Privacy Policy

1. Who we are

CentreHQ is a tuition centre management platform operated by [to be confirmed] (company registration number [to be confirmed]), registered at [to be confirmed]. You can contact us at [to be confirmed]. In this policy, “CentreHQ”, “we” and “us” mean the operator of the platform; “centre” means a tuition centre that uses CentreHQ to run its business.

2. Controller and processor roles

Two different roles apply, depending on whose data is involved:

• Family data (parents, children, enquiries, attendance, progress, invoices): the tuition centre you deal with is the data controller. CentreHQ processes this data only on the centre’s instructions, as a data processor, under a data processing agreement. If you are a parent or student, your first point of contact for any privacy question or request is your centre.
• Platform account data (centre owner and staff accounts, subscription and billing details, support correspondence, demo enquiries from this website): CentreHQ is the data controller.

3. Data we collect

Processed on behalf of centres (centre is the controller)

• Parent and guardian contact details, and enquiry records
• Child records: name, date of birth, year group, study plans, homework, assessment results, progress and uploaded evidence
• Safeguarding records: authorised collectors, consents, incident logs
• Attendance, session bookings and absence requests
• Invoices, payment records and signed contracts
• Staff records held by the centre: profiles, availability, timesheets, payslips and DBS expiry dates

Collected by CentreHQ as controller

• Account details for centre owners and staff: name, email, authentication credentials, two-factor enrolment and registered passkeys
• Subscription and billing information for the centre’s CentreHQ plan
• Demo and contact enquiries submitted through this website, including the answers copied to the support team’s Google Form
• Technical logs (IP address, timestamps) needed to secure and operate the service

4. Children’s data

Children’s data on CentreHQ is controlled by the centre that teaches them. We apply specific safeguards:

• We never market directly to children, and children’s data is never used for marketing.
• Child logins use a centre code and a PIN managed through the parent portal. Children do not need a personal email address or password. Passkeys are also supported. Biometric information used to unlock a passkey stays on the device.
• Parents manage their child’s PIN and homework settings through the parent portal.

5. Lawful bases

Each centre determines the lawful bases for the family and staff data it controls, including any additional conditions for health or safeguarding information. The bases below describe CentreHQ’s own processing as controller.

• Contract — providing and administering the platform subscription for centres.
• Legitimate interests — securing the platform, preventing fraud and abuse, and responding to demo enquiries you send us.
• Legal obligation — retaining accounting records and responding to lawful requests.
• Consent — where we ask for consent for an optional use, you can withdraw it by contacting us. Centres obtain and manage their own photo, video and similar consents.

6. Service providers and sub-processors

These providers support the platform, centre communications, our own billing and website enquiries. The purpose and circumstances of each use are listed below.

Locations and international processing

The application, database and uploaded files use Google Cloud’s London region. Operational email is sent through Amazon SES in London. These settings do not keep all processing within the UK: Google states that Firebase Authentication processes data in the United States. Website delivery, security services, demo enquiry handling and payment providers may also involve processing outside the UK.

The provider-specific transfer terms, applicable safeguards and how to obtain a copy must be confirmed before this draft is finalised. UK hosting alone does not establish that international-transfer safeguards are unnecessary.

7. Retention

• Family data is retained for as long as the centre instructs us to hold it. When a centre leaves CentreHQ, its data is exported to the centre and then deleted (see our Data Processing Agreement).
• The daily retention routine removes records in bounded batches: enquiries that never became a family after about 12 months without activity, WhatsApp message records after about 24 months, former pupils’ records after six years without activity, and audit logs after six years. These are the current platform retention periods. Safeguarding records are never deleted automatically.
• Platform account data is retained while the account is active and for a reasonable period afterwards to resolve disputes.
• Daily task execution records are kept for 30 days for operational support.
• Billing records are retained as required by UK tax law (normally six years).
• Demo enquiries are kept while we handle the request and for any resulting business relationship. The retention period for copies held by support must be confirmed in the legal review.

8. Your rights

Under UK GDPR you have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent. The rights available depend on the processing and any applicable legal exceptions.

• Parents and students: contact your tuition centre first — it is the controller of your data and can action requests directly in the platform, including a GDPR data export.
• Centre owners and staff, or website visitors: contact us at [to be confirmed] and we will respond within one month.

9. Security

• Staff workspace access requires an authenticator or registered passkey
• Encrypted cloud storage and HTTPS for data in transit
• Login lockout after repeated failed attempts, and passkey support
• A full audit log of significant actions
• Core application data stored in London, with provider processing described above

10. Contact

Questions about this policy: [to be confirmed]. Postal address: [to be confirmed].