How we collect, use and protect personal information about families, students, tutors and visitors to our website.
Last updated: October 2026
1. Who we are
EduNoetic Solutions (“we”, “us”, “our”) is the trading name of EduNoetic Solutions Limited, a private limited company registered in England and Wales (company number 16543138). We are a tuition provider in the United Kingdom. We offer one-to-one and group tuition, exam preparation and coding lessons, online and in person.
We are the controller of the personal information described in this notice. This means we decide why and how it is used. We are responsible for it under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
- Email: contact@edunoetic.co.uk
- Phone: +44 7775423712
- Registered office and post: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Our student portal and workspace, and our online tests, are provided for us by TargetGrade, a product of Gradespace Ltd (company no. 13919800). Gradespace Ltd also builds and supports our website. It acts as our processor (see section 7).
Data protection contact
For anything about your personal information, contact us at contact@edunoetic.co.uk. Gradespace Ltd, 86-90 Paul Street, London EC2A 4NE, gives us independent data protection support.
2. The short version
- We collect only what we need to arrange and teach lessons and to run our student portal.
- For students under 18, we deal with a parent or guardian. Every email about lessons goes to them, and they get copies of class messages and assignments.
- We do not sell personal information, and we do not use it for advertising.
- Online lessons run on Zoom. A lesson is recorded only if you ask, and a recording never includes students’ cameras.
- Our website uses only the cookies it needs to work. Our visitor counts use no cookies at all.
- Our student portal, workspace and online tests are provided by TargetGrade, a product of Gradespace Ltd. Tutors can get AI mark suggestions on students’ work. A tutor always checks the suggestion, and the student’s name is never sent.
- You can ask for a copy of your information, or ask us to correct or delete it, at any time.
3. The information we collect
3.1 Parents and guardians
- Your name, email address, phone number and relationship to the student.
- What you tell us when you enquire or book: subjects, level, when suits you, online or in person, and any notes.
- Lessons, group places and packages you book, and payments or gift vouchers.
- Messages you send us, and the emails we send you. For a student under 18, these include copies of class messages, new assignments and notices that work has been marked.
3.2 Students, including students under 18
- Name, level or school year, whether the student is under 18, and (where the office records it) date of birth.
- Subjects, classes and tutors, lessons, attendance and group places.
- Notes about learning needs, such as target grades, exam dates or support needs. Please only tell us about health or additional needs when it helps us teach. This is more sensitive information, and we treat it with extra care (see section 4).
- Answers, scores and results from online tests (see section 6).
- Lesson recordings, only when you ask for one (see section 3.5).
If the student has a portal account, we also hold:
- their email address and sign-in details (passwords are stored only in scrambled, hashed form);
- their classes and subject requests;
- the class messages sent to them, and when they first opened each one in the portal;
- assignments and the work they hand in (text, links and files), with marks and feedback.
3.3 Tutors and staff
- Name, email address, phone number, subjects taught and account details.
- What you do in the staff portal: messages you send, assignments you set, marks and feedback you give, and attendance you record.
- Sign-in records in our security log (see section 10).
Recruitment and vetting records are not kept on the website. These include the Disclosure and Barring Service (DBS) check every tutor has before working with children. They are kept securely, and staff get a separate staff privacy notice that explains them.
3.4 Website visitors
- Contact form: your name, email address, subject and message.
- Newsletter: your email address, the consent wording you ticked, the date and time, and the page you signed up on.
- Visitor counts: which pages are viewed and when. These counts use no cookies and store no IP address. A visit is counted with an anonymous code that changes every day, so one day’s visits can’t be linked to the next. If your browser sends a Global Privacy Control signal, you are not counted.
- Security: when someone signs in, fails to sign in, is locked out or sends forms too often, we record the IP address, the username used and the time.
3.5 Online lessons on Zoom, and recordings
Online lessons take place on Zoom. The student joins with a meeting link we send. To run the meeting, Zoom processes the name and email address used to join, and the live audio and video.
Recordings are made only on request. A student, parent or guardian can ask us to record a lesson, for example to watch it again when revising.
- What is recorded: only the lesson itself, which means the shared screen or whiteboard and the audio. Students’ cameras are never recorded, so a recording contains no images or video of the student.
- Who can watch it: the student, their parent or guardian, and the tutor. Nobody else.
- How long it is kept: 90 days, then it is deleted. We delete it sooner if you ask.
- How to ask: tell your tutor, or email contact@edunoetic.co.uk. You can ask us to record a lesson, delete a recording or stop recording.
3.6 Where the information comes from
Most information comes from you, whether you are a parent, guardian, adult student or tutor. Some comes from our tutors (attendance, marks and feedback), and test results come from TargetGrade. Some information about students under 18 comes from their parent or guardian.
4. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Reply to enquiries and arrange the free consultation | Steps you ask us to take before entering a contract (Article 6(1)(b)). Where a parent enquires for a child, we use the child’s details on the basis of our legitimate interests in arranging the lessons the parent has asked for (Article 6(1)(f)). |
| Arrange, teach and manage lessons, groups and packages, and send confirmations and reminders | Contract with the parent, guardian or adult student (Article 6(1)(b)). For a child: our legitimate interests in teaching them (Article 6(1)(f)). |
| Run online lessons on Zoom | Contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) |
| Record a lesson when you ask | Your consent (Article 6(1)(a)), which you can withdraw at any time |
| Send parents and guardians of under-18s every lesson email, plus copies of class messages, assignments and marking | Legitimate interests: keeping parents informed and protecting children (Article 6(1)(f)) |
| Run the student and staff portals: accounts, class messages and read records, assignments, marking and feedback | Contract (Article 6(1)(b)) and legitimate interests in teaching and tracking progress (Article 6(1)(f)) |
| Online tests and results through TargetGrade | Contract (Article 6(1)(b)) and legitimate interests in assessing progress (Article 6(1)(f)) |
| AI mark suggestions on students’ work | Legitimate interests in faster, more consistent feedback, with a tutor checking every suggestion (Article 6(1)(f)). You can object at any time (see section 6). |
| Take payments and keep accounts | Contract (Article 6(1)(b)) and legal obligation under tax law (Article 6(1)(c)) |
| Send our newsletter (study tips and tutor spotlights) | Your consent (Article 6(1)(a) and PECR regulation 22). You can withdraw it at any time. |
| Answer contact form messages | Legitimate interests in replying to you (Article 6(1)(f)) |
| Keep the website secure and count visits without cookies | Legitimate interests in a safe, working website (Article 6(1)(f)) |
| Act on safeguarding concerns | Legal obligation (Article 6(1)(c)), legitimate interests (Article 6(1)(f)), or protecting someone’s vital interests (Article 6(1)(d)) |
| Deal with complaints and legal claims | Legitimate interests (Article 6(1)(f)) |
More sensitive information.
- Learning needs and health: if a parent or adult student tells us about health, disability or additional learning needs, we use it only to adapt our teaching. We rely on your consent (Article 6(1)(a)) and, because this is special category information, your explicit consent (Article 9(2)(a)). You can withdraw it at any time.
- Safeguarding: where we must act to protect a child or an adult at risk, we rely on the substantial public interest condition for safeguarding (Article 9(2)(g) and the Data Protection Act 2018, Schedule 1, paragraph 18).
Where we rely on legitimate interests, we have weighed our interests against yours, and you can object (see section 11).
5. Children’s information
Many of our students are under 18, and we take particular care with their information:
- A parent or guardian is the contact. When a student is under 18, we ask for a parent or guardian’s name, email address and phone number. Every email about lessons goes to the parent or guardian.
- Parents get copies. A parent or guardian gets a copy of each portal account email (without the private sign-in link), each class message and each new assignment. They are also told when work has been marked.
- Read records stay in the portal. The portal records when a student first opens a class message, and how often, so tutors can see who has read it. Our emails contain no tracking pixels and no personal tracking links, so opening an email tells us nothing.
- No marketing to children. Our newsletter is for adults: parents, guardians and adult students.
- Recordings never show students. A recorded lesson contains only the shared screen or whiteboard and the audio.
- Portal pages for students show no cookie banner, because they use only the cookies needed to sign in.
- Staff previews. Office staff can view the portal as a particular student to check what they see. A preview is read-only, so nothing can be sent or changed. It lasts at most 30 minutes, it doesn’t mark anything as read, and every preview is recorded in our security log.
- The student’s own rights. Students aged about 12 or over are usually mature enough to exercise their own data protection rights. For younger children, a parent or guardian normally acts for them.
- No automated decisions. No decision about a child, or anyone else, is made by a computer alone.
Where it applies to our online services, we follow the ICO’s Age Appropriate Design Code (the Children’s Code).
6. Online tests and AI mark suggestions
Online tests. Our online tests run on TargetGrade, a product of Gradespace Ltd, which acts as our processor.
- To give a student access, we send TargetGrade their name, email address, classes and subjects. We send tutors’ names, email addresses and subjects so they can set and mark tests.
- Answers and full results are held in TargetGrade. Our website keeps a summary of each result, such as the score and when the test was taken.
- Results are kept while the student is with us. They are deleted when you ask, or within 12 months of the student leaving. Deleting a student’s information from our website doesn’t remove their TargetGrade account automatically, so we ask Gradespace Ltd to delete that too.
Attendance, behaviour, files and results for parents. These are kept in TargetGrade too, as part of the same service.
