeguarding. If something we already hold for lessons (a message, a lesson note) becomes relevant to a concern about a child's safety, we may use it for that. The law treats this as compatible with the original purpose where it's needed to safeguard a child.
What we don't do: we don't collect your child's own phone number, email or social media. We don't photograph, film or record lessons. We don't keep diagnosis reports, medication details or medical history. We don't make automated decisions about you or your child: people make every decision.
3. Do you have to give it?
Your contact details, the lesson details and payment are needed for us to provide lessons. Without them, we can't teach. Your child's year group, subjects and level are needed to plan lessons that work. A learning-needs note is entirely your choice: lessons carry on whether or not you agree; agreeing just lets the tutor make adjustments that suit your child. Anything else is up to you.
4. Where it comes from
Mostly from you. Your child's details come from you and from your child, in lessons and homework. Their tutor adds lesson notes and marks. If a safeguarding concern arises, information may also come from your child's school, other professionals or others who raise it. We don't use publicly available sources.
5. Who sees it, and who we share it with
Within UPrep: only your child's tutor and Abdulrehman.
Outside UPrep, only where needed:
- You, about your own child's lessons and progress. Each WhatsApp group contains one family only. Safety information is the exception: we may not share it with a parent where that could put a child or someone else at risk.
- Children's services, the Local Authority Designated Officer (LADO), the police or the Disclosure and Barring Service, only where needed to protect a child or where the law requires it.
- HMRC, and any accountant we use, for tax.
- Companies that work for us and handle information only on our instructions: Google, through Firebase (our portal and database). How we handle an enquiry sent through our website is explained in our website privacy notice at u-prep.co.uk/privacy.
- Companies whose services we use under their own terms: Google (Gmail, our email) · WhatsApp, only if you chose it for lesson messages (otherwise we use email). Messages are end-to-end encrypted and generally stored on phones; WhatsApp may keep undelivered messages and media on its servers, encrypted, for up to 30 days · our bank (a UK bank), for payments.
- Our records are on an encrypted laptop only Abdulrehman uses.
We never sell your information or use it for marketing.
6. Information outside the UK
- Firebase (Google LLC, USA). Portal sign-in details are processed in the USA. Our database is stored in London, in the UK. Google is signed up to the UK's adequacy regulations for the US (the "UK Extension"), so these transfers are covered by UK law. Google's data processing terms also include standard contractual clauses, at firebase.google.com/terms/data-processing-terms, or ask us for a copy.
- Gmail (Google LLC, USA). Google handles our email under its own privacy policy and relies on the same UK Extension. See policies.google.com/privacy/frameworks.
- WhatsApp (WhatsApp LLC, USA). WhatsApp can't read your messages (they're end-to-end encrypted), but it handles your phone number and group details in the USA. WhatsApp LLC isn't covered by the UK's adequacy regulations for the US, and there's no other UK-approved safeguard for this. So we only use WhatsApp if you agree, after we've explained this; if you'd rather not, we use email instead, and you can switch at any time.
- Payments: we pay through a UK bank and don't ourselves send payment information abroad. Our records are on a laptop in the UK.
7. How long we keep it
| Record | How long |
|---|---|
| Invoices and payment records | As long as tax law requires: at least until the fifth anniversary of the 31 January after the tax year they belong to, longer if HMRC opens an enquiry (about six years in practice) |
| Your contact details, lesson and progress records | While lessons continue. After they end, only as long as we might need them to answer a question or claim about the lessons, or to meet the tax rule above for the records it covers. Our retention schedule sets the final periods and we review them yearly |
| A learning-needs note, and the record that you agreed | While lessons continue, then both deleted within one month. Both deleted within 7 days if you withdraw your agreement. Afterwards we keep only a line in our deletion log (a reference number and the date), so that if we ever restore from a backup we delete them again. It records nothing about your child or the need |
| Health details sent in a message before you've agreed | Not recorded. The message is deleted within 2 working days |
| Portal login | Until lessons end and you no longer need access. We'll tell you before we close it |
| Safeguarding records about a child | At least until the child's 25th birthday |
| A concern or allegation about an adult | At least 10 years, and longer where the law on child-abuse claims requires it |
8. Your rights, and your child's
You can ask to see the information we hold, correct it, have it deleted or restricted, object to how we use it (for anything based on legitimate interests or the safeguarding basis), or ask for a copy to move elsewhere where that applies. Some rights are limited where information is needed to protect a child.
Withdrawing your yes. Where we keep a learning-needs note because you said yes, you can withdraw that at any time, by message or in person. We'll delete the note and the record of your agreement within 7 days. Withdrawing doesn't make what we did before unlawful, and lessons carry on; the tutor just stops using the adjustments in the note.
WhatsApp or email. If you agreed to WhatsApp, you can switch to email at any time: just tell us.
Your child has these rights too. Once your child understands what they're asking for, they can make these requests themselves. We'll listen to them, and a parent's request doesn't override a child's own rights.
Complaints. Tell us first: email uprep.tutors@gmail.com with the subject "Data protection complaint", or tell Abdulrehman any other way. We'll acknowledge it within 30 days, look into it, and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk · 0303 123 1113.
Changes. If we plan to use your information for something new, we'll tell you first.
Version 7 · 1 October 2026. Website enquiries are covered by our website privacy notice.