1. Who we are
CentreHQ is a tuition centre management platform operated by [to be confirmed] (company number [to be confirmed]), registered at [to be confirmed]. You can contact us at [to be confirmed]. In this policy, “CentreHQ”, “we” and “us” mean the operator of the platform; “centre” means a tuition centre that uses CentreHQ to run its business.
2. Controller and processor roles
Two different roles apply, depending on whose data is involved:
- Family data (parents, children, enquiries, attendance, progress, invoices): the tuition centre you deal with is the data controller. CentreHQ processes this data only on the centre’s instructions, as a data processor, under a data processing agreement. If you are a parent or student, your first point of contact for any privacy question or request is your centre.
- Platform account data (centre owner and staff accounts, subscription and billing details, support correspondence, demo enquiries from this website): CentreHQ is the data controller.
3. Data we collect
Processed on behalf of centres (centre is the controller)
- Parent and guardian contact details, and enquiry records
- Child records: name, date of birth, year group, study plans, homework, assessment results and progress
- Safeguarding records: authorised collectors, consents, incident logs
- Attendance, session bookings and absence requests
- Invoices, payment records and signed contracts
- Staff records held by the centre: profiles, availability, timesheets, payslips and DBS expiry dates
Collected by CentreHQ as controller
- Account details for centre owners and staff: name, email, hashed password, two-factor enrolment
- Subscription and billing information for the centre’s CentreHQ plan
- Demo and contact enquiries submitted through this website
- Technical logs (IP address, timestamps) needed to secure and operate the service
4. Children’s data
Children’s data on CentreHQ is controlled by the centre that teaches them. We apply specific safeguards:
- We never market directly to children, and children’s data is never used for marketing.
- Child logins use a centre code and a 4-digit PIN issued by the centre to the parent — no email address, no password and no biometric data is collected from a child.
- Parents manage their child’s PIN and homework settings through the parent portal.
5. Lawful bases
- Contract — providing the platform to centres, and processing family data needed to deliver tuition services the family has signed up for.
- Legitimate interests — securing the platform, preventing fraud and abuse, and responding to demo enquiries you send us.
- Legal obligation — retaining accounting records and responding to lawful requests.
- Consent — where a centre records photo, video or similar consents, the centre obtains and manages that consent as controller.
6. Sub-processors
We use a small number of service providers to run CentreHQ:
| Sub-processor | Purpose | When it applies |
|---|
| Resend | Transactional email delivery | Always |
| Stripe | Platform subscription billing (centre payment details) | Always |
| Intuit (QuickBooks) | Accounting sync of customers, invoices and payments | Only when a centre connects its own QuickBooks account |
| Railway (hosting) | Application and database hosting, EU/UK region | Always |
| Meta (WhatsApp Business) | WhatsApp messaging | Not yet live — will apply only once the integration is approved and a centre enables it |
7. Retention
- Family data is retained for as long as the centre instructs us to hold it. When a centre leaves CentreHQ, its data is exported to the centre and then deleted (see our Data Processing Agreement).
- Platform account data is retained while the account is active and for a reasonable period afterwards to resolve disputes.
- Billing records are retained as required by UK tax law (normally six years).
- Demo enquiries that do not lead to a subscription are deleted within a reasonable period.
8. Your rights
Under UK GDPR you have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
- Parents and students: contact your tuition centre first — it is the controller of your data and can action requests directly in the platform, including a GDPR data export.
- Centre owners and staff, or website visitors: contact us at [to be confirmed] and we will respond within one month.
9. Security
- Mandatory two-factor authentication for all staff-level accounts
- AES-256 encryption at rest for stored integration credentials
- Login lockout after repeated failed attempts, and passkey support
- A full audit log of significant actions
- Data hosted in the UK
10. Contact
Questions about this policy: [to be confirmed]. Postal address: [to be confirmed].