Privacy Policy

This privacy policy applies between you, the User of this Website and of our services, and StudyBox Ltd, the owner and provider of this Website, the StudyBox tuition centres, and our student/parent records management system. StudyBox Ltd takes the privacy of your information very seriously. This privacy policy applies to our use of any and all Data collected by us or provided by you in relation to your use of the Website and our tuition services (both online and in our centres). Please read this privacy policy carefully.

1. Who we are

StudyBox Ltd is a company incorporated in England and Wales with registered number 10254220. Our registered office is at Unit 1 Kensington Court, 108 Manor Road, Wallington, SM6 0DW.

We are registered with the Information Commissioner’s Office (ICO) as a data controller. For any privacy-related queries, please contact us at info@studybox.london.

StudyBox operates Ofsted-registered out-of-school tuition centres and provides educational services to children. We process personal data relating to both parents/guardians and children (pupils).

2. Definitions

  • Cookies — Small text files placed on your device by this Website when you visit certain parts of it or use certain features.
  • Data — All information that you submit to StudyBox Ltd via this Website, our student records system, or in connection with our services, including personal data as defined under UK GDPR.
  • UK GDPR — The UK General Data Protection Regulation — Regulation (EU) 2016/679 as retained in UK law by the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019, and as further amended by the Data (Use and Access) Act 2025.
  • DPA 2018 — The Data Protection Act 2018.
  • StudyBox Ltd, we, us, our — StudyBox Ltd, as described above.
  • User or you — Any third party that accesses this Website or uses our services and is not employed by or engaged as a consultant to StudyBox Ltd. This includes parents/guardians and, where relevant, older pupils.
  • Website — The website at www.studybox.london and any sub-domains, unless expressly excluded by their own terms.
  • Child / Pupil — Any individual under the age of 18 whose data we process in connection with our tuition services.

3. Scope of this privacy policy

This privacy policy applies to the actions of StudyBox Ltd and Users with respect to this Website, our tuition services (including in-centre and any online provision), and our student/parent records management system used to administer enrolment, attendance, progress, communications, payments and safeguarding-related records. It covers personal data relating to parents/guardians and children. It does not extend to any third-party websites accessible from this Website, including links to social media platforms.

4. Data we collect

We may collect the following personal data:

About the pupil:

  • Full name, date of birth, gender
  • School name, school year (and per-subject year level where relevant), 11+/KS3 options, GCSE subjects/texts, home-schooled status
  • Centre (Sutton, Wallington or Croydon)
  • Contact details where held for the pupil directly (mobile number, email)
  • Subjects enrolled and hours per week
  • Learning and support notes
  • Lesson enrolments and attendance, including absences and catch-up sessions
  • Quiz and coding-club progress and answer history (where the pupil uses our online exercises)
  • Portal login code
  • Documents uploaded to the pupil’s record (e.g. school reports, assessments)
  • Where applicable, safeguarding or child-protection concern records, held separately and accessible only to staff with safeguarding permission

About the parent/guardian:

  • Full name
  • Email address(es) and phone number(s)
  • Full postal address
  • Family and finance-related notes
  • Portal password (stored hashed, not in plain text)
  • Login history
  • Payment information: billing references and Direct Debit mandate identifiers with our payment processors (Stripe and GoCardless), and payment/transaction history. We do not store full card numbers ourselves — these are handled directly by our payment processors.
  • Content of messages we send to you (email and WhatsApp)
  • Documents you upload to your account
  • For enquiries that do not proceed to enrolment: contact details and follow-up history

Automatically collected via the Website:

  • IP address
  • Web browser type and version
  • Operating system
  • Pages visited and time spent on the Website (via analytics cookies)
  • Marketing interaction data (e.g. which ads you clicked on)

We only collect data that is necessary for the purposes set out in this policy, and we periodically review our systems to remove fields that are no longer used (data minimisation).

