Privacy, cookies & safeguarding

Privacy Policy

Data controller

Compass 13 Ltd (Company No. 12273967), registered at 320 Firecrest Court, Centre Park, Warrington, WA1 1RG, is the data controller for the personal data described in this policy. Where a school determines how pupil data is used within its own programme, the school and STEM Tutoring may act as joint or independent controllers as set out in the school agreement.

Student data

We may process a student name, year group, school, class information, account details, lesson attendance, quiz scores, homework completion, exam practice results and relevant support information shared by a parent or school.

Parent and school data

We may process parent contact details, billing information, communication history, school contact details, teacher account information and agreed reporting information connected to a purchased service or school partnership.

Why we use data

We use personal data to create accounts, deliver live and recorded learning, manage payments, track progress, provide support, protect the platform, respond to enquiries and meet legal or safeguarding obligations.

Lawful bases

We usually process data because it is necessary to provide the service (contract), because we have a legitimate interest in running the platform safely and improving it, because the law requires it (legal obligation), or because consent has been given for optional communications and non-essential cookies.

Recording of live lessons

Live masterclasses may be recorded for catch-up access, quality assurance and safeguarding. We rely on our legitimate interests in education quality and learner safety, balanced against learner privacy, and we provide clear notice before sessions are recorded. Recordings are access-controlled and retained in line with the retention period below.

No sale of data, no child marketing

We do not sell personal data. We do not use students’ data for direct marketing and we do not build behavioural advertising or marketing profiles of student users.

Trusted providers

We may share limited data with trusted service providers such as hosting, video delivery, the learning platform, email and payment providers. These providers act on our instructions and may only use the data for the purpose agreed with STEM Tutoring.

International transfers

Where a provider processes data outside the UK, we ensure an appropriate safeguard is in place, such as UK ‘adequacy’ regulations or the ICO’s International Data Transfer Agreement or Addendum, so that your data remains protected.

Data storage and retention

Data is stored securely and kept only for as long as needed. As a standard rule, learner activity data is retained for 6 months after the relevant lessons have been completed, after which it is deleted or anonymised, unless a longer period is required for legal, financial or safeguarding reasons. Schools are responsible for, and are encouraged to delete, the data held within their own school account when it is no longer needed.

Data protection impact assessments

Because we process children’s data, we complete and maintain a Data Protection Impact Assessment for higher-risk processing, in line with the Children’s Code.

Your rights

Parents, students where appropriate, staff and school contacts can ask to access, correct, delete or restrict use of their personal data, or object to certain processing, where the law allows. Requests should be sent to dataprotection@stemtutoring.co.uk.

Complaints

Data protection concerns should be raised with us first at dataprotection@stemtutoring.co.uk. Individuals also have the right to contact the Information Commissioner’s Office at ico.org.uk.