Last updated: 17 August 2026
Privacy at a glance
Zoë Huggett Tutorials collects only the personal information needed to answer enquiries, provide tuition, manage the business, operate this website and meet legal obligations.
I do not sell personal information or use student information for my own behavioural profiling or marketing.
Non-essential cookies and personalised advertising are controlled through the consent choices displayed on the website. You can change those choices at any time.
If you are a student, you have your own data protection rights, even if a parent or guardian arranged your tuition.
Who I am
The data controller is Zoë Huggett, a sole trader trading as Zoë Huggett Tutorials.
Website: https://zhtutorials.com
Privacy and data protection enquiries: zoe@zoehuggetttutorials.co.uk
This policy applies to website visitors, people making enquiries, students, parents and guardians, and customers whose details I receive in connection with my services.
Personal information I may collect
Depending on how you interact with me, I may collect:
- your name, email address, telephone number and other contact details;
- the name and contact details of a parent or guardian;
- a student’s age or year group, subjects, examination board, learning goals and availability;
- lesson arrangements, attendance, homework, lesson notes and relevant correspondence;
- information about learning needs, disabilities, health or safeguarding where it is relevant and has been provided to me;
- invoice, payment and transaction information, although I do not receive or store full payment-card details;
- information included in contact-form submissions, emails or other messages;
- order information supplied through Buy Me a Coffee where needed to deal with a purchase or customer enquiry;
- website information such as IP address, browser and device information, pages visited, referral information, cookie choices and advertising information; and
- information needed to investigate a complaint, protect the website, prevent fraud or meet a legal obligation.
I normally receive this information directly from you, a student’s parent or guardian, TutorBird, Buy Me a Coffee or through the website. Some technical information is generated automatically when the website is used.
How and why I use personal information
Enquiries
I use contact details and the contents of an enquiry to respond, discuss possible tuition and take steps requested before entering into a contract.
The lawful bases are taking steps before a contract and my legitimate interest in responding to genuine enquiries and operating my tutoring business.
Providing tuition
I use student and parent information to arrange and deliver lessons, communicate about tuition, provide feedback, set and review work, maintain appropriate teaching records, administer the TutorBird portal and manage the tutoring relationship.
Where the person entering into the tuition agreement is the student, the lawful basis is performance of a contract. Where a parent or guardian enters into the agreement, I rely on the contract for their information and my legitimate interest in using the student’s information to provide the requested tuition.
Learning needs, health and safeguarding information
You may choose to tell me about a disability, learning need, health matter or safeguarding concern where this is relevant to tuition. I use this information only when necessary to make suitable adjustments, support the student or respond appropriately to a safeguarding concern.
Where this is special-category information, I normally rely on explicit consent. In an urgent situation, or where safeguarding action is necessary, I may process or share relevant information where the law allows this to protect the vital interests or safety of the student or another person.
Administration, invoices and payments
I use contact, invoicing and transaction records to administer bookings, issue invoices, record payments, maintain accounts and deal with queries.
The lawful bases are performance of a contract, compliance with legal obligations such as tax and accounting requirements, and my legitimate interest in maintaining accurate business records.
Website operation, security and spam prevention
I use limited technical information to operate and secure the website, remember privacy choices, prevent misuse and filter spam.
The lawful bases are my legitimate interests in maintaining a secure and functional website and, where cookies or similar technologies require it, consent.
The contact form is provided through Jetpack Forms. Form submissions are stored in the website database and sent to me by email. Akismet may receive the submission, IP address, user agent, email address and message to check for spam.
Advertising and cookies
This website is funded partly by Google AdSense advertising. Google may process technical, consent and advertising information to deliver, secure and measure advertisements.
Personalised advertising and non-essential storage are used only where the appropriate consent has been given. If consent is refused, limited or contextual advertisements may still appear without using the refused purposes.
Where consent is required, consent is the lawful basis. Where limited technical processing is permitted without consent, I rely on legitimate interests in funding, operating and securing the website, balanced against visitors’ rights.
More information is provided in the Cookie Policy: https://zhtutorials.com/cookie-policy/
Children and young people
The website and tuition services are primarily intended for A-level students, who are normally aged 16 or over. They are not directed at children under 13.
Where a student is under 18, a parent or guardian may provide information and enter into the tuition agreement. I may communicate with the student and parent or guardian as appropriate for the tuition relationship and the student’s age and understanding.
Children have their own data protection rights. A sufficiently mature student may exercise those rights themselves. A parent or guardian may act for a student where authorised, where the student does not have sufficient understanding, or where this is clearly in the student’s best interests.
I do not record Zoom tuition sessions.
