Privacy Policy

Policy Statement & Definitions 

Name: Study Mind Limited 

Address: 40 Russell Rd, Northwood HA6 2LR 

Phone Number: +44 (0) 20 3305 9593 

E-mail: info@studymind.co.uk 

Study Mind Limited, a company registered in England and Wales (No. 12944555) with a registered office at: 40 Russell Rd, Northwood HA6 2LR herein referred to as “Study Mind” or “we” have created this privacy statement (“Statement”) in order to demonstrate our firm commitment to the privacy of the details that you provide to us when using this website, as the data controller for the purposes of the GDPR (General Data Protection Regulations EU 2016/679) and related UK legislation. 

Unless otherwise indicated all definitions in the Client Policy and the Tutor Policy shall apply to this Statement. In this Statement, references to “you” and “your” are references to the User of i.e. www.studymind.co.uk (the “Site”) regardless of whether you are a Client or a Tutor or other user. It applies to information we collect about Users of our Site and amongst other things, this Statement describes what personally identifiable information “Personal Information” we collect from you, how and when it is used, how we protect it and who has access to it. This Statement incorporates our Cookie Policy, the Terms of Service and the Tutor Policy and/or the Client Policy (where applicable) by this reference. 

This Privacy Policy should be read alongside Study Mind’s Data Protection Policy, which sets out our organisational compliance with the seven UK GDPR principles, data retention rules, data subject rights, and breach response procedures.

 2.0 Aims of this Policy 

This Policy explains our processing of your personal data and your rights according to EU General Data Protection Regulation and UK data protection legislation. We reserve the right to modify this Statement at any time without notice by posting the changes on this page. 

2.1 The type of personal information we collect 

We currently collect and process the following information: 

1. Personal information that you give to us that is necessary for the use of Study Mind Tutoring 

• Account information: to enable us to create an account for you on the Site. Depending on whether you register as a parent, student, school pupil, or tutor, this information can include your name, email, telephone number, WhatsApp number, date of birth. 
• Identity verification information: when you apply as a tutor we ask for verification that you study at the university you claim to, have a valid ID card and a DBS check (if applicable). We also ask for information to demonstrate that you have the right to work in the UK.
• Tutor application details: so we can process your application to become a tutor. These details include your educational background and qualifications, your tutoring subjects, your profile picture and video interview and your gender. 
• Communication history: to enable communication with other users of the website and with Study Mind we store details about your communication history including jobs you have submitted, jobs you have applied for, interacts with the Study Mind team via SMS and telephone. This includes call recordings. 
• Data for Work Experience, Summer Schools, and Residential Programmes
  For residential or off-site activities, Study Mind processes additional information such as passport details, emergency contacts, medical information, dietary requirements, travel arrangements, and supervision notes.

Only essential information is shared with vetted partners to ensure student safety and support.

1. Information we automatically collect from your use of the Study Mind Site 

We collect some information from all users of the Study Mind site regardless of whether you are registered with us as a customer or tutor, to fulfil our contract with users and to enable our legitimate interests in providing the Study Mind site and services. 

Automatically tracked information includes: Cookie information, your IP address, details of the device you use to access the Site, the pages you visit and the actions taken, the times and dates of actions you take on our website. 

Cookies and Tracking Technologies
Study Mind uses cookies and similar technologies to support website functionality, maintain security, and analyse site usage.

Cookies requiring consent (e.g., analytics or marketing cookies) are only activated where users have provided explicit permission. Full details are available in our Cookie Policy.

1. Information we collect from third parties 

• Pupil profile details: if you register for Study Mind as a pupil through our Schools Partnerships your teacher will share relevant information to set up tutoring with us. This includes your development areas, target grades, school, year group and any special requirements you have. Your Study Mind tutor will then share feedback on your progress with your teachers and this information may also be shared with other tutors who are also teaching you in order to provide the best possible experience. 
• Your reviews from other Study Mind users: students on Study Mind can rate tutors after lessons, this information is shared with you if you are a tutor and will be shown on your public profile. 
• Other sources: we reserve the right, where permitted by law, to collect and use information on you from third party providers. 