- Attendance and behaviour: when a tutor takes the register, it is recorded in TargetGrade as well. Tutors can also note how a student did in a lesson (participation, attitude, homework, punctuality and a short note). The student and their tutors can see both.
- Files handed in for a test: photos or files a student hands in for a test, including the pages of a paper test, are kept in TargetGrade for their tutors to mark.
- Exam mode: some tests run full screen. Each time a student leaves the test, for example by switching to another tab, the time is recorded and their tutor sees it. No camera or microphone is used.
- Results for parents: a tutor or the office can email a parent or guardian a private link to a page with their child’s released results, attendance and behaviour. The link works for 30 days and can be withdrawn at any time. We keep only a scrambled fingerprint of it, never the link itself.
- Opening TargetGrade: students and tutors signed in to our portal can open their own TargetGrade account from it without a second password. When they do, our website asks TargetGrade for a sign-in link that works once, within a minute, and TargetGrade records the sign-in. No other information about them is sent.
AI mark suggestions. Tutors can ask TargetGrade for a suggested mark and feedback on a student’s written work.
- What is sent: the task or question brief and the student’s work. They go through TargetGrade to its AI provider, OpenAI, which is a sub-processor of Gradespace Ltd. The student’s name and email address are not sent.
- Not stored, not used for training: TargetGrade does not keep the work or the suggestion for this feature. Under OpenAI’s standard API terms, the content is not used to train AI models. OpenAI may keep it for up to 30 days to monitor for abuse, and then deletes it.
- A tutor decides: the suggestion is only a suggestion. A tutor always reads it and decides the mark and feedback.
- It is switched on, including for students under 18.
- Leaving your work out: a parent or guardian, or an adult student, can ask for the student’s work to be left out of AI suggestions. Email contact@edunoetic.co.uk or tell your tutor. We note the request on the student’s record, and their tutors then mark that student’s work without AI suggestions.
7. Who we share information with
We share personal information only with the organisations below, and only as much as each needs. Each one is bound by a contract that requires it to protect the information. We never sell personal information.
Service providers (processors). These organisations act only on our instructions:
| Organisation | What they do for us | Where the data is |
|---|---|---|
| Gradespace Ltd, 86-90 Paul Street, London EC2A 4NE (company no. 13919800) | Under a data processing agreement: provides TargetGrade, its product, for our student portal, workspace and online tests, including AI mark suggestions through its AI provider (OpenAI, below); builds, maintains and supports the hosting of our website; and gives us data protection support. | United Kingdom. Website and portal data are held on our hosting server (Namecheap, below). |
| Namecheap, Inc. | Web hosting: the server our website, portal and their database run on | United States |
| Zoom Video Communications, Inc. | Online lessons, and recordings when you ask for one, under Zoom’s standard data processing terms | United States |
| Brevo (Sendinblue SAS) | Delivers the website’s emails. If we move our newsletter list to Brevo, it will also hold that list. | European Union (France) |
| OpenAI (a sub-processor of Gradespace Ltd for TargetGrade) | AI mark suggestions | United States |
| Google (Firebase) | Hosted our previous website. Its data has been moved to this website and the old system retired. What remains there is deleted within 60 days of the move. | United States and European Union |
| Our card payment provider, when you pay by card | Processes card payments. We never see or store your full card details. | As set out in the provider’s terms |
Others we may share with:
- Our tutors, so they can teach. Each tutor sees only the students and subjects they teach, and all our tutors are bound by confidentiality and data protection terms.
- Professional advisers, such as accountants, insurers and lawyers.
- HM Revenue & Customs and other authorities, where the law requires it.
- Children’s social care, the police or a local authority designated officer, if we have a safeguarding concern.
WhatsApp and other links. A WhatsApp button on our website is only a link. Nothing is shared with WhatsApp unless you choose to message us there, and then WhatsApp’s own privacy policy applies. The same is true of map and social media links. We don’t embed maps, videos or social media feeds that track you.
8. International transfers
Some of our providers are in the United States: Namecheap hosts our website and portal there, Zoom runs our online lessons there, and OpenAI processes AI mark suggestions there.
When personal information leaves the UK, it is protected by an approved safeguard. Depending on the provider, this is one of:
- the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework), where the provider is certified under it;
- the UK International Data Transfer Agreement;
- the UK International Data Transfer Addendum to the EU standard contractual clauses.
Transfers to Brevo in the European Union are covered by the UK’s adequacy regulations for the EEA. You can ask us for details of the safeguard that applies.
