Privacy Policy

We are the data controller for the information described here. That means we decide how and why it is used, and we are responsible for looking after it.

Who this policy covers:

• Account holders – the adult (usually a parent or guardian, sometimes an adult student) who signs up and pays.
• Students – the people we teach. Most are aged 16–18, so most are children in law. Section 8 is written for students and explains their rights in their own terms.
• Enquirers – anyone who contacts us or books a free consultation but doesn't sign up.
• Website visitors.
• School and professional contacts we deal with in the course of business.

If you are a student and you want the short version, go straight to Section 8.

We are not required to appoint a Data Protection Officer, and we have not appointed one. Rohan Dinesh is responsible for data protection at Econora and is the person to contact with any question, request or complaint about your information.

3.1 When you enquire or book a free consultation

• Name and contact details of the enquiring adult
• The student's first name, school year, exam board, and current/target grades
• Anything else you choose to tell us on the call or in your message
• Notes we make during or after the consultation

3.2 When you sign up

• Account holder: name, email address, phone number, billing address
• Relationship to the student (parent, guardian, or the student themselves if 18+)
• Payment details – see the note below

We do not see or store your card details. Payments are handled by Stripe. Stripe collects your card information directly, and we receive only confirmation, the last four digits, the card type, and the payment status.

3.3 The student record

• Student's name, school year, school (if given), exam board
• Current grade and target grade
• Attendance at classes and check-ins
• Assessment submissions, marks, and per-question feedback
• Essays submitted as homework, and the feedback given on them
• Notes from the 15-minute check-ins every two weeks
• Progress notes and any reports we produce

3.4 Communications

• Emails between us
• WhatsApp messages, including messages in group chats that include parents/guardians
• Messages sent through the student portal
• Records of calls and consultations (notes, not recordings, unless we tell you otherwise)

3.5 Lesson recordings

We record our live group classes.

What is recorded: the teacher (audio & face) and screen (slides and annotations), and the audio of any student who chooses to unmute and speak.

What is not recorded: student faces are never recorded and never appear in recordings on the portal or anywhere else. Cameras are optional in class, and our recording settings are configured to capture only the active speaker's audio and the teacher's screen.

Please be aware: if a student unmutes to answer a question, their voice will be captured in the recording, and other students will hear it. A student who does not want their voice recorded can ask questions in the chat instead.

1-to-1 check-ins are recorded. We record the teacher's camera, the teacher's shared screen, and the audio of the teacher, student, and parent. The student's and parent's cameras are never recorded – the student or parent may turn their cameras on so the teacher can see them during the check-in, but their video is not captured in the recording.

These check-in recordings are different from class recordings:

• they are made for safeguarding and quality purposes, not for catch-up;
• they are not published on the portal and are not visible to other students or to the account holder;
• they are accessible only to our Designated Safeguarding Lead, and every access is logged;
• they are automatically deleted after 30 days, unless a safeguarding concern has been raised, in which case the relevant recording is kept in line with the safeguarding retention period in Section 9.

We record these sessions to protect both the student and the teacher. No one reviews a check-in recording unless there is a specific reason to.

3.6 Portal and technical data

• Login credentials (passwords are encrypted; we cannot see them)
• Which resources and recordings have been accessed, and when
• IP address, browser and device type, and general location (country/region)
• Cookies and similar technologies – see Section 13

3.7 Testimonials and marketing material

Where someone agrees to give a testimonial, whether it is written, through a video, or a photograph, only with written consent, do we use it for business, marketing, or any other purposes. See Section 7.4.

3.8 Information we do not ask for

We do not ask for health information, information about a student's special educational needs, ethnicity, religion, or any other "special category" data.

However, people sometimes tell us these things – for example, a parent explaining that a student has a diagnosed condition, is unwell, or has had a bereavement. Where that happens:

• we use it only to support the student appropriately;
• we record only what is necessary and delete the rest;
• our lawful basis is your explicit consent, or – where the information relates to a safeguarding concern – the safeguarding of children basis in the Data Protection Act 2018.

Please do not send us medical or other sensitive information unless it is relevant to the tuition.

Under UK data protection law, we must have a lawful basis for everything we do with personal information. Here is ours, purpose by purpose.

