Privacy Notice
This notice explains what personal information DATUM Learning collects, why we collect it, what we do with it and what rights you have. It applies to parents and guardians, to students we tutor, and to tutors who apply to work with us.
1. Who we are
1.1 DATUM Learning is a trading name of Sarah Kuti, a sole trader based in Cardiff. We provide in-person GCSE mathematics tutoring.
1.2 For the purposes of UK data protection law, Sarah Kuti trading as DATUM Learning is the data controller for the personal information described in this notice. That means we decide what information is collected and what happens to it, and we are responsible for it.
1.3 We are not required to appoint a Data Protection Officer. Sarah Kuti is personally responsible for data protection matters and is the person to contact about anything in this notice.
1.4 Contact: hello@datumlearning.co.uk, 4th Floor, 14 Museum Place, Cardiff CF10 3BH, or telephone 07849 117611.
2. Information we collect about parents and students
2.1 When you register a student with us, we collect:
| Category | What this includes |
|---|---|
| Contact and identity | Parent or guardian name, relationship to the student, email address, mobile number, home address and postcode. |
| About the student | Name, preferred name, date of birth, school, year group and maths set. |
| Emergency contact | Name, relationship and telephone number of an emergency contact. |
| Academic | Exam board, expected tier, unit-by-unit timing, tier, results and series, most recent grade, target grade and exam dates. |
| Access arrangements | Whether the student has extra time, a reader, a scribe, a separate room or supervised breaks, and the status of any application. |
| Health and learning needs | Additional learning needs, medical information, allergies, and anything you tell us about concentration or attention. See section 3. |
| Context | Why you are seeking tutoring now, what the student finds hardest, any previous tutoring, and what a good outcome looks like to you. |
| The student's own view | How the student feels about maths, what they find hardest and what they want to achieve, where they choose to tell us. |
| Practical | Preferred and unavailable times, session location, travel notes and how you heard about us. |
| Records of your consent | Which consents you gave, and when. |
| Signature | Your signature, printed name and the date on the registration form. |
2.2 During tutoring we also generate information about the student: diagnostic assessment results, scores across the six assessment areas we use, working pace, teaching plans, session records, attendance and progress reports.
2.3 We keep records of payments, correspondence with you, and any complaint or safeguarding concern raised.
3. Health and additional learning needs information
3.1 Information about a student's health, disability or additional learning needs is “special category data” under the UK GDPR. It is given extra protection in law, and we treat it accordingly.
3.2 We collect it for one reason: so that tutoring and diagnostic assessment can be adapted appropriately, and so that a tutor working alone with a student knows about anything relevant to their safety, such as an allergy or a medical condition.
3.3 Our lawful basis for processing it is your explicit consent under Article 9(2)(a) of the UK GDPR, which you give by completing the relevant section of the registration form. Providing this information is optional. You can register a student without it, and we will not refuse the service if you would rather not share it — though we may not be able to adapt the tutoring in ways that depend on knowing.
3.4 You can withdraw that consent at any time by contacting us. Withdrawing it does not affect anything already done on the basis of it. If the information is relevant to delivering a session safely, we will talk to you about what withdrawing it means in practice before acting on it.
3.5 Where we process this kind of information because we need to protect a child from harm rather than because you have consented, we rely on the substantial public interest condition for safeguarding children in paragraph 18 of Schedule 1 to the Data Protection Act 2018. This is covered by our Appropriate Policy Document (section 6).
4. Information we collect about tutors
4.1 When you apply to tutor with us, we collect your name, email address, telephone number and postcode; your right-to-work status; details of your mathematics or STEM background and your teaching or tutoring experience; confirmation that you can provide references, identification, insurance and self-employed status with your own UTR; your availability, how you travel and how far; and anything else you choose to tell us.
4.2 If we take your application forward we also collect your references, proof of identity and right to work, evidence of your insurance, and information about your DBS check as described in section 5.
4.3 Our lawful basis for most of this is that the processing is necessary for a contract with you, or to take steps at your request before entering one. For the vetting checks, we also rely on our legitimate interests in safeguarding the children we place tutors with, and in meeting our obligations as an organisation arranging work with children.
5. DBS checks and criminal record information
5.1 Information about criminal convictions, cautions and barred-list status is treated separately and more strictly under Article 10 of the UK GDPR. It is not ordinary personal data and we handle it accordingly.