1. Financial information 

We may require you to provide us with Financial Information to authorise or process payment and bill you or pay you for the Services. These details include for tutors: your nominated bank account, your invoices and your payment history, and for customers your payment history and payment card details. 

When you book Tutoring Services via the Site (if you are a Client) or when you receive payment for delivering Tutoring Services via the Site (if you are a Tutor), we will pass your Financial or Personal Information to those third parties necessary to process your transactions with us, such as credit card companies and banks. 

The legal basis under GDPR by which we are permitted to process this information in this way is that it is necessary for the performance of a contract to which you are a party, or to take steps prior to entering into a contract with you or where we need to comply with a legal obligation. 

This includes exchanging information with other companies and organisations for fraud protection and credit risk reduction. Except as provided above, we will not share Financial Information with third parties without your prior consent. 

1. Special Category Personal Data
   In some circumstances, Study Mind processes Special Category Data, including information relating to health, SEND needs, EHCP details, ethnicity (where requested by commissioners), and safeguarding concerns.

Such data is processed only when strictly necessary and under one of the following conditions:

• Explicit consent from the parent/carer or adult learner
• Substantial public interest, including safeguarding children and individuals at risk
• Legal obligations relating to statutory education or local authority reporting

Additional safeguards are applied to Special Category Data, including restricted access, enhanced security controls, and secure storage.

2.2 How the information is used 

The Site asks you to provide various types of Personal Information to enhance the quality of the Services we can provide to you and the more accurate the information you provide, the better we are able to respond to your requirements. 

Any Personal Information that is held with Study Mind shall be retained in accordance with the GDPR. Study Mind is the data controller in respect of all of the Personal Information which Study Mind collects and receives about you when you use the Study Mind Services. 

1. Data processing to provide and improve the Study Mind Site and Services 

We use your information primarily to fulfil our contract to provide you with the Services that you request, and related services (this includes providing this Site, website administration and security). We run the following processes to fulfil our contract with you: 

• Enabling you to access the Site and create an account 
• Enabling tutors to create and promote their profile on the Site 
• Enabling bookings between customers and tutors 
• Enabling payments 
• Providing support for customers and tutors 

We also use your information to support our legitimate interests in developing the Site and the Services. These processes include: 

• To ensure quality of service 
• To better understand how the Site is functioning for Users to inform our product development 
• To draw conclusions upon demographic information 
• Preventing fraud, spam and abusive or inappropriate behaviour 
• Fulfilling our safeguarding and legal obligations 

You acknowledge that your Personal Information may be used by Study Mind to contact you by phone or by electronic mail when necessary in connection with the Services requested by you on the Site. 

1. Data processing to provide, tailor and improve our marketing activities 

We also use your information to support our legitimate interests in marketing our Site and the Services. These processes include: 

• Marketing activities to promote our services to registered users. These communications may be personalised to you and your interactions with the Site and can be delivered by email, social media advertising and other digital marketing channels 
• Notifying you about upcoming promotions, Referral Discount Codes, services or customer surveys 

Opting out: If you do not wish to be contacted by Study Mind in respect of future marketing communications, in the case of our own promotional communications please contact Study Mind by sending an email to info@studymind.co.uk with “UNSUBSCRIBE REQUEST” or similar statement in the subject line. 

Study Mind distinguishes between essential service communications (which are necessary for contract fulfilment) and optional marketing communications (which require consent).

Users may withdraw consent for marketing at any time without affecting the delivery of core services.

1. The legal grounds under GDPR for processing your personal data described above are as follows 

• It is necessary for the performance of a contract to which you are a party, or to take steps prior to entering into a contract with you, for us to provide you with our products and services. Where we require information from you for these purposes we have set out above which information it is necessary for us to process, without which we will be unable to provide you with our services. 
• It is necessary for the purposes of our legitimate interests, such as fraud prevention, child protection, maintaining quality of service, error detection and cybersecurity, except where our interests are overridden by the interests, rights or freedoms of affected individuals (such as you). To determine this, we shall consider a number of factors, such as what you were told at the time you provided your data, what your expectations are about the processing of the data, the nature of the data, and the impact of the processing on you. In order to protect children from harassment and abuse, we video record and store tutoring sessions. 
• You have given us explicit opt-in consent to the processing of your personal data for one or more specific purposes, namely where you have given us consent to receive electronic marketing by us and/or by third parties as described in this notice. 
• Where we need to comply with a legal obligation; or in rare circumstances: 
• Where we need to protect your interests (or someone else’s interests); and/or 
• Where it is needed in the public interest or for official purposes 