9. How long we keep information
Our website removes or reviews information automatically, using the settings below:
| Information | How long we keep it |
|---|---|
| Enquiries and contact form messages | Reviewed 12 months after they arrive. Deleted then, unless they became a student record or are still needed. |
| Newsletter sign-up | Until you unsubscribe. We keep a record of your consent and of your unsubscribing, so we don’t email you again. |
| Student records, with parent or guardian details, attendance, group places and packages | Reviewed 24 months after the student’s last activity with us, and deleted then unless there is a recorded reason to keep them. When a record is deleted, past lessons stay in our timetable with the personal details removed. |
| Portal accounts, class memberships and subject requests | Until the student’s record is deleted. The account is closed at the same time. |
| Class messages and their read records | Until the student’s record is deleted |
| Handed-in work, files, marks and feedback | Deleted automatically 24 months after the work is handed in |
| Lesson recordings (made only on request) | 90 days, then deleted. Sooner if you ask. |
| Account invitation links | Valid for 7 days. Removed 30 days after they are used or expire. |
| Online test results (in TargetGrade, and their summary on our website) | While the student is with us. Then deleted when you ask, or within 12 months of the student leaving. |
| Private results links for parents | 30 days, or until withdrawn. Only a scrambled fingerprint of the link is kept. |
| Work sent for AI mark suggestions | Not stored by TargetGrade. Up to 30 days at OpenAI for abuse monitoring. |
| Payment records and accounts | 6 years, as HMRC requires |
| Safeguarding records | As long as statutory guidance requires |
| Email log (recipient, subject, whether it was sent) | 90 days |
| Security log (IP address, username, time) | 30 days. Automatic blocks of suspicious IP addresses last 7 days. |
| Visitor counts (no cookies, no IP address) | 400 days |
| Your cookie choice | 6 months, on your own device |
| Data on our previous website (Google Firebase) | Deleted within 60 days of the move to this website |
We may keep information for longer if the law requires it, or if it is needed for a complaint or legal claim.
10. How we keep information safe
- The whole website uses encrypted connections (HTTPS).
- Each person sees only what their role needs. Tutors see only the students and subjects they teach.
- Handed-in files are kept in a private folder that can’t be reached from the internet. They get random names and are checked to be the type they claim to be. They are shown only to someone who is signed in and allowed to see them.
- Sign-in links in invitations expire after 7 days. We store them only in scrambled (hashed) form.
- Repeated failed sign-ins lead to a lockout. Suspicious addresses are blocked automatically, and sign-ins are recorded in a security log.
- Our emails contain no tracking.
- Gradespace Ltd keeps the website software up to date. Our host makes regular backups and keeps them securely.
If a personal data breach is likely to put people at risk, we will report it to the ICO within 72 hours. If the risk is high, we will also tell the people affected.
11. Your rights
You have the right to:
- access your information and get a copy of it;
- correct information that is wrong or incomplete;
- delete your information (the “right to be forgotten”), where we have no good reason to keep it;
- restrict how we use it while a concern is looked into;
- object to uses based on legitimate interests, including AI mark suggestions;
- data portability: get the information you gave us in a format a computer can read;
- withdraw consent at any time, where we rely on consent (for example, for the newsletter or lesson recordings). This doesn’t affect what we did before.
How to use your rights. Email contact@edunoetic.co.uk or write to us at our registered office. Parents and guardians can make requests for children too young to act for themselves. We may ask you to confirm who you are. We reply within one month. In some cases the law lets us take up to two months more, and if so we’ll tell you why. It is free.
Getting a copy of your information. Students can see their messages, assignments, work, marks and feedback in the portal at any time. For a complete copy, ask us, and we will produce a single file with our website’s privacy export tool. It includes:
- the student record and parent or guardian details;
- lessons, attendance, packages and group places;
- the portal account and classes;
- class messages, with when each was first opened;
- handed-in work, with marks and feedback;
- subject requests and contact form messages;
- bookings, and any payments or gift vouchers.
We can also ask Gradespace Ltd for your TargetGrade data.
Deleting your information. When you ask us to delete your information, we use our website’s privacy erase tool:
- It deletes the student record, together with the portal sign-in, class memberships, read records, handed-in work and files, attendance and subject requests.
- It removes personal details from past lessons.
- We also ask Gradespace Ltd to delete the TargetGrade account, and we delete any lesson recordings.
We may need to keep some records, such as payment records for tax. If so, we will tell you.
Newsletter. Every newsletter email has an unsubscribe link, or you can simply email us.
12. Complaints
If you are unhappy with how we have used your information, please tell us first, and we will try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
13. Other websites
Our website links to other websites, such as WhatsApp, Google Maps and social media. Their own privacy policies apply when you visit them.
14. Changes to this notice
We update this notice when our services or the law change. The date at the top shows the latest version. If we make a significant change to how we use your information, we will tell families and students with portal accounts by email.
15. Contact us
For any question about your privacy, or to use your rights, contact us at contact@edunoetic.co.uk or +44 7775423712.