Where we rely on legitimate interests, we have carried out a balancing assessment and taken particular account of the fact that most of our students are children and are entitled to a higher standard of protection. You can ask us for a summary of any of these assessments at hello@econora.co.uk.

We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects.

Most of our students are aged 16–18, and we may accept younger students. Children have the same data protection rights as adults, and additional protections.

How this shapes what we do:

• Only an adult (18 or over) can sign up and pay. We do not offer a public signup link – access is issued only after an initial conversation.
• We have designed the student portal in line with the ICO's Age Appropriate Design Code. That means privacy-protective settings by default, collecting the minimum information we need, no techniques designed to nudge students into sharing more, and information written in language a student can actually understand.
• Students cannot see each other's marks, feedback, essays, or contact details.
• We treat the best interests of the child as a primary consideration when we decide how to use their information.
• We do not use student data for advertising, and we do not sell it. Ever.
• We have completed a Data Protection Impact Assessment for the student portal and review it annually.

A note on consent and age. In UK law, a child aged 13 or over can give their own consent to online services. But we do not rely on the student's consent to deliver tuition – our basis is the contract with the account holder and our legitimate interests. Consent matters only where we ask for it specifically, such as for a testimonial.

Students exercise their own data rights. From around the age of 12, a child is generally considered mature enough to exercise their own rights over their information. A 16- or 17-year-old student can make a request to us directly, and their parent cannot make it for them or prevent it.

Account holders have access to the student portal. This is part of the service, and we tell students about it when they join.

What an account holder can see:

• Attendance at classes and check-ins
• Assessment marks and per-question feedback
• Essay feedback
• Lesson recordings
• Progress reports

What an account holder cannot see:

• Anything a student tells us in confidence about their personal circumstances
• Any safeguarding concern, record or referral
• The content of a student's own data rights request to us
• Private notes we keep for safeguarding purposes

If a student objects. A student aged 16 or over who does not want their parent or guardian to have access can contact us at hello@econora.co.uk. In some circumstances, we may need to restrict or remove portal access. We will not tell the account holder the student's reasons.

When a student turns 18, parental responsibility ends. We will ask the student to confirm whether they are happy for the account holder to continue to have access.

We do not sell your personal information, and we do not share it for anyone else's marketing.

7.1 Our service providers

We use the following companies to run the business. They act on our instructions and are bound by contract to protect your information.

About Stripe: Stripe is not simply acting on our instructions when it processes payments – it is a separate controller of your payment data and has its own privacy policy, which we recommend reading at stripe.com/privacy.

About WhatsApp: WhatsApp is a messaging service, not a service provider we control. Messages are end-to-end encrypted, but Meta processes information about your use of the service under its own terms. Please note that in a WhatsApp group chat, your phone number and display name are visible to every other member of that group, including parents.

7.2 Safeguarding

If we have a concern that a student is at risk of harm, we may share information with the police, local authority children's services, the Local Authority Designated Officer, the NSPCC, or the student's school – without the account holder's consent, and without telling them first, where doing so would increase the risk to the student. This is set out in our Safeguarding Policy.

7.3 Professional advisers and legal requirements

We may share information with our accountant, insurers or legal advisers, and we will disclose information where the law requires it – for example to HMRC, a court, or a regulator.

7.4 Testimonials

We publish testimonials only with written consent from the person giving it. If the person is under 18, we ask for consent from both the student and their parent or guardian.

We publish first names only. Photographs and videos are also used only with specific written consent. You can withdraw your consent at any time by emailing hello@econora.co.uk, and we will remove the testimonial from our own website and social media accounts within 14 days. We cannot recall printed material already distributed, or copies cached or archived by third parties such as search engines.

7.5 If the business is sold

If Econora is sold or reorganised, personal information may be transferred to the buyer. We will tell you if that happens and the buyer will be bound by this policy until they give you a new one.

What we know about you. Your name, your school year, your exam board, your grades now and the grades you're aiming for, your attendance, your assessment answers and marks, your essays and the feedback on them, and messages you send us.