5. Special considerations for children’s data

Children merit specific protection under UK GDPR. We process children’s personal data primarily for the provision of educational services and only where necessary.

Where we rely on consent as the lawful basis for processing a child’s personal data in the context of an information society service offered directly to a child, we will obtain consent from a person with parental responsibility if the child is under 13. Children aged 13 or over may provide their own consent where they have sufficient understanding.

We make reasonable efforts to verify parental responsibility where required.

We do not use children’s data for automated decision-making that produces legal or similarly significant effects.

We design our services and website with the best interests of the child as a primary consideration, in line with the principles of the ICO’s Age Appropriate Design Code (Children’s Code) where applicable to our online services.

Where safeguarding or child-protection information is held about a pupil, it is kept in a dedicated, access-controlled area of our records system, visible only to staff who have been specifically granted safeguarding permission. Every grant or removal of that permission, and every view, edit or deletion of a safeguarding record, is logged.

Privacy information is provided primarily to parents/guardians. We aim to make our notices clear and accessible. Where appropriate for older pupils, we can provide simplified explanations on request.

6. Lawful basis for processing

We process personal data on the following lawful bases under UK GDPR Article 6:

  • Contract — where processing is necessary to provide tuition services you have requested or entered into with us, including billing and payment processing.
  • Consent — where you have given us explicit consent (e.g. opting in to marketing communications, or accepting non-essential cookies). Consent can be withdrawn at any time.
  • Legitimate interests — where processing is necessary for our legitimate business interests (such as responding to enquiries, improving our services, preventing fraud, and basic website analytics), provided these interests are not overridden by your (or your child’s) rights and freedoms.
  • Legal obligation — where we are required to process data to comply with a legal requirement (including safeguarding obligations and financial record-keeping).
  • Vital interests / safeguarding — where necessary to protect a child or another person (e.g. sharing information with relevant authorities in a safeguarding situation).

We do not rely solely on consent for core service delivery or safeguarding-related processing.

7. How we use your data

  • Responding to enquiries and arranging trial sessions or enrolment
  • Delivering tuition services and tracking pupil progress via our student records system
  • Communicating with parents/guardians about sessions, progress and centre information, by email and WhatsApp
  • Taking payment for our services via Stripe and GoCardless
  • Meeting our safeguarding and child-protection responsibilities, including referring concerns to a child’s school or the local authority where appropriate
  • Improving our services and website
  • Marketing (only where you have consented or where legitimate interests apply and you have not opted out)
  • Complying with legal and regulatory obligations (including Ofsted-related record-keeping where applicable, and financial record-keeping)
  • Preventing fraud and ensuring the security of our systems

8. Data retention

We retain enquiry and contact form data for up to 24 months from the date of your last interaction with us, after which it is flagged for review and secure deletion.

If you become a student or customer of StudyBox, we retain relevant records for 6 years from the end of our relationship, in line with our legal obligations and limitation periods.

Financial records are retained for the period required by HMRC and other applicable legal obligations, independent of the retention periods above.

Where we identify a safeguarding concern, our role is to refer it promptly to the child’s school and/or the local authority as appropriate. We retain our own contemporaneous record of the concern and the referral — including who we spoke to and when — for the following periods, after which the records are securely destroyed:

  • Safeguarding concerns that have been formally referred to a school or local authority — retained for a minimum of 10 years from the date of the concern/referral.
  • Concerns involving, or allegations of, child sexual abuse — retained until the child’s 25th birthday, reflecting the heightened sensitivity of this category (following the recommendation of the Independent Inquiry into Child Sexual Abuse, IICSA).
  • Lower-level concerns that did not meet the threshold for referral — retained for up to 6 years after the child leaves our provision.

This allows us to demonstrate that we fulfilled our safeguarding responsibilities and to respond to any subsequent enquiries from a school, local authority, Ofsted, or insurer. These records are reviewed at the end of the applicable retention period and stored separately from general pupil and enrolment records, accessible only to staff with safeguarding permission.