1. Our Lawful Bases for Processing
   Study Mind processes personal data under the following lawful bases:

• Contract: to provide tutoring, educational services, bookings, payments, and support.
• Legal Obligation: for safeguarding reporting, DBS verification, payroll, accounting, and compliance with statutory guidance.
• Legitimate Interests: to improve our services, maintain platform security, prevent fraud, record lessons for safeguarding, and ensure quality of delivery.
• Consent: for optional marketing communications or where required for publicity, photography, or certain uses of children’s data.
• Vital Interests: where processing is necessary to protect someone’s life.

Where Legitimate Interests are used, Study Mind conducts and documents a Legitimate Interests Assessment (LIA) in line with the Data Protection Policy.

1. Safeguarding and Information Sharing
   Study Mind may share personal data without consent where there is a safeguarding concern, in accordance with statutory duties under Keeping Children Safe in Education (KCSIE), Working Together to Safeguard Children, and relevant local authority procedures.

Information will only be shared on a need-to-know basis with authorised agencies such as schools, local authorities, the police, or social care. Individuals will be informed where appropriate and where doing so does not place a child or adult at further risk.

2.2.1 Children’s Data and the Age-Appropriate Design Code

As Study Mind provides services to children and young people, we comply with the ICO’s Age-Appropriate Design Code by ensuring:

• High privacy settings by default
• No unnecessary profiling of children
• Clear explanations to parents/carers and learners about how their data is used
• Robust safety measures for online lessons and digital platforms
• Data minimisation for all services involving children

Where consent is required for processing children’s data, parental consent is obtained for users under the age of 13 except where data is supplied directly by a school or local authority.

2.3 Data Protection Processes

At Study Mind, we are committed to protecting personal data and ensuring compliance with UK GDPR when introducing, changing, or expanding any processes involving personal data. To safeguard individuals’ rights and minimise risks, we have implemented the following procedures:

1. Data Protection Impact Assessments (DPIAs)

Before initiating any new process, system, or project that involves the collection, storage, or processing of personal data, we conduct a Data Protection Impact Assessment (DPIA) to:

• Identify potential risks to personal and sensitive data.
• Assess the necessity and proportionality of data processing
• Ensure that appropriate technical and organisational security measures are in place.
• Mitigate any risks through secure data handling procedures and access controls.

2. Risk Minimisation Strategies

To protect personal data throughout any changes to our operations, we ensure:

• Data minimisation – Only collecting necessary personal data relevant to the project or process.
• Access control – Restricting access to authorised personnel only, ensuring the principle of least privilege.
• Secure processing – Implementing encryption, anonymisation, and secure storage measures where applicable.
• Third-party due diligence – If external providers are involved, ensuring contractual safeguards such as Data Processing Agreements (DPAs).

3. Ongoing Review and Compliance Checks

• All new projects undergo a compliance check by the Data Protection Officer (DPO) or designated compliance lead.
• Any significant changes to existing data processing activities are reviewed to ensure continued compliance with data protection laws.
• Regular audits and staff training ensure that all employees handling personal data are aware of risk mitigation protocols.

3.0 Access to the information 

1. Other users on the Study Mind site 

Your Personal Information may also be viewed by Tutors (where you are a Client) or by a Client or Tutor (where you are a Tutor) for the sole purposes of enabling Tutors to deliver their Tutoring Services direct to you and to provide you with information about their Tutoring Services and access to the Tutoring Services themselves. 

If you as a Client make a request for Tutoring Services with a Tutor via the Site, your Personal Information will be shared with the Tutor to enable the Tutor to deliver the Tutoring Services or to follow up on any enquiry. Such details may include: first name and initial of surname, the requirements of your subject and telephone number. 

