Privacy Policy

Last updated: 16 May 2026

This policy explains what personal information Wallington Academy collects, why we collect it, how we use and protect it, and the rights you have over it. It covers visitors to our website, parents and guardians, students (including children), and staff.

1. Who we are

Wallington Academy is a tutoring centre based in Wallington, Surrey, established in 1999. For the purposes of UK data protection law — the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — Wallington Academy is the data controller for the personal information described in this policy.

You can reach us about anything in this policy by email at info@wallingtonacademy.co.uk, or by post at Wallington, Surrey, SM6.

2. Information we collect

We collect personal information in the following ways.

When you contact us through the website

When you submit an enquiry through our contact form, we collect the name, email address and (if you provide it) phone number you give us, the year group or session type you select, and the contents of your message. This typically includes information about your child.

When you hold a parent or staff account on our platform

To use our online platform (the parent and staff portal), we collect your name, email address and a securely hashed password, and we keep a record of your activity within the platform such as bookings, messages and homework you view or set.

Student information

To deliver tutoring we hold records about each student, which may include their name, year group, the subjects they study, attendance, lesson and booking history, homework, assessment and mock-exam results, progress notes, and similar academic records. Where relevant to safe and effective teaching, we may also hold limited additional information that a parent or guardian chooses to share with us.

Payment information

If you pay for tutoring through the platform, payments are handled by our payment providers. We receive a record that a payment has been made and its amount, but we do not store full card or bank details ourselves — these are handled directly by the payment provider.

Technical information

Like most websites, our hosting and security providers automatically process limited technical data — such as IP address and browser type — to keep the site available and secure. This is described further in the Cookies section below.

3. Children’s information

Accounts on our platform are created and managed by a parent or guardian, not by the child directly. We collect children’s information only so far as it is needed to provide tutoring and to keep students safe, and we do not use children’s information for marketing. A parent or guardian can ask to see, correct or delete their child’s information at any time using the contact details below.

4. How and why we use your information

We use personal information only where the law allows. The main reasons we process your information, and the lawful bases we rely on, are:

• To respond to enquiries — when you contact us, we use your details to reply and to discuss tutoring for your child. Lawful basis: our legitimate interest in responding to people who contact us, and taking steps at your request before entering into a contract.
• To provide tutoring and run our platform — managing accounts, bookings, lessons, homework, assessments and progress tracking. Lawful basis: performance of our contract with you.
• To take payment — processing fees for tutoring. Lawful basis: performance of our contract, and compliance with our legal obligations (for example accounting records).
• To keep the service secure — protecting the site and accounts against fraud, abuse and unauthorised access. Lawful basis: our legitimate interest in keeping our service and our users safe.
• To send service messages — for example confirming a booking or a payment, or telling you about a change. Lawful basis: performance of our contract.
• To meet legal and safeguarding obligations — where we are required to keep records or to act to protect a child. Lawful basis: legal obligation, and protecting the vital interests of an individual.

We will only send you marketing messages if you have asked us to or otherwise agreed to receive them, and you can opt out at any time.

5. Who we share information with

We do not sell your personal information. We share it only with trusted service providers who help us run the academy, and only so far as they need it to provide their service to us. These include:

• Supabase — our database and account-authentication provider, which securely stores platform data.
• Netlify — our website hosting provider.
• Cloudflare — provides the “Turnstile” security check that protects our forms from automated abuse.
• Resend — the service we use to send transactional emails such as enquiry and booking notifications.
• Google — we display public Google reviews of the academy on our website.
• Our payment providers — where you pay for tutoring online, the payment is processed by a regulated payment provider.

These providers act as our data processors and are required to keep your information secure and to use it only on our instructions. We may also disclose information where we are legally required to do so, or where it is necessary to protect a child or to establish or defend legal claims.

Information held outside the UK

Some of our providers may process data on servers outside the UK. Where that happens, we rely on those providers’ safeguards — such as UK or EU adequacy arrangements or standard contractual clauses — so that your information continues to receive a level of protection comparable to that under UK law.

6. Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary cookies keep you signed in to the platform and support the Cloudflare security check. The site cannot function without these, so they do not require consent.
• Functional cookies remember small preferences, such as cookie choices you have made. These are not used for tracking.
• Analytics and marketing cookies are not currently used on this site. If we add them in future, they will only run with your consent.

When you first visit the site you can accept, reject or customise non-essential cookies, and you can change your choice at any time using the “Manage cookies” link in the website footer.

7. How long we keep information

We keep personal information only for as long as we need it for the purposes set out in this policy. In practice:

• Enquiries that do not lead to tutoring are kept for a limited period and then deleted.
• Student and account records are kept for the duration of the tutoring relationship and for a reasonable period afterwards, so that we can deal with follow-up questions and meet our legal and accounting obligations.
• Financial records are kept for as long as required by law.

When information is no longer needed, we delete it or securely anonymise it.

8. How we protect information

We take appropriate measures to keep personal information secure. The site is served only over an encrypted (HTTPS) connection, account passwords are stored in a securely hashed form, access to the platform is controlled by per-user permissions, and the database enforces rules so that families can see only their own information. We also apply browser-level security protections and automated checks to guard against abuse. No system can be guaranteed completely secure, but we work to protect your information and to keep our safeguards up to date.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you or your child;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete information, where there is no continuing reason for us to keep it;
• ask us to restrict or object to certain uses of your information;
• ask to receive certain information in a portable format; and
• withdraw consent at any time, where we are relying on your consent.

To exercise any of these rights, contact us using the details below. We will respond within one month. There is normally no charge.

10. Contact and complaints

If you have any questions about this policy, or you wish to exercise your rights, please email info@wallingtonacademy.co.uk.

If you are not satisfied with how we have handled your information, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “last updated” date at the top of the page. Significant changes will be made clear on the website.