Privacy Policy

Last updated: 14 September 2026

This policy explains what personal information Gloucester Maths Academy ("we") collects, why we need it, and what your rights are. It follows UK data protection law: the UK GDPR, the Data Protection Act 2018 and PECR. It covers people who message us through the website, parents and guardians with a portal account, and the students whose lessons we manage.

1. Who we are

Gloucester Maths Academy is responsible for your information (the "controller").

• Email: [email protected]
• Address: 6 Ampney Drive, Kingsway, Quedgeley, Gloucester, GL2 2HR
• For a privacy request, email us or use the contact form and put "Privacy Request" in your message.

2. What we collect

We collect this from you when you fill in a form, sign up, sign in, confirm a payment or contact us, and from the tutor when they book and manage lessons:

• Contact details: parent or guardian name, student name, year group, email address, phone number and any address you give us.
• Messages: what you send through the contact form.
• Account details: your login email, account type, when you accepted our policies, sign-in information and password reset records.
• Lesson records: lesson dates, times, subjects, status and prices.
• Payment records: amounts due and paid, and when you confirm a payment, the name on the bank account, the date you paid and any note. If the tutor records or queries a payment, we keep their note too.
• Security information: such as IP addresses, used to limit repeated attempts and keep the site safe.

3. Why we use it, and our legal reasons

• To provide tuition (contract): running your account, booking lessons and keeping payment records.
• To keep things safe (legitimate interests): protecting accounts and preventing misuse or fraud.
• Because the law requires it (legal obligation): keeping records we have to keep.
• To reply to you (consent, or steps before a contract): answering messages you send us.

4. Children's information

Our students are school age. The parent or guardian manages the account and must be allowed to share their child's details with us.

5. Who we share it with

We never sell your information. We only share it with companies that help us run the site: Supabase, which stores our database and handles sign-in; our email provider, which sends emails such as password resets; and our hosting and security providers. Where needed, these companies are bound by contracts that protect your information.

6. Information stored outside the UK

Some of these companies may store information outside the UK. When they do, we use the safeguards UK law requires, such as approved countries or approved contracts.

7. How long we keep it

• Messages: until we no longer need them to reply and follow up.
• Account, student, lesson and payment records: while lessons continue, and afterwards for as long as accounting and legal rules require (usually up to 6 years).
• Password reset links: they stop working after about 30 minutes, or once used.

8. Keeping it safe

We protect your information with secure sign-in, secure connections (HTTPS), limits on repeated attempts, and making sure each account can only see what it should.

9. Your rights

You can ask us to show you the information we hold about you, correct anything that's wrong, delete it in some cases, stop or limit how we use it in some cases, give you a copy of what you gave us in a format you can reuse, or stop using it where we rely on your consent.

To make a request, use the contact details in section 1. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

10. Automated decisions

We don't make decisions about you by computer alone that have a legal or similarly serious effect on you.

11. Cookies

We only use the cookies needed to sign you in and keep the site secure. Our Cookie Policy has the details.

12. Changes to this policy

We may update this policy. When we do, we'll change the "Last updated" date at the top.