The short version
- Geminine Group Ltd (trading as TutorKiwi) is responsible for your data.
- We use it to match your child with a tutor, run lessons, take payments and keep children safe.
- Your child's tutor sees what they need to teach: first name, school year, subject, goals and lesson work. Tutors can be based outside the UK, including Nigeria, and we protect that data with UK-approved contract terms.
- Parents can see their child's lessons, chat and results. Our safeguarding team can too.
- We never sell your data or show adverts, and we don't use your child's data for marketing.
- You can ask to see, correct, download or delete your data at any time: privacy@tutorkiwi.com.
For students: what happens to your information
Hi! This bit is for you.
- Your parent or carer set up your account. They choose your username and PIN.
- Your tutor knows your first name, your school year and what you're learning, so they can help you.
- When you chat or share files in a lesson, your parent and the TutorKiwi safety team can read it. That's to keep you safe.
- Our computers look out for worrying words in chats. If something looks wrong, a real person checks it.
- If anything in a lesson makes you feel worried or uncomfortable, press "Something not right? Tell TutorKiwi", or tell a grown-up you trust. You won't be in trouble.
- Your test scores, stars and badges are only for you, your parent and your tutor. We never show them to other children.
- You can ask your parent to see everything we keep about you, or to delete it.
Who we are
TutorKiwi is run by Geminine Group Ltd, a company registered in England and Wales (number 15370683), registered office 3 Bonneville Close, Tipton, DY4 9SP, England. We are the "controller" of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact us about privacy at privacy@tutorkiwi.com or by post at our registered office. ICO registration number: [to be added once registered].
What we collect
Parents and guardians
Name, email, phone number, password (stored encrypted), country and region, time zone, payment records (we don't see or store your full card details: our payment providers handle them), credit and referral balances, messages to us, lesson ratings and reviews.
Children
First name, username and PIN, school year or stage, subjects, exam board, goals, any learning notes a parent chooses to share, availability, lesson attendance, homework, in-lesson chat and files, test answers and results, tutor reports, stars, streaks and badges. Please only share health or special educational needs information if it helps the tutor teach. If you do, we treat it as special category data and use it only for that purpose.
Tutors and applicants
Name, email, phone, country and region, subjects, stages, rate, biography, experience, right-to-work declaration, identity check results, criminal record check status (an Enhanced DBS check in the UK, or a police certificate from your home country), references, payout details, tax information we must report to HMRC, lesson records, reports and ratings.
Everyone who visits
Technical data such as device type, pages visited and actions taken on the site. Analytics and testing cookies are only used if you allow them (see our Cookie policy).
Why we use it and our legal basis
| What we do | Legal basis |
|---|---|
| Create accounts, match children with tutors, run lessons, homework, tests and reports | Contract with the parent. For the child's data: our legitimate interest in giving the child the tutoring their parent asked for. |
| Take payments, give credit and refunds, pay tutors | Contract |
| Vet tutors, including identity and criminal record checks | Legitimate interests and legal obligation. Criminal record data is processed under the "safeguarding of children" condition in Schedule 1 of the Data Protection Act 2018. |
| Monitor in-lesson chat and files for safeguarding risks, investigate concerns and refer them to the authorities | Legitimate interests in protecting children, legal obligation, and for special category or criminal data, the safeguarding of children condition |
| Keep financial records and report tutor earnings to HMRC | Legal obligation |
| Send service emails (sign-up, password reset, lesson reminders) | Contract |
| Send parents news and offers | Consent, or our legitimate interest for existing customers with an easy opt-out. We never send marketing to children. |
| Analytics and A/B testing | Consent (cookie banner) |
| Prevent fraud, keep the service secure, handle legal claims | Legitimate interests |
We don't make decisions about anyone using solely automated processing that have legal or similarly significant effects. Tutor matching is suggested by software, but parents choose whether to accept, and staff review every safeguarding flag.
How we protect children's data
We follow the ICO's Age Appropriate Design Code (the Children's Code). In practice:
- Only a parent or guardian aged 18 or over can create an account. Children use a sub-account their parent controls.
- Children's profiles are never public, and children can't contact tutors outside a live, paid lesson.
- Privacy settings are set to the highest level by default. We don't use location tracking, profiling for advertising, or third-party advertising.
- Rewards such as stars and streaks are there to encourage learning. They aren't designed to keep children on the app longer than their lessons need.
- We carried out a data protection impact assessment before launch and review it when we add features.
International transfers
Some tutors are based outside the UK, including Nigeria, and some of our providers process data in the European Economic Area or the United States. When data leaves the UK, we protect it with one of the safeguards UK law allows:
- countries with UK "adequacy" regulations (for example, EEA countries);
- the UK Extension to the EU–US Data Privacy Framework, for certified US providers;
- the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which every tutor outside the UK signs as part of their tutor agreement, together with a transfer risk assessment.
Ask us for a copy of the relevant safeguards at privacy@tutorkiwi.com.
How long we keep it
| Data | How long |
|---|---|
| Account, profile, lesson records, reports and test results | While the account is open, then 12 months |
| In-lesson chat and shared files | 2 years after the lesson |
| Safeguarding concerns and investigation records | Until the child turns 25, or longer if the law or an ongoing case requires it |
| Payment, invoice and tax records | 6 years after the end of the financial year (UK tax law) |
| Tutor vetting records | While the tutor is active, then 6 years. We keep the check result and date, never copies of certificates longer than needed. |
| Unsuccessful tutor applications | 12 months |
| Analytics and testing data | Up to 90 days |
Your rights
You can ask us to: see a copy of your data; correct it; delete it; restrict or object to how we use it; and receive it in a portable format. You can withdraw consent at any time, for example through cookie settings. Parents can use these rights for their children. Older children can also ask us directly, and we will involve their parent where appropriate.
Email privacy@tutorkiwi.com. We reply within one month. Some data, such as safeguarding and tax records, may have to be kept even after a deletion request, and we'll explain if so.
Security
We use encrypted connections, hashed passwords, role-based staff access, file-type checks on uploads and audit logs on safeguarding actions. If a breach puts your data at risk, we will tell the ICO within 72 hours and tell you without delay where the law requires it.
Complaints
Please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113. If you live outside the UK, you can also contact your local data protection authority.
Changes to this policy
We'll post any changes here and update the date at the top. If a change materially affects how we use your data, we'll email account holders before it takes effect.