GDPR Policy

---

Key details

Date created: 10 November 2025 

Reviewed by: Chloe White, Owner of Chloe White Tutoring Services

Next review date: 11 November 2026

Policy number: GDPR001

Version number: 1

Introduction

This document sets out where Chloe White Tutoring Services gathers and uses certain information about individuals, or organisations, and lists who they are and the purpose. 

Chloe White Tutoring Services needs to gather certain information about individuals so that it can build better relationships with stakeholders and deliver the very best tutoring support. Any data is only gathered following the clear consent of the individual and is only used for specific, defined purposes. 

The policy provides a practical guide on the use of personal data. It describes how the data will be collected, handled and stored to comply with the law. 

Purpose of the policy

This data management policy ensures that Chloe White Tutoring Services:

• complies with data protection law and follows good practice;
• protects the rights of staff, tutors, clients and partners;
• is open about how it stores and processes individuals’ data; and 
• protects itself from risks of a data breach. 

The policy outlines: 

• what data Chloe White Tutoring Services is collecting;
• how data might be used; 
• how to achieve compliance and what is required in setting up a data audit trail; 
• who will be able to access and amend information;
• with whom Chloe White Tutoring Services will share data; and
• how Chloe White Tutoring Services will notify clients of any data breach or changes to the policy.

Data protection law 

Since 1 January 2021, the principal legislation has been the UK General Data Protection Regulation (the UK GDPR), coupled with the Data Protection Act 2018 (DPA 2018), which supplements the UK GDPR in specific ways. The UK GDPR states that six principles must be followed, so personal data must be processed so that the data are: 

1. processed lawfully, fairly and transparently; 
2. processed only for specific, explicit and legitimate purposes; 
3. adequate, relevant and necessary;
4. accurate and kept up to date; 
5. not to be stored or held for any longer than necessary; and 
6. processed securely with appropriate technical measures in place that ensure integrity and confidentiality. 

Data controllers must also be able to demonstrate that they are following the principles. There are also additional expanded individual rights:

• Right to be informed – to provide ‘fair processing information’, typically through a privacy notice and to be transparent over how personal data is used. 
• Right of access – the right to access their personal data and supplementary information, and confirmation that their data is being processed. 
• Right to rectification – Individuals have the right to have personal data rectified if it is inaccurate or incomplete. 
• Right to erasure – the right to be forgotten. Enables the deletion or personal data if there is no compelling reason for retention. 
• Right to restrict processing of data – the right to ‘block’ processing of personal data. You are permitted to store the personal data but not process it further. 
• Right to data portability – applies to personal data provided by an individual where processing is based on consent or the performance of a contract, and when processing is carried out automatically. 
• Right to object – to direct marketing (including profiling); processing for purpose of scientific/historical research and statistics; processing based on legitimate interests of a task in the public interest. 

People, risks and responsibilities 

Policy scope 

This policy applies to: 

• all premises of Chloe White Tutoring Services; 
• all staff, workers and volunteers at Chloe White Tutoring Services; 
• all contractors, suppliers, visiting companies and other people working on behalf of the organisation. 

The policy also applies to all data that Chloe White Tutoring Services holds relating to identifiable individuals, even if that information technically falls outside the UK GDPR. This can include: 

• names of individuals;
• postal addresses;
• email addresses;
• telephone numbers;
• any other information relating to individuals (e.g. age, gender, ethnicity) 

Data protection risks 

This policy helps to protect Chloe White Tutoring Services from data security risks, including: 

• breaches of confidentiality such as information being given out inappropriately; 
• failing to offer choice – all individuals should be free to choose how Chloe White Tutoring Services uses data relating to them; and
• reputational damage. 

Responsibilities 

Everyone who works for or with Chloe White Tutoring Services has some responsibility for ensuring data is collected, stored and handled appropriately. 

Each team that handles personal data must ensure that it is handled in line with the policy and data protection principles. Serious breaches of this policy might be considered a disciplinary matter. 

Whilst the organisation is the data controller and data processor, some people may have key areas of responsibility. The directors are responsible for ensuring the organisation meets its legal obligations. 

The Data Protection Officer (DPO) is responsible for: 

• keeping the directors updated about data protection responsibilities, risks and issues; 
• reviewing all data protection procedures and related policies, in line with an agreed schedule; 
• arranging data protection training and advice for the people covered by this policy; 
• handling data protection questions from staff and anyone else covered by this policy;
• dealing with subject access requests from individuals to see the data Chloe White Tutoring Services holds about them; 
• checking and approving any contracts or agreements with visiting companies that may handle Chloe White Tutoring Services’s data; 
• ensuring all systems, services and equipment used for storing data meet acceptable security standards; 
• performing regular checks and scans to ensure security hardware and software is functioning properly; and 
• evaluating any third party services Chloe White Tutoring Services is using to store or process data. For example, cloud computing services. 