If you as a Tutor submit Personal Information on the Site for example by creating a profile, Personal Information in your profile may be accessible by any User who visits the Site. The personal information shared may include: first name, university details, your qualifications, your experience, your profile picture, your video, your tutoring subjects and reviews. Releasing this Personal Data is necessary for you to make use of the Site and the Services. 

If you as a user send a message to another user on the Site, you acknowledge that Study Mind may monitor the content of your message to fulfil our safeguarding obligations and to protect our legitimate interests. 

1. Third party companies and service providers 

We use a variety of third party companies to provide the services and we may need to pass some Personal Information to these third parties. If we pass Personal Information to third parties, we minimise as far as possible what Personal Information is shared. The categories of third party providers we share personal data with include: 

• Analytics providers 
• Payment providers 
• Communications platforms for email, text and in-app communications 
• Marketing platforms 
• Business operations tools 
• Accounting and finance platforms 
• Customer support platforms 

In addition to the providers listed above, Study Mind may share data with:

• Cloud hosting and secure storage services
• Online learning platforms and video-conferencing tools
• External agencies assisting with Alternative Provision, EHCP support, or safeguarding
• Residential and work experience partners requiring essential health, safety, or travel information

All third-party providers are bound by Data Processing Agreements and must demonstrate compliance with the UK GDPR.

1. Disclosure of your personal information and financial information in compliance with laws 

You should be aware that we may release your Personal Information or Financial Information when we believe it is necessary to comply with laws or regulations, to assist law enforcement, to enforce the terms under which you transacted with Study Mind, or to protect the rights, property or safety of Study Mind, Site Users or others. 

1. Other sites/third party vendors and their privacy policies and cookie policies 

This Site may contain links to other websites. Study Mind is not responsible for the privacy practices or the content of such websites or for the privacy policies, cookie policies and practices of other third parties, and so you should be careful to read and understand those website policies independently. 

1. International Data Transfers
   Where data is transferred outside the UK (for example, through cloud storage or international programme partners), Study Mind ensures appropriate safeguards are in place, including:

• ICO-approved Standard Contractual Clauses (SCCs)
• Adequacy regulations
• Additional technical and organisational security measures

These safeguards ensure that all international transfers comply with UK GDPR requirements.

4.0 How do we protect your information? 

The privacy and protection of your Personal Information is important to us. You acknowledge that email messages sent over the internet are not encrypted and are not secure. Despite efforts to protect your Personal Information, we cannot ensure or warrant the security of any information you transmit to us, or to or from our online Services. You accept that Study Mind cannot be held liable for any breaches of confidentiality that may occur as a result of the use of email. If there is any sensitive or confidential information which you do not wish to communicate by email, please contact Study Mind by telephone or post to arrange an alternative method of communication. You transmit all such information at your own risk. However, once we receive your transmission, we use our best efforts to ensure its security on our systems. 

All data is stored on secure password-protected sheets which only the relevant management team have access to. Study Mind stores all data on encrypted 2560bit SSL/TLS servers which can only be accessed by two factor authentication. 

The Site has security measures in place to protect the loss, misuse and alteration of the information under our control. We use 256-bit SSL/TLS encryption for your transactions with us. It encrypts all your Personal Information, including credit card number, name, and address, so that it cannot be read as the information travels over the Internet. 

Additional Organisational and Technical Security Measures
Study Mind applies the following safeguards:

• Multi-factor authentication for sensitive systems
• Encryption of data in transit and at rest
• Restriction of access using the principle of least privilege
• Regular staff training in data protection and cybersecurity
• Annual reviews of internal systems and DPIA requirements

These measures align with the expectations outlined in Study Mind’s Data Protection Policy.

4.1 Data Breach Reporting Procedure

At Study Mind, we are committed to ensuring the security and confidentiality of personal data. In accordance with UK GDPR, we have a structured procedure for identifying, reporting, and responding to data breaches to protect individuals’ rights and prevent further risks.