5.2 We require every tutor to hold an Enhanced DBS check including a check against the Children's Barred List, and to be registered with the DBS Update Service. Since 21 January 2026, self-employed people have been able to obtain these checks themselves through a DBS umbrella body.
5.3 We do not keep a copy, photocopy, scan or photograph of any DBS certificate. We view the original certificate, and we then record only: the certificate number, the date it was issued, the level of the check, the date we saw it, and whether we considered the applicant suitable. Where a tutor is on the Update Service, we record the date and outcome of each online status check we carry out with their permission.
5.4 Our condition for processing this information is the substantial public interest condition for safeguarding children in paragraph 18 of Schedule 1 to the Data Protection Act 2018. As that condition requires, we maintain an Appropriate Policy Document explaining how we comply with the data protection principles and how long we keep this information.
5.5 We do not share DBS information with parents or any third party. If a parent asks whether a tutor has been checked, we confirm that the required checks have been completed — nothing more.
5.6 If we ever have to stop a tutor working with us because of conduct that harmed or risked harm to a child, the law may require us to make a referral to the Disclosure and Barring Service under section 35 or 36 of the Safeguarding Vulnerable Groups Act 2006. We would do so, and this would involve sharing relevant personal information with the DBS.
6. Our Appropriate Policy Document
6.1 Where we process special category data for safeguarding purposes, or criminal offence data, the Data Protection Act 2018 requires us to keep an Appropriate Policy Document. It explains how we comply with the data protection principles when handling that information and how long we keep it.
6.2 We keep that document under review and will provide a copy free of charge on request, and to the Information Commissioner if asked.
7. Why we are allowed to use your information
7.1 We must have a lawful basis for everything we do with personal information. Ours are:
| What we do | Lawful basis |
|---|---|
| Respond to your enquiry before you register | Legitimate interests — responding to someone who has contacted us |
| Assess the student, match a tutor, plan and deliver tutoring, write reports | Necessary for our contract with you |
| Take payment and keep financial records | Necessary for our contract with you, and our legal obligation to keep tax records |
| Use health, disability or additional learning needs information to adapt tutoring | Your explicit consent — Article 9(2)(a) UK GDPR |
| Vet tutors (references, identity, right to work, insurance) | Necessary for our contract with the tutor, and our legitimate interest in safeguarding children |
| Process DBS and barred-list information | Article 10 UK GDPR, with the safeguarding condition in Schedule 1 paragraph 18 of the Data Protection Act 2018 |
| Act on a safeguarding concern, including reporting it | Our legal obligations and the safeguarding condition in Schedule 1 paragraph 18; and, where necessary, protecting someone's vital interests |
| Defend a complaint, dispute or chargeback | Legitimate interests — establishing, exercising or defending legal claims |
7.2 Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can ask us for the details of that assessment, and you can object to processing on that basis — see section 12.
8. Where we get information from
8.1 Almost everything we hold comes directly from you — through our online forms, the registration form, email, telephone or conversation.
8.2 We also receive information from: the referees a tutor nominates; the DBS Update Service, when we check a tutor's status with their permission; and, occasionally, from a student's school where you have asked us to liaise with them.
8.3 We do not buy personal information, and we do not obtain it from data brokers or social media profiling.
9. Who we share information with
9.1 Your tutor. We share with the matched tutor only what they need to teach the student safely and effectively: contact details for arranging sessions, the diagnostic results and teaching plan, and any health, allergy or access information relevant to the sessions. Tutors are contractually required to keep this confidential, to use it only for teaching your child, and to return or delete it when the arrangement ends.
9.2 Service providers. We use a small number of providers who process information on our instructions:
| Provider | What for | Where data is held |
|---|---|---|
| Tally | Online enquiry and application forms | European Union |
| Google (Gmail) | Email correspondence | United Kingdom and European Union |
| Square | Appointment booking and card payments | United Kingdom, with transfers outside it under approved safeguards |
| Netlify | Website hosting | Delivered from servers worldwide, under approved safeguards |
9.3 Safeguarding and legal. We will share information with Cardiff children's services, the police, or the Disclosure and Barring Service where we have a safeguarding concern or a legal duty to do so. We may also share information where we are required to by law, or to establish or defend a legal claim.