Data Storage 

Data that is stored electronically must be protected from unauthorised access and accidental deletion:

• Chloe White Tutoring Services’s staff should ensure that they have set up strong passwords that are changed regularly and never shared between other staff members.
• Data should never be stored on removable media like CD or DVD. 
• Servers should be sited in a secure location.
• Data should be backed up frequently. 
• Data should never be saved directly to laptops or other mobile devices like tablets or smart phones (that includes personal laptops or other mobile devices). 
• All servers and computers containing data should be protected by approved security software and a firewall. 

Data use and security 

Chloe White Tutoring Services is only obliged to report a data breach to ICO where it is likely to result in a risk to the rights and freedoms of individuals. Such a breach must be reported to the ICO within 72 hours. 

If unaddressed such a breach is likely to have a significant detrimental effect on an individual which, for example, might result in discrimination, financial loss, damage to reputation, loss of confidentiality. 

For example, the ICO will be notified about loss of customer details where the breach leaves individuals open to identify theft. Lesser data breaches will not require Chloe White Tutoring Services to notify the ICO but will necessarily require communication and apology to the individuals concerned. 

Data accuracy 

The law requires Chloe White Tutoring Services to take reasonable steps to ensure data is kept accurate and up to date.

Data Minimisation 

Chloe White Tutoring Services will only collect personal data we need to deliver our tuition service. Any data Chloe White Tutoring Services collects will be: 

• Adequate – sufficient to properly fulfil our tutoring services
• Relevant – has a rational link to the delivery of our tutoring services 
• Limited to what is necessary – Chloe White Tutoring Services will not hold more data than we need for the delivery of our tutoring services We will review the data we hold every 6 months and delete any information that we do not need. 

Pseudonymisation 

Pseudonymisation is a technique that replaces or removes information in a data set that identifies an individual. Pseudonymisation may involve replacing names or other identifiers which are easily attributed to individuals with, for example, a reference number. 

Wherever possible personal data held by Chloe White Tutoring Services will be pseudonymised. Measures will be put in place to ensure that the additional information (e.g. a reference number) is held separately and securely. 

Pseudonymising personal data can reduce the risks to the data subjects and help Chloe White Tutoring Services to meet its data protection obligations. Pseudonymisation, however, is effectively only a security measure. It does not change the status of the data as personal data. Pseudonymised personal data remains personal data and within the scope of the UK GDPR (ICO). 

Purpose limitation 

Chloe White Tutoring Services will always be clear about what its purposes for processing any data are from the start. We will record the purposes for processing data and specify them clearly for individuals. 

Chloe White Tutoring Services will only use personal data for a new purpose if:

• this is clearly compatible with the original purpose;
• consent is received; or 
• there is a clear obligation or function set out in law which Chloe White Tutoring Services must follow. 

Chloe White Tutoring Services will ensure:

• we have clearly identified the purpose or purposes for processing data; 
• we have documented those purposes; • details of those purposes are made clearly available to individuals;
• we regularly review the processing of data and, where necessary, update our documentation; and 
• if we plan to use personal data for a new purpose, other than a legal obligation or function set out in law, we check that this is compatible with our original purpose or we get specific consent for the new purpose. 

Personal data of vulnerable groups 

The personal data of vulnerable groups, for example children, must be given extra protection. Processing any data concerning vulnerable groups is considered high risk processing. As such, additional measures must be taken to protect this data. 

Chloe White Tutoring Services will take additional measures to protect the data of vulnerable groups, including:

• creating a specific record of processing activity; • specific oversight from the DPO;
• conducting a specific Data Privacy Impact Assessment (DPIA); 
• maintaining a data breach register; 
• documenting the information assets of vulnerable groups and Chloe White Tutoring Services’s approach to privacy management;
• ensuring all data is pseudonymised wherever possible; and 
• maintaining strict controls over the use of this data, managed by the DPO. 

Data sharing 

Chloe White Tutoring Services may at times need to share some personal data with self-employed tutors in order to ensure tutors can provide tutoring services for clients. Client’s consent will always be confirmed before any data is shared. Only limited and necessary data will be shared with tutors. 

Chloe White Tutoring Services will take all reasonable steps to ensure self-employed tutors have robust data protection policies in place. 

Chloe White Tutoring Services will keep clear records of any data shared, when it was shared, and the reasons for sharing data 

Subject access requests 

All individuals who are the subject of personal data held by Chloe White Tutoring Services are entitled to: 

• ask what information the company holds about them and why;
• ask how to gain access to it; 
• be informed how to keep it up to date; and 
• be informed how the company is meeting its data protection obligations. 

If an individual contacts the company requesting this information, this is called a ‘subject access request’. The Data Protection Officer can supply a standard request form, although individuals do not have to use this and may wish to verify the identity of anyone making a subject access request before handing over any information. 

Details should be provided of the timescale for when data will be provided to the individual. 

Providing information

Chloe White Tutoring Services should aim to ensure that individuals are aware that their data is being processed, and that they understand: 

• how the data is being used; and 
• how to exercise their rights. 

Key contacts and resources: 

Data Protection Officer – Chloe White Tutoring Services: chloewhitetutor@gmail.com Information Commissioners Office - https://ico.org.uk