1. Identifying a Data Breach

A data breach may occur if personal data is:

• Lost or stolen (e.g., misplaced documents, unauthorised access to accounts).
• Accessed or disclosed without authorisation (e.g., sending data to the wrong recipient).
• Compromised due to a cyber-attack or system failure (e.g., hacking, malware, or phishing attacks).
• Altered or destroyed without authorisation.

If someone suspects a data breach has occurred, they must report it immediately following the steps below.

2. Reporting a Data Breach

Step 1: Immediate Notification

The individual identifying the breach must report it to the Data Protection Officer (DPO) or designated compliance lead within 24 hours.

• Reports should include:
  • Nature of the breach (e.g., lost data, unauthorised access).
  • Type of personal data affected.
  • Individuals impacted.
  • How and when the breach occurred.

Step 2: Investigation & Risk Assessment

The DPO will assess the breach, determining:

• The scale of the breach and its potential impact.
• Whether the breach is likely to result in harm to individuals.
• The required mitigation steps.

Step 3: Containment & Mitigation

• Immediate actions will be taken to contain and limit the impact of the breach (e.g., restricting access, changing passwords, notifying affected individuals).
• Technical and operational measures will be reviewed to prevent similar breaches in the future.

Step 4: Reporting to ICO (If Required)

• If the breach poses a high risk to individuals’ rights and freedoms, Study Mind will report it to the Information Commissioner’s Office (ICO) within 72 hours.
• Affected individuals will be notified without undue delay if the breach is likely to result in serious harm.

Step 5: Documentation & Review

• All breaches will be logged in the Data Breach Register, including actions taken and future preventive measures.
• A post-incident review will be conducted to identify areas for improvement.

5.0 How long do we keep information? 

Data will be held by us for the period necessary to meet the purposes for which we initially collected the information. 

• By default, we retain personal data for three years after you have last been active on the Site. 
• After that period has passed, or after you request us to delete your data (whichever comes sooner) we will delete your personal data except where we have specific reason which means we need to keep it for longer. 
• We may retain records where necessary to fulfil our regulatory or statutory duties. 

Retention Periods for Specific Categories

• Safeguarding records: retained in accordance with statutory guidance, often until the individual reaches the age of 25.
• Financial records: kept for 6 years in line with HMRC requirements.
• Tutor employment and right-to-work records: retained for the duration of engagement and a legally required period thereafter.
• Lesson recordings: retained only for safeguarding and quality assurance purposes and deleted after the defined retention period.

Study Mind maintains a full retention schedule in accordance with its Data Protection Policy.

6.0 Your data protection rights 

Study Mind tries to be as open as it can be in terms of giving people access to their Personal Information. Individuals can find out if we hold any Personal Information by making a “subject access request”, normally free of charge, under the data protection legislation. If we do hold information about you we will let you have a copy of that information unless a legal exception applies, in which case we will inform you of this at the time. You also have the right to request that information we hold about you which may be incorrect, incomplete, or which has been changed since you first told us, is updated or removed. 

Under data protection law, you have rights including: 

• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. including when there is no good reason for us to continue to process it. To request that we delete your personal data please send an email with the subject line “Personal Data Deletion Request” to info@studymind.co.uk 
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances. 
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances. 
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances. 

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. 

Please contact us at info@studymind.co.uk if you wish to make a request. 

Automated Decision-Making and Profiling
Study Mind does not carry out solely automated decision-making that has legal or significant effects on individuals.

Some processes, such as tutor matching or service recommendations, may involve limited automated analysis but always include human oversight.

7.0 How to complain 

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data has been processed unlawfully or your rights have not been respected.

Study Mind tries to meet the highest standards when collecting and using Personal Information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures. 

If you have any concerns about our use of your personal information, you can make a complaint to us. Our details: 

Name: Study Mind Limited 

Address: 40 Russell Rd, Northwood HA6 2LR 

Phone Number: +44 (0) 20 3305 9593 

E-mail: info@studymind.co.uk 

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address: 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 

Helpline number: 0303 123 1113 

ICO website: https://www.ico.org.uk 

Policy Review

Study Mind reviews this Privacy Policy annually, or sooner if changes in legislation, ICO guidance, or operational practices require updates. This policy was last updated in November 2025.