This policy explains what personal data The Contemporary Mathematics School and Olympia Fellows collect about enquirers, parents, pupils and website visitors, why we use it, who we share it with, and your rights.
1. Who we are
The data controller is Contemporary Mathematics School Limited, trading as The Contemporary Mathematics School and Olympia Fellows ("CMS", "we", "us").
- Company number: 17302106, registered in England and Wales
- Registered office: Flat 19 North End House, Fitzjames Avenue, London, W14 0RS
- ICO registration number: ZC251240
- Privacy contact and Data Protection Officer: info@cmschool.co.uk
- Website: contemporarymathematics.com
2. Who this policy covers
- Website visitors and people who enquire or apply
- Parents and guardians who book or pay for tuition
- Pupils who receive tuition, most of whom are under 18
- Contacts at schools and partner organisations
Tutors and job applicants are covered by our separate tutor privacy notice. Where a school arranges our tuition for its pupils, the school's own privacy notice also applies.
3. What personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Parent or guardian name, email, phone or WhatsApp number, billing address where needed for invoicing | You |
| Pupil details | Pupil name, age or school year, school, programme of interest, goals, competition and exam history | Parent or pupil |
| Tuition records | Lesson dates, attendance, lesson notes, homework, progress reports and tutor feedback | Our tutors and booking system |
| Lesson recordings and transcripts | Audio, video, whiteboard content and transcripts of online lessons | Our online classroom |
| Payment and billing | Invoices, payment status and payment references | You and our payment provider |
| Additional needs | Any health, learning support or access information you choose to share | Parent or pupil |
| Safeguarding | Concerns raised about a pupil's welfare and how we handled them | Tutors, parents, reviewers, our systems |
| Marketing preferences | Newsletter consent and unsubscribe status | You |
| Technical | IP address, browser type, operating system and pages visited, from server logs | Your device |
4. Children's data
Most of our pupils are under 18. We collect a pupil's details from their parent or guardian, who enters into the tuition agreement with us.
- We collect only what we need to teach and to keep pupils safe.
- We do not send marketing to pupils.
- We publish a pupil's name, results, photo or testimonial only with separate written consent, which can be withdrawn at any time.
- Pupils have their own data protection rights. A parent can usually exercise them for a younger child. Where a pupil is mature enough to understand their rights (as a guide, from around age 12 or 13), we may ask for the pupil's view before acting on a parent's request.
5. How we use your data and our lawful bases
We process personal data under the UK GDPR on the following bases.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries and applications, arranging consultations | Identity and contact, pupil details | Steps taken at your request before a contract |
| Delivering tuition: matching tutors, scheduling, teaching, progress reports | Identity and contact, pupil details, tuition records | Performance of a contract |
| Invoicing, taking payment and chasing unpaid invoices | Identity and contact, payment and billing | Performance of a contract |
| Keeping tax and accounting records | Payment and billing | Legal obligation |
| Recording and transcribing online lessons, and generating AI lesson summaries, for safeguarding review, teaching quality, lesson planning, and so pupils can catch up on missed lessons | Lesson recordings and transcripts | Legitimate interests: keeping pupils safe and maintaining teaching standards |
| Safeguarding pupils and responding to welfare concerns | Safeguarding, recordings, tuition records | Legitimate interests. For any special category data: substantial public interest (safeguarding of children) |
| Adapting teaching to additional needs you tell us about | Additional needs | Legitimate interests, plus your explicit consent for health information |
| Sending newsletters and updates about courses and events | Contact, marketing preferences | Consent, which you can withdraw at any time |
| Keeping our website secure and monitoring its performance | Technical | Legitimate interests: running a secure website |
| Handling complaints, rights requests and legal claims | Any relevant data | Legal obligation and legitimate interests: defending our legal position |
If you do not provide the contact and pupil details we need, we may be unable to provide tuition.
We use automated tools to transcribe lessons and to generate lesson summaries and plans for tutors. Our classroom provider sends lesson text to its AI provider for this, which does not keep it or use it to train its models. We do not make decisions about you or the student by solely automated means.
6. Who we share data with
We never sell personal data or share it for anyone else's marketing. We share it only with the recipients below.
| Recipient | Why |
|---|---|
| Our tutors (employees and self-employed tutors, all bound by confidentiality) | To teach and report on progress |
| Tutoring management platform | Booking, enquiries, lesson administration and client records |
| Online classroom provider, and the AI provider it uses | Online lessons, lesson recording, transcription and AI lesson summaries |
| Other pupils in the same group lesson | Group lesson recordings and materials are available to the group so pupils can catch up |
| Email and document storage provider | Email, documents and internal records |
| Website hosting provider | Hosting our website |
| Payment provider | Invoicing and payments |
| Professional advisers and insurers | Advice, audits and claims |
| HMRC, police, local authority safeguarding teams, courts and regulators | Where the law requires it or a child's safety demands it |
Our service providers act as our data processors under written contracts. They may use your data only on our instructions.
You can ask us for the names of the providers we currently use.
7. International transfers
Some of our providers store or access data outside the UK, including in the EEA and the United States. Where that happens, the transfer is covered by UK adequacy regulations (including the UK-US Data Bridge where the provider is certified) or by the ICO's International Data Transfer Agreement or Addendum. You can ask us for details of the safeguard that applies.
8. Security
- Data sent through our website forms is encrypted in transit using HTTPS.
- Our systems are protected by multi-factor authentication.
- Access is limited to the staff and tutors who need it for their role.
- If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.
9. How long we keep your data
We keep personal data only for as long as we need it for the purposes in section 5. We delete or anonymise data once it is no longer needed.
| Data | How long we keep it |
|---|---|
| Enquiries and applications that do not lead to enrolment | While there is a reasonable prospect you may enrol |
| Pupil details, tuition records, lesson recordings, transcripts and summaries | While the pupil studies with us, then for as long as reasonably needed to answer questions, provide references, or deal with a complaint or legal claim |
| Invoices and payment records | At least 6 years, as tax law requires |
| Safeguarding records | For as long as they may be needed to protect a child or respond to a concern or claim, in line with safeguarding guidance |
| Newsletter contact details | Until you unsubscribe. We then keep a minimal record so we do not email you again. |
| Complaints and rights requests | For as long as needed to resolve the matter and any follow-up |
| Website technical data | For as long as needed for security and troubleshooting |
You can ask us to delete your data earlier. We will do so unless the law requires us to keep it.
10. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to:
- Access a copy of the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data in certain circumstances
- Restrict or object to processing based on legitimate interests
- Object to direct marketing at any time, which we will always honour
- Port data you gave us, in a structured, machine-readable format, where we process it by consent or contract
- Withdraw consent at any time where we rely on it
To exercise a right, email info@cmschool.co.uk. It is free. We may ask you to confirm your identity, and we will respond within one month.
11. Complaints
If you are unhappy with how we have handled your personal data, email info@cmschool.co.uk with the subject line "Data protection complaint". We will acknowledge your complaint within 30 days, investigate without undue delay and tell you the outcome.
You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint or 0303 123 1113.
12. Cookies
Our website does not set cookies itself. Our booking and enquiry forms, provided by TutorCruncher, use Google reCAPTCHA to block spam and abuse, which sets a security cookie. We do not use analytics or advertising cookies. Our online classroom and booking system set their own cookies, described in their providers' privacy notices. If we introduce analytics or other non-essential cookies, we will update this policy and ask for your consent where the law requires it.
13. Changes to this policy
We review this policy regularly and post any update on this page with a new "last updated" date. We will tell you directly about any change that significantly affects how we use your data.