Privacy notice for tutors
How UPrep uses the information of tutors who work with us.
Who we are. UPrep is run by Abdulrehman Shaker as a sole trader. Abdulrehman decides how your information is used (the "controller") and is also our Designated Safeguarding Lead. Contact: uprep.tutors@gmail.com · 07305 601684.
Who this is for. Anyone who tutors for UPrep, applies to, or covers lessons for us.
1. What we collect, and why
| What | Why | Our legal basis |
|---|---|---|
| Your name, contact details, the subjects, levels and times you'd like to teach | To offer you lessons and run our work together | Contract: our Tutor Services Agreement with you |
| The agreement, and the policies you've been given and acknowledged | To show what we agreed and what you were given | Contract, and legitimate interests in keeping a reliable record |
| Lesson records (which pupil, when, how long) and payment details (bank details, amounts paid) | To arrange lessons and pay you | Contract |
| Tax and payment records | Where the law requires us to keep them | Legal obligation |
| Vetting: your identity, qualifications, work history, two references, a yearly self-declaration about cautions or convictions, and four details from your DBS certificate (issue date, type, what it was issued for, number) | To make sure it's safe for you to work with children, and to keep that check current | Legitimate interests in protecting children (we've written an assessment you can ask to see), with DPA 2018 Sch 1 para 36 + para 10 for criminal-record information |
| DBS Update Service checks (with your permission) | To confirm your certificate is still current, yearly | As above |
| Right-to-work evidence, where the law requires it | To meet that legal requirement | Legal obligation |
| Concerns, complaints or allegations about you | To protect children and deal with concerns fairly | Legitimate interests in protecting children (assessment written), with Sch 1 para 18 for any sensitive or criminal information |
What we don't do: we never keep a copy or photo of your DBS certificate, and we don't collect health, religion, ethnicity or similar information about you.
2. Do you have to give it?
Your contact details, the agreement, references, the self-declaration and a suitable DBS check are conditions of tutoring for UPrep (contractual). Without them we can't offer you lessons. Right-to-work evidence is a legal requirement where it applies. Everything else is optional.
3. Where it comes from
Mostly from you. Also from your referees (who we tell about this notice), the DBS (through the certificate you show us and the Update Service), and, if a concern is raised, from parents, pupils or others.
4. Who we share it with
- Parents of the pupils you teach: your name, and your lesson times.
- Children's services (CASS), the LADO, the police or the DBS, only where needed to protect a child or where the law requires it.
- HMRC, and any accountant we use, for tax.
- Service providers who store or carry information for us (section 5). Some act only on our instructions; others under their own terms.
We never sell your information or use it for marketing.
5. Service providers we use
- Google, through Firebase (our website and tutor portal) handles information only on our instructions.
- Google (Gmail, our email) and WhatsApp (lesson coordination, only if you agree, otherwise email; messages are end-to-end encrypted and generally stored on phones, and WhatsApp may keep undelivered messages and media on its servers, encrypted, for up to 30 days) are services we use under their own terms.
- Our bank (a UK bank), for payments.
- Our records are on an encrypted laptop only Abdulrehman uses.
6. Information outside the UK
- Firebase (Google LLC, USA). Portal sign-in details are processed in the USA. Our database is stored in London, in the UK. Google is signed up to the UK's adequacy regulations for the US (the "UK Extension"), so these transfers are covered by UK law. Google's data processing terms also include standard contractual clauses, at firebase.google.com/terms/data-processing-terms, or ask us for a copy.
- Gmail (Google LLC, USA). Google handles our email under its own privacy policy and relies on the same UK Extension. See policies.google.com/privacy/frameworks.
- WhatsApp (WhatsApp LLC, USA). WhatsApp can't read your messages (they're end-to-end encrypted), but it handles your phone number and group details in the USA. WhatsApp LLC isn't covered by the UK's adequacy regulations for the US, and there's no other UK-approved safeguard for this. So we only use WhatsApp with you if you agree; if you'd rather not, we use email, and that makes no difference to your work with us. You can switch at any time.
- The DBS is a UK government body. Payments: we pay you through a UK bank and don't ourselves send payment information abroad. Our records are on a laptop in the UK.
7. How long we keep it
| Record | How long |
|---|---|
| Vetting (the four DBS details, references, self-declarations, our checks) | While you tutor for us, then up to 6 years after you stop, unless a safeguarding matter about you is open |
| Contract, lesson and payment records | While you tutor for us, then for as long as tax law and possible claims require (usually around 6 years) |
| Concerns or allegations about you | At least 10 years, and possibly longer where the law on child-abuse claims requires it |
These are the criteria in our retention schedule. Final periods are being set, and we'll tell you if they change.
8. Your rights
You can ask to see your information, correct it, have it deleted or restricted, object to how we use it (for anything based on legitimate interests), or ask for a copy to move elsewhere where that applies. Some rights are limited where information is needed to protect children.
Complaints. Tell us first: uprep.tutors@gmail.com, subject "Data protection complaint". We'll acknowledge within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk · 0303 123 1113.
WhatsApp or email. If you agreed to WhatsApp, you can switch to email at any time: just tell us.
Changes. If we plan to use your information for something new, we'll tell you first.
Version 5 · 1 October 2026. Website enquiries are covered by our website privacy notice.