We regularly review the data we hold and delete or anonymise it when it is no longer needed.

9. Third-party services and processors

We use the following third-party services which may process your personal data on our behalf or in their own right:

  • Google Analytics (GA4) — website analytics. Data may be transferred to Google servers in the USA.
  • Google Ads — advertising and conversion tracking.
  • Meta (Facebook/Instagram, and WhatsApp Business messaging) — advertising, the Meta Pixel, and parent/guardian communications sent via WhatsApp.
  • Contact Form 7 — form submission handling on our Website.
  • FluentSMTP / email delivery provider — used to deliver email notifications from our forms and communications.
  • Cookie Script — cookie consent management.
  • GoDaddy / Cloudflare — web hosting and content delivery.
  • Stripe and GoCardless — payment processing and Direct Debit collection. We do not store full card details ourselves.
  • Our student and parent records management system — used to store enrolment, attendance, progress, communications, payment references, and safeguarding-related records for students and parents. This system is hosted by Replit on Google Cloud infrastructure located in the United States. Replit is SOC 2 Type II attested and encrypts data at rest (AES-256) and in transit (TLS). Access is role-based: staff can generally only view records for their own centre, and safeguarding records require a separate, specifically granted permission. Every view, change or deletion of a record is logged. Replit’s Data Processing Agreement incorporates the UK Addendum to the EU Standard Contractual Clauses and/or the UK International Data Transfer Agreement (IDTA) as the transfer safeguard for data hosted outside the UK.

All third-party processors are required to handle your data in accordance with UK GDPR and our data processing instructions. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (see Section 13).

10. Sharing your data

We will not sell or rent your personal data to any third party. We may disclose your data to:

  • Our third-party service providers, as listed above, to the extent necessary to operate the Website and deliver our services
  • Law enforcement, local authorities, or regulatory bodies (including Ofsted where relevant) where we are required to do so by law or where necessary to safeguard a child
  • A prospective or actual purchaser of our business or any part of it, where data transfer is necessary and appropriate safeguards are in place

Safeguarding note: Where we have concerns about a child’s welfare, we may share relevant information with appropriate agencies without relying on consent, in accordance with our safeguarding duties and UK data protection law. We keep our own record of any concern raised and any referral made, for the retention periods set out in Section 8.

11. Your rights under UK GDPR

Under UK GDPR and the Data Protection Act 2018, you (and, where competent, a child) have the following rights in relation to personal data:

  • Right of access — request a copy of the personal data we hold (a Subject Access Request). This is free of charge and we will respond within one calendar month. You can also make certain requests directly through your account, where our systems allow it.
  • Right to rectification — ask us to correct any inaccurate or incomplete data.
  • Right to erasure — ask us to delete personal data where there is no legitimate reason for us to continue processing it. We are not able to action an erasure request where a safeguarding record exists on the family’s account, or in full where financial records must be retained for legal/accounting reasons — in the latter case, we remove the personal details but retain the minimum financial figures the law requires us to keep.
  • Right to restrict processing — request that we restrict the processing of data in certain circumstances.
  • Right to data portability — receive personal data in a structured, commonly used and machine-readable format, and transmit it to another controller where technically feasible.
  • Right to object — object to processing based on legitimate interests or for direct marketing purposes.
  • Rights related to automated decision-making — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Parents/guardians may exercise rights on behalf of a child who is not competent to do so themselves. We will consider the child’s best interests and any competing rights when responding.

To exercise any of these rights, please contact us at info@studybox.london. We will respond within one calendar month of receiving your request.

12. Right to complain

If you believe we have not handled your personal data in compliance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.