Are you on the recording? Your face, never. We record the teacher's screen and voice. If you unmute to answer a question, your voice will be on the recording and other students will hear it. If you'd rather not be recorded at all, use the chat instead of unmuting – that's completely fine.

What can your parent see? Your attendance, your marks, your feedback, and the class recordings. That's it. They cannot see anything you tell us privately, and they cannot see notes we keep if we're worried about you.

Can other students see your results? No. Your marks, feedback and essays are yours alone.

Your rights are yours. Not your parent's. You can ask us what we hold about you, ask us to correct something wrong, or ask us to delete something. You don't need your parents' permission, and they can't stop you.

If something's wrong, or you're not happy. Email hello@econora.co.uk and tell us. We'll take it seriously, and we'll reply. If you don't like our answer, you can complain to the Information Commissioner's Office – they're the UK regulator, and they're free. Details in Section 12.

If you're worried about something that isn't about data – anything at all, about you or someone else – tell Rohan Dinesh at rohan@econora.co.uk.

We keep information only as long as we need it. Here is our schedule.

After these periods, we delete the information securely, or anonymise it so it can no longer identify anyone.

Our database and the student portal are hosted in the UK/EU region.

Some of our service providers are based in the United States or store data there. When personal information is transferred outside the UK, we make sure it is protected by one of the safeguards UK law allows – either the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the International Data Transfer Agreement / UK Addendum together with an assessment of the risks of that transfer.

You can ask us which safeguard applies to a particular provider at hello@econora.co.uk.

You have the following rights over your personal information. They are free to exercise, and we will respond within one month.

• Access – ask for a copy of what we hold about you
• Rectification – ask us to correct anything inaccurate or incomplete
• Erasure – ask us to delete your information, where we no longer have a good reason to keep it
• Restriction – ask us to stop using your information while a dispute is resolved
• Objection – object to us using your information where we rely on legitimate interests, and object to direct marketing at any time (we will always stop marketing when you ask)
• Portability – ask for the information you gave us in a machine-readable format
• Withdraw consent – where we rely on consent, withdraw it at any time. This doesn't affect anything we did before you withdrew it

Some rights are not absolute. For example, we cannot delete records we are required by law to keep, such as accounting records, and we will not delete safeguarding records on request.

To exercise a right, email hello@econora.co.uk. We may ask you to confirm your identity. If a request is unusually complex or you have made several, we may need longer – we will tell you within a month if so, and explain why.

Students make their own requests. See Section 5.

If you are unhappy with how we have handled your personal information, tell us first. We would rather fix it.

• Email: hello@econora.co.uk
• Write to: Rohan Dinesh, Econora Limited, 167-169, Great Portland Street, London, England, W1W 5PF

You can complain in any way that suits you – email, letter, or a message through any channel you normally use to contact us.

What happens next:

1. We will acknowledge your complaint within 30 days.
2. We will investigate and respond as quickly as we can, and keep you updated if it takes longer.
3. We will tell you what we found and what we are doing about it.

If you are still not satisfied, you have the right to complain to the Information Commissioner's Office, the UK's independent regulator:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. ico.org.uk/make-a-complaint

We are not a member of an alternative dispute resolution scheme for data protection matters.

We use cookies on econora.co.uk.

You can change your choices at any time using the "Cookie settings" link in the website footer, or by clearing cookies in your browser.

We do not use any advertising or marketing cookies at all – not on our website, and not in the student portal. We do not use cookies to advertise to students.

Check the full Cookie Policy for more details.

• All data is encrypted in transit and at rest
• Access to student records is restricted to the two directors, and the portal enforces this at the database level
• Two-factor authentication is enabled on all business accounts
• Passwords are stored encrypted and cannot be seen by us
• We keep a record of what we hold and why, and we review it annually
• We have a procedure for dealing with data breaches. If a breach happens that is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you directly where the risk to you is high

No system is completely secure, but we take these obligations seriously, and we will always be straight with you if something goes wrong.

We will update this policy when what we do changes. The version number and date at the top will tell you when it last changed.

If we make a significant change – for example, using your information for a new purpose – we will email account holders and give reasonable notice before it takes effect.

• Terms & Conditions
• Cancellation & Refund Policy
• Safeguarding & Child Protection Policy
• Cookie Policy