Privacy Notice
Updated 4 November 2026
Who we are
Green Business Tools Ltd, trading as Out of School, is registered in England and Wales, company number 17467760, at 297 Green Lane, Redbridge, London IG3 9TL. We are responsible as controller for personal information where we decide its purposes and use. Contact our Admin Team for privacy or safeguarding enquiries at parents@out-of-school.net.
This notice covers our public website, learning accounts, parent subscriptions, tutor applications and tuition support. A school or council arrangement may need additional privacy information explaining its respective responsibilities.
Information we use
Parents and guardians: names, contact and account details, child-account links, subscription and booking records, payment references and support correspondence. Children: first name, year group, assigned work, responses, completion, accuracy, time on tasks and progress or lesson notes. Tutors and applicants: contact details, applications, CVs, qualifications and relevant identity, address, right-to-work and safeguarding verification information. We also process operational security logs and privacy choices.
Payment providers process payment details through their approved payment screens. Do not send card details, passwords, children's medical records or identity documents through general enquiries or ordinary learning notes. Ask the team for the appropriate secure document process.
Why we use information and our lawful bases
We use information to operate accounts, provide learning and progress reports, manage subscriptions and lessons, review tutor suitability, answer questions, maintain security, keep financial records and respond to safeguarding concerns.
We rely on contract necessity for the adult customer or tutor arrangements where applicable; legitimate interests for proportionate child learning support, service administration, security and suitability review; legal obligations where applicable; and consent for optional analytics. We consider children's interests and rights when relying on legitimate interests. Consent to an optional activity can be withdrawn without affecting the lawfulness of earlier processing.
SEND health information and criminal-record or DBS information require additional legal conditions. We assess necessity and the applicable condition before processing such information and use an appropriate secure process. Contact us before sending it. A general sign-up or privacy acknowledgement is not blanket consent for sensitive information.
Learning personalisation
Learning results are analysed to identify strengths, gaps and practice needs and to support parent and tutor review. This performance-based personalisation uses the child's learning information. It is educational support, not a clinical diagnosis or a promise of exam results. Contact the team to question a recommendation or ask for human review.
Who can receive information
Parents or guardians and authorised tutors can receive the information needed for the child's learning support. Our authorised staff and service providers support hosting, storage, payment processing, communications, security and analytics. Current providers include DigitalOcean for hosting and data storage (servers in London, UK), Stripe for payment processing, Amazon Web Services (Amazon SES, EU Stockholm region) for account, homework and booking emails, and Google Analytics for optional public-website analytics. Provider processing is subject to its role and applicable privacy terms. We do not sell personal information.
We may disclose necessary information to professional advisers, regulators, law enforcement or safeguarding bodies where there is a lawful reason. Information must not be shared for unrelated marketing or publicity without the required permission. Contact us for details of the providers, recipients and processing relevant to your account.
International processing
Service providers may process information outside the UK. Where a restricted international transfer is involved, it must use an applicable adequacy regulation or other lawful safeguard, such as approved contractual protections with the required assessment. Contact the Admin Team for information about the destination and safeguards applicable to your information, including how to request relevant details. We do not promise that all providers store information only in the UK.
Lessons, duration evidence and recordings
Tutors provide a screenshot of the call-duration display after the lesson ends as supporting lesson evidence. Capture only what is needed to establish the relevant call and duration; exclude children's faces, messages and unnecessary identifiers. Do not upload a lesson recording as routine duration evidence.
Recording requires prior written parent or guardian permission and Out of School approval. Before recording, explain its purpose, storage, access and deletion arrangements, and explain it to the child appropriately. Any approved recording is held securely by the tutor as lesson evidence and deleted within 30 days of the lesson. It must not be used for publicity. Any exceptional preservation for an active complaint, safeguarding matter or legal obligation must be referred to the Admin Team for a documented lawful decision and review date. Accepting our service terms does not itself give recording permission.
How long information is kept
We keep personal information only for as long as we need it. These are our maximum periods; we delete or anonymise information sooner when it is no longer needed.
| Information | How long we keep it |
|---|---|
| Parent account and child learning records (work, answers, progress, notes) | While the account is open, then deleted within 12 months after it closes or after 12 months with no sign-in. |
| Payments, subscriptions, lesson bookings, refunds and tutor earnings records | 6 years after the end of the financial year they relate to (HMRC record-keeping rules). |
| Tutor applications that do not go ahead | 6 months after our decision. |
| Copies of tutor identity, address and right-to-work documents | Only while we check them, then deleted within 6 months of our approval decision. We keep a short record that the check was done (date, document type and who checked it) while the tutor works with us and for 2 years after. |
| DBS certificate information | We do not keep copies longer than needed: deleted within 6 months of our decision, in line with DBS guidance. We keep only the date of issue, certificate number, type of check and our decision while the tutor works with us and for 2 years after. |
| Tutor agreement and approval decision | While the tutor works with us and for 6 years after (contract and tax records). |
| Lesson call-duration screenshots | 6 months after the lesson (to settle payment questions and disputes). |
| Approved lesson recordings | Deleted within 30 days of the lesson, as explained above. |
| Safeguarding concerns | Kept separately and securely for as long as child-protection guidance requires, and reviewed every year. |
| Enquiries and support emails | 12 months after the last message, unless needed for a complaint or safeguarding matter. |
| Lesson emails waiting to be sent | Deleted 30 days after sending (90 days if they could not be sent). |
| Website and security logs | Up to 12 months. |
| Backup copies | Overwritten within 14 days. Any separate monthly off-site backup copies are kept for up to 12 months, then deleted. |
We may keep something longer only where the law requires it, or for an open complaint, dispute, safeguarding matter or legal claim; we then record the reason and review it. You can ask us to delete information sooner, and we will explain if a legal reason stops us.
Cookies, analytics and your choices
Necessary cookies and similar storage support sign-in, security and remembering privacy choices. The public website offers optional Google Analytics, which loads after analytics acceptance. You can reject optional analytics and still use the core service. Google Analytics may use browser/device and usage information; its cookies commonly include names beginning _ga. Exact storage depends on the service and configuration.
You can turn off optional public-site analytics with the button below. This stores your rejection and reloads this page. Browser settings can also clear cookies and site storage; clearing consent storage may cause the banner to ask again. Learning-app sign-in cookies are separate from the public website's analytics choice.
Your rights and complaints
Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing, including processing based on legitimate interests. You may withdraw consent where we rely on it. These rights have legal conditions and exceptions. A parent can help a child exercise rights, taking account of the child's understanding and interests. We may need to verify identity before releasing information.
Contact parents@out-of-school.net. You may also complain to the Information Commissioner's Office. If you do not supply information necessary for an account, payment, suitability check or agreed service, we may be unable to provide that service; optional analytics and recording permissions are separate choices.
For children
We remember the work you do here so you, your parent and your tutor can see what you are learning and what to practise next. People who help with your learning or keep the service safe may need to see it. Do not put private information about yourself or other children into ordinary notes or questions. Ask your parent to contact us if something is wrong or you want to know more.
Changes
We update this notice when our processing changes and provide further notice where required. This notice does not enable a planned service or override the permissions required before a lesson or recording. Read our parent terms and tutor terms for the applicable service arrangements.