Who receives personal information
Where necessary, information may be processed by:
- WordPress.com and Automattic, which provide website hosting and services including Jetpack Forms and Akismet;
- TutorBird, which I use for student administration, scheduling, records, invoicing and the student portal;
- Zoom, which I use to provide online tuition;
- email, cloud-storage and other IT service providers;
- Google, which provides AdSense advertising and the Google consent-management system;
- CookieYes, which manages general cookie choices and consent records;
- Buy Me a Coffee, which independently processes purchases made through its service and may provide me with relevant customer or order information;
- social-media and embedded-content providers when their content or links are used;
- professional advisers, insurers or accountants where necessary; and
- HM Revenue & Customs, regulators, courts, law-enforcement bodies or safeguarding authorities where disclosure is required or permitted by law.
TutorBird acts as a processor for the student, billing and customer information held in my TutorBird account. Other providers may act as processors, independent controllers or both, depending on the service involved.
I do not sell or rent personal information.
Links and content from other websites
The website contains links to TutorBird, Buy Me a Coffee, Zoom, social-media platforms and other external websites. It may also display content hosted by services such as Instagram, Gravatar or WordPress.com.
Those providers may receive technical information such as your IP address when content loads or when you follow a link. Their own privacy policies apply to their processing.
International transfers
Some service providers, including TutorBird, Google, Automattic, Zoom, Buy Me a Coffee and social-media providers, may process information outside the United Kingdom, including in Canada or the United States.
Where personal information is transferred outside the UK, I use providers that make appropriate transfer arrangements available. Depending on the destination, these may include UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses.
You may contact me for further information about the safeguards relevant to a particular provider.
How long I keep personal information
I keep information only for as long as it is reasonably needed for the purpose for which it was collected.
My usual retention periods are:
- enquiries that do not lead to tuition: up to 12 months after the last contact;
- routine contact-form submissions and correspondence: up to 12 months, unless they become part of an ongoing tuition or business record;
- detailed homework, lesson and teaching notes: normally for the duration of tuition and up to 12 months afterwards;
- essential student, parent, contract, invoice and payment records: for as long as required for the tutoring relationship and applicable tax, accounting, insurance or legal purposes;
- records required for Self Assessment: at least five years after the 31 January submission deadline for the relevant tax year, as required by HMRC;
- information concerning a safeguarding matter, complaint or legal dispute: for as long as reasonably necessary in light of the circumstances and any professional or legal advice; and
- cookie choices and consent information: for the periods explained in the Cookie Policy or shown by the relevant consent tool.
Information may be kept for longer where required by law, where a dispute or complaint is ongoing, or where it is needed to establish, exercise or defend legal claims.
Security
I take reasonable technical and organisational measures to protect personal information. These include using reputable service providers, password-protected accounts, access controls, software updates and limiting access to people who need the information.
No internet or storage system can be guaranteed completely secure. If a personal-data breach creates a risk to people’s rights, I will take the steps required by law, including notifying the ICO or affected individuals where necessary.
Your rights
Depending on the circumstances and lawful basis, you may have the right to:
- ask for a copy of your personal information;
- ask for inaccurate information to be corrected;
- ask for information to be erased;
- ask for the use of information to be restricted;
- object to particular uses of your information;
- receive information you provided in a portable format;
- withdraw consent at any time where processing relies on consent; and
- complain about the handling of your information.
There is normally no fee. I may need enough information to confirm your identity and understand the request. I will respond without undue delay and normally within one month, subject to the rules that apply to complex requests, identification or necessary clarification.
To exercise a right, email zoe@zoehuggetttutorials.co.uk.
Your right to object
You have the right to object to processing based on legitimate interests. If you object, I will stop that processing unless I can demonstrate compelling legitimate grounds or the information is needed for legal claims.
You can withdraw cookie consent through the Cookie Settings control and Google’s “Privacy and cookie settings” control displayed on the website.
Withdrawing consent does not make earlier processing unlawful.
Automated decisions
I do not make decisions about students or customers based solely on automated processing where the decision would have a legal or similarly significant effect.
Google and other advertising providers may use automated systems to select or measure advertisements in accordance with the consent choices made on the website, but I do not use that advertising information to make decisions about individuals.
Data protection complaints
If you are unhappy about how I have used personal information, please email zoe@zoehuggetttutorials.co.uk with the subject “Data protection complaint”.
Please explain what happened, the information involved and what you would like me to consider. I may ask for reasonable proof of identity or authority if someone is acting for another person.
I will acknowledge the complaint within 30 days, investigate it without undue delay, keep you informed where appropriate and explain the outcome.
If you remain dissatisfied, you may complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/
Changes to this policy
I may update this policy when my services, providers or legal obligations change. The latest version will be published on this page with a revised “last updated” date.
