BrightSteps Learning
Privacy Notice
Last updated: 30 July 2026

This privacy notice explains how BrightSteps Learning collects, uses, stores and shares personal information when providing online tutoring and related educational services.

1. Contact details

BrightSteps Learning

Email: hello@brightstepslearning.co.uk

Website: brightstepslearning.co.uk

For questions about this notice, to exercise a data protection right, or to make a data protection complaint, please contact us using the email address above.
 

2. What information we collect and use
 

Student education and welfare: Student names and contact details where applicable; parent or guardian names and contact details; date of birth or age information where needed; account information; attendance; lesson records; homework; feedback; progress information; and information relating to enquiries, compliments or complaints.

Bookings, payments and administration: Booking and service history, transaction records, billing information and payment status. Full payment-card details are normally processed by our payment provider rather than stored directly by BrightSteps Learning.
 

Queries, complaints and claims: Names and contact details, correspondence, relevant account or service information, attendance information, transaction information and other information needed to investigate and respond.
 

Updates and marketing: Names, contact details, marketing preferences and records of consent or opt-out choices, where applicable.

|Legal and safeguarding requirements: Information that we are required to collect, retain or disclose to comply with applicable law or to respond appropriately to safeguarding concerns.
 

3. Lawful bases for using personal information
 

Under UK data protection law, we must have a lawful basis for processing personal information. The lawful basis depends on why the information is being used.

· Contract: where processing is necessary to arrange, administer or provide tutoring services requested by a parent, guardian or customer.
 

· Legitimate interests: where processing is reasonably necessary to operate and improve our tutoring service, maintain appropriate educational and administrative records, respond to enquiries or complaints, prevent misuse, and communicate with existing customers where permitted. We consider the necessity and privacy impact before relying on this basis.
 

· Consent: where we ask for permission, including for certain marketing communications. Consent may be withdrawn at any time.

· Legal obligation: where processing is necessary to comply with a legal requirement, including applicable accounting, tax, data protection or safeguarding obligations.
 

4. Our legitimate interests
 

For student education and welfare, our legitimate interest is to maintain proportionate records of attendance, lesson content, progress, homework and feedback so that teaching can be adapted to the student and progress can be communicated to parents or guardians.

For enquiries, complaints and claims, our legitimate interest is to keep enough information to investigate issues, communicate with the people involved, maintain service quality and establish or defend legal claims where necessary.
 

For permitted customer communications, our legitimate interest may include keeping existing customers informed about relevant BrightSteps Learning services. Where consent is required for direct marketing, we rely on consent instead. Marketing communications will include an appropriate way to opt out.
 

We aim to collect only information reasonably necessary for these purposes, restrict access to people who need it, and avoid using personal information in ways that would unfairly override the rights and interests of students, parents or customers.
 

5. Children’s information
 

BrightSteps Learning provides services to children and therefore processes children’s personal information. Where appropriate, information is supplied or managed by a parent or person with parental responsibility. We take particular care to use children’s information only where it is relevant to providing, administering or safeguarding the educational service.
 

6. Where we get personal information from
 

· Students directly.

· Parents, guardians, carers or other people with parental responsibility.

· The online services used to administer bookings, payments, accounts and lessons, where relevant.
 

7. How long we keep information
 

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected and to meet applicable legal, accounting, safeguarding and dispute-resolution requirements. Our normal approach is:
 

· Student educational and account records: for the period the student receives services and normally for up to 3 years after the last lesson, unless a longer period is reasonably required for safeguarding, a complaint or a legal claim.

· Routine enquiries and correspondence: normally up to 2 years after the matter is concluded.

· Financial and transaction records: normally 6 years after the end of the relevant financial year, where required for tax or accounting purposes.
 

· Marketing records: until consent is withdrawn, the person opts out, or the information is no longer required. We may retain a minimal suppression record so that an opt-out continues to be respected.
 

· Safeguarding, complaints or legal records: for as long as reasonably necessary having regard to the nature of the matter and any applicable legal or safeguarding requirements.
 

These are standard periods rather than absolute rules. We periodically review retained information and securely delete or anonymise information that is no longer required.
 

8. Who we share information with
 

We do not sell personal information. We may share information with parents or carers, organisations involved in safeguarding, legal or regulatory authorities where required, and service providers that process information for us.
 

Service provider & Purpose:
 

CoursePod

Online learning platform used to manage accounts, lessons, bookings, communications and educational records.
 

Google Workspace

Business email, cloud storage and productivity services used for communications and documents.
 

Wix

Website hosting, website forms and related website services.
 

Stripe

Payment processing, transaction administration and fraud-prevention services.
 

Notion

Internal business organisation, planning and record-management tools where personal information is stored only when necessary.

Some providers may act as independent controllers for limited processing they carry out for their own legal, security or compliance purposes. Their own privacy terms may therefore also apply.
 

9. International transfers
 

Some of the technology providers we use operate internationally. Personal information may therefore be processed or accessed outside the UK, including through global cloud infrastructure.
 

Where UK data protection law treats this as a restricted international transfer, we require an appropriate transfer mechanism or safeguard to be used. Depending on the destination and provider, this may include UK adequacy regulations or a UK data bridge, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. The mechanism applicable to a particular transfer may change as providers update their infrastructure or legal arrangements.
 

You can contact us at hello@brightstepslearning.co.uk if you would like further information about the safeguards relevant to a particular service provider.
 

10. Your data protection rights
 

Depending on the circumstances and the lawful basis used, UK data protection law may give you rights to:
 

· ask for access to your personal information;

· ask us to correct inaccurate or incomplete information;

· ask us to erase personal information;

· ask us to restrict how information is used;

· object to certain processing;

· receive or transfer certain information in a portable format; and

· withdraw consent at any time where processing is based on consent.
 

These rights are subject to legal conditions and exemptions. We will normally respond to a valid rights request without undue delay and within one month.
 

11. How to complain
 

If you have concerns about how BrightSteps Learning uses personal information, please contact us first at hello@brightstepslearning.co.uk.
 

If you remain dissatisfied, you can complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.
 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
 

12. Changes to this notice
 

We may update this privacy notice when our services, legal obligations or data-processing arrangements change. The latest version will be published on the BrightSteps Learning website with the date of the most recent update.