9.4 Professional advisers. We may share information with our accountant, insurer or legal advisers where necessary.
9.5 If we add or change a provider we will update this notice. We do not sell personal information, and we do not share it with anyone for their own marketing.
10. Sending information outside the UK
10.1 Our form provider stores submissions on servers in the European Union. Some of our other providers may process information outside the UK.
10.2 Where information leaves the UK, we rely on the UK's adequacy regulations where they apply, or on the International Data Transfer Agreement or Addendum approved by the UK government. You can ask us for details of the safeguards in place for any particular transfer.
11. How long we keep information
11.1 We keep information only as long as we need it. Our periods are:
| Information | Kept for | Why |
|---|---|---|
| Enquiries that do not lead to a booking | 12 months | In case you come back to us |
| Student records, plans, assessments and reports | Until tutoring ends, then 3 years | So we can respond to questions about work we did, and defend any claim |
| Financial and contractual records | 6 years from the end of the tax year | HMRC record-keeping requirements |
| Safeguarding records and concerns | Until the student turns 25, or longer where an investigation requires it | Safeguarding records may be needed long after the event |
| Unsuccessful tutor applications | 12 months | In case a suitable opportunity arises, unless you ask us to delete sooner |
| Engaged tutor records, including DBS check details | Duration of the engagement, then 6 years | Insurance, tax and safeguarding audit |
| Consent records | As long as we rely on the consent, then 6 years | To show we obtained consent properly |
11.2 When a retention period ends we delete the information securely, or anonymise it so that it can no longer identify anyone.
12. Your rights
12.1 You have the right to:
be informed about how we use your information — that is what this notice is for;
access a copy of the information we hold about you;
rectification — have inaccurate information corrected or incomplete information completed;
erasure — ask us to delete information where we no longer need it, though we cannot delete safeguarding or financial records we are required to keep;
restrict processing — ask us to pause how we use information while a concern is resolved;
object to processing we carry out on the basis of legitimate interests;
data portability — receive information you gave us in a portable format, where processing is based on consent or contract and carried out by automated means; and
withdraw consent at any time, where we rely on it.
12.2 To exercise any of these, email hello@datumlearning.co.uk. We will respond within one month. We will not charge you, and we will not ask why you are asking.
12.3 We may need to confirm your identity before releasing information, particularly where a request concerns a child.
12.4 We do not make any decision about you or the Student by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects. Our diagnostic assessments are marked and interpreted by people.
13. Children's information
13.1 Our students are under 18. The parent or guardian who registers a student provides their information, gives any consent needed on their behalf, and receives this notice.
13.2 Children have their own data protection rights, and as they get older they become more able to exercise them for themselves. A student who wants to know what we hold about them, or wants something corrected, can ask us and we will explain it in a way that makes sense to them. Depending on their age and understanding, we may deal with them directly rather than through their parent.
13.3 We collect the minimum we need about a student, and we do not use children's information for marketing of any kind.
14. Keeping information secure
14.1 We take practical steps proportionate to a small business handling sensitive information about children:
accounts protected by strong, unique passwords and two-factor authentication where available;
providers chosen because they encrypt information in transit and at rest;
access limited to what each tutor needs for the student they teach;
paper registration forms kept secure and not left where others can read them, and destroyed securely once transferred to our records;
no DBS certificate copies retained, as explained in section 5.
14.2 If a breach of personal information occurs that is likely to result in a risk to anyone's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will tell you directly and without undue delay.
15. Marketing
15.1 We may send you information about our own tutoring services by email where you are an existing customer or have asked us to, and every message will include a way to stop receiving them.
15.2 We never send marketing to a student, and we do not pass your details to anyone else for marketing.
16. Our website and cookies
16.1 Our website does not set analytics or advertising cookies, and we do not track visitors. Where a page includes a form provided by Tally, that form may set cookies necessary for it to work. If we ever add analytics, we will ask for your consent first.
17. Complaints
17.1 If you are unhappy with how we have handled your information, please tell us first — hello@datumlearning.co.uk — so that we can try to put it right.
17.2 You also have the right to complain to the Information Commissioner's Office at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Helpline 0303 123 1113 · ico.org.uk
18. Changes to this notice
18.1 We review this notice at least once a year, and whenever we change how we work. The version number and date at the top show when it was last updated. Where a change is significant, we will tell you directly rather than relying on you to notice.