13. International data transfers

Several of our third-party service providers store or process your data outside the United Kingdom, in particular our student and parent records system, which is hosted on Google Cloud infrastructure in the United States via Replit. Google, Meta and our payment processors may also process data in or transfer data to the USA. Where this occurs, we ensure appropriate safeguards are in place. For our records system, this is via Replit’s Data Processing Agreement, which incorporates the UK Addendum to the EU Standard Contractual Clauses and/or the UK International Data Transfer Agreement (IDTA), adopted under Article 46 of the UK GDPR. For our other service providers, we rely on the UK’s adequacy decisions, the UK–US Data Bridge, or standard contractual clauses/the UK IDTA as approved by the ICO, to ensure your data receives an equivalent level of protection.

14. Security

Data security is of great importance to StudyBox Ltd. We have put in place appropriate technical and organisational measures to protect personal data (including children’s data) against unauthorised access, alteration, disclosure or destruction. Our Website is served over HTTPS (TLS in transit). Our student records system is hosted on infrastructure that encrypts data at rest using AES-256, enforces role-based access so staff can generally only see records for their own centre, restricts safeguarding records to staff with a specific safeguarding permission, and logs every view, change or deletion of a record.

Transmission of information over the internet carries inherent risks. While we take all reasonable precautions, we cannot guarantee the absolute security of data transmitted to the Website.

15. Links to other websites

This Website may provide links to third-party websites. We have no control over those websites and are not responsible for their content or privacy practices. This privacy policy does not extend to your use of such websites. We recommend you read the privacy policy of any website you visit.

16. Changes of business ownership and control

StudyBox Ltd may from time to time expand or reduce our business, which may involve the sale or transfer of control of all or part of the company. In such cases, personal data held by us may be transferred to the new owner, who will be bound by the terms of this privacy policy.

17. Cookies

This Website uses cookies in accordance with the Privacy and Electronic Communications Regulations (PECR) and the Data (Use and Access) Act 2025. We use a cookie consent tool to obtain your consent before placing non-essential cookies.

We use the following categories of cookies:

  • Strictly necessary cookies — essential for the operation of the Website (e.g. security, form submission). No consent required.
  • Analytics cookies — help us understand how visitors use the Website (e.g. Google Analytics). Placed only with your consent.
  • Marketing/targeting cookies — used to deliver relevant advertising (e.g. Meta Pixel, Google Ads). Placed only with your consent.
  • Functionality cookies — remember your preferences to improve your experience. Placed only with your consent.

You can manage or withdraw your cookie consent at any time via the cookie banner on this Website, or by adjusting your browser settings. Note that disabling certain cookies may affect the functionality of the Website.

Given that our services involve children, we apply high-privacy defaults where practicable and minimise the use of non-essential tracking.

18. Direct marketing

We will only contact you for direct marketing purposes where you have consented to receive such communications, or where we have a legitimate interest and you have not opted out. You may opt out of marketing communications at any time by emailing info@studybox.london or clicking the unsubscribe link in any marketing email.

Every marketing email we send includes an unsubscribe link, or you can ask any member of staff to mark your account as no-marketing.

We do not use children’s data for direct marketing to the child.

19. Data Protection Impact Assessments

Where our processing of personal data is likely to result in a high risk to the rights and freedoms of individuals (particularly children), we carry out or review Data Protection Impact Assessments (DPIAs) as required by UK GDPR. This includes consideration of marketing tools and analytics used on our Website, and the student records system used to hold enrolment, attendance, progress, communications, payment and safeguarding-related data.

20. General

You may not transfer any of your rights under this privacy policy to any other person. We may transfer our rights under this privacy policy where we reasonably believe your rights will not be affected.

If any provision of this privacy policy is found to be invalid, illegal or unenforceable, the remaining provisions shall continue in full force and effect.

This privacy policy is governed by the law of England and Wales. All disputes arising under it shall be subject to the exclusive jurisdiction of the English and Welsh courts.

21. Changes to this privacy policy

We reserve the right to update this privacy policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this policy periodically. Your continued use of the Website or our services after any changes constitutes your acceptance of the updated policy.

If you have any questions about this privacy policy, please contact us at info@studybox.london.

Last updated: 12 August 2026