Privacy Policy

1. Introduction

Rex Tutors, the trading name of Caleb Akhtar Martinez ("we," "our," or "us"), is committed to safeguarding your privacy and protecting the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our tutoring services and website.

This policy covers the personal data we collect when you use our tutoring services provided directly by Caleb Akhtar Martinez, as well as when you use our referral service to connect with an independent affiliate tutor.

This policy complies with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the UK Data Protection Act 2018.

2. Data Controller

Caleb Akhtar Martinez, trading as Rex Tutors, is the data controller for the personal data we process for both his own tutoring lessons and the Rex Tutors referral service.

If you have any questions about this Privacy Policy or how we handle your personal data, please see Section 16 for our contact information.

3. Personal Data We Collect

3.1 Personal Tutoring Data

When you book tutoring sessions directly with Caleb Akhtar Martinez, we collect:

Session Booking Information

When you book tutoring sessions through Cal.com, we collect:

• Booking Details: Name, email address, session preferences
• Calendar Information: Preferred dates and times for sessions
• Payment Information: Payment details processed securely through Stripe (we do not store payment card details)

Session Delivery Information

During tutoring sessions, we may collect:

• Session Content: Notes, problems worked on, learning materials created during sessions
• Progress Information: Academic progress, areas of focus, session outcomes
• Whiteboard Content: Digital whiteboard content created during sessions (see Section 8 for retention details)

3.2 Referral Service Data

When you use our referral service to connect with independent affiliate tutors, we collect:

Affiliate Tutor Communications: When you use the provided email addresses to inquire about or contact an affiliate tutor, we collect and store all information contained in the initial message. This data is retained so that we can validate feedback, handle complaints, or address any issues that may arise later regarding the tutor referral or connection process.

3.3 Technical Information

We automatically collect limited technical data:

• Website Usage: IP address (for security and rate limiting), browser type, pages visited

3.4 Communication Records

• Email Communications: All email correspondence related to your tutoring services
• Support Inquiries: Any questions or issues you raise with us

4. Legal Basis for Processing

4.1 Processing for Direct Tutoring Services

Contractual Necessity

We process personal data to fulfill our tutoring service contract:

• Delivering tutoring sessions you have booked
• Processing payments through Cal.com and Stripe
• Scheduling sessions and sending calendar invitations
• Providing educational materials and session content

Legitimate Interests

We process data for legitimate business purposes:

• Maintaining educational continuity when students return for additional tutoring
• Providing consistent and progressive learning experiences
• Improving our tutoring services and methods
• Business administration and record keeping
• Retaining records for potential audits or legal compliance

4.2 Processing for Referral Services

Legitimate Interests

We process data for legitimate business purposes:

• Facilitating connections between students and affiliate tutors
• Validating feedback and handling complaints regarding affiliate tutor referrals
• Business administration and record keeping
• Website security and fraud prevention

4.3 Legal Obligation

• Retaining financial records for tax and accounting purposes
• Compliance with business regulations

5. How We Use Your Personal Data

5.1 Service Delivery

• Responding to your initial inquiries
• Scheduling and conducting tutoring sessions
• Creating and sharing educational materials
• Tracking your learning progress
• Sending session reminders and follow-up materials

5.2 Business Operations

• Processing payments for tutoring services
• Maintaining business records and documentation
• Improving our tutoring methods and service quality
• Ensuring website security and preventing abuse

6. Third-Party Services We Use

6.1 Essential Service Providers

• Cal.com: Session booking and calendar management
• Stripe: Secure payment processing (integrated through Cal.com)
• Google Meet: Video conferencing for online tutoring sessions
• Google Workspace: Email services, document storage, and business operations

6.2 Session Tools

• Digital Whiteboard Services: We currently use Miro Lite or similar services for interactive whiteboards during sessions. These services may change, and alternative services may require account creation.

6.3 Third-Party Data Handling

We maintain data processing agreements with Google Workspace, Google Cloud, and Stripe for services that process personal data on our behalf.

Important: When you use our booking system, your data will be processed by Cal.com under their privacy policy. We are currently working on obtaining a Data Processing Agreement with Cal.com. In the meantime, you should review and be comfortable with their data handling practices:

• Cal.com Privacy Policy: https://cal.com/privacy

Payment processing through Stripe is covered by our Data Processing Agreement with them, ensuring your payment data is handled with appropriate GDPR protections. For additional information, you may review:

• Stripe Privacy Policy: https://stripe.com/privacy

Digital whiteboard services operate under separate terms where users interact directly with the service and are advised not to include personal information.

7. Affiliate Tutors

Important: Rex Tutors' privacy policy applies to the personal data we process directly. It does not govern the data handling practices of the independent Affiliate Tutors once a referral is made.

Rex Tutors facilitates connections between students and independent Affiliate tutors.

• Each Affiliate Tutor operates independently and forms direct contracts with students/parents
• The Affiliate Tutor becomes the data controller for the data they process for the tutoring services
• Affiliate Tutors are individually responsible for their own GDPR compliance
• Rex Tutors is not responsible for the data handling practices of the Affiliate Tutors
• Any personal data processing by tutors is governed by their own privacy policies

Important: Affiliate tutors are independent professionals who contract directly with customers. Rex Tutors does not employ these tutors and they are not contracted to Rex Tutors. Affiliate tutors are not classed as third-party service providers as they do not process data on behalf of Rex Tutors.

For questions about how a tutor handles personal data, please contact them directly. Rex Tutors' privacy policy only covers data we process directly.

8. Digital Whiteboard and Session Content

8.1 Whiteboard Usage Policy

Important: You must not include any sensitive personal information on digital whiteboards, including:

• Full names, addresses, or contact details
• Personal identification numbers or documents
• Financial information or payment details
• Any other confidential, sensitive, or private information

8.2 Whiteboard Content Retention

• Digital whiteboard data is not private and could be accessed by others on the whiteboard service
• A copy of the whiteboard content is provided to you for your reference
• We may retain a copy for educational continuity and service improvement purposes

9. Data Security

9.1 Technical Measures

• Secure transmission of all data using encryption (HTTPS)
• Secure cloud storage through Google Workspace
• Access controls and password protection
• Security monitoring and updates provided by our service providers
• Input sanitization to prevent malicious content

9.2 Organizational Measures

• Personal commitment to data protection and security practices
• Regular review of data processing practices
• Incident response procedures for any security issues
• Ongoing education on data protection requirements and best practices

10. Data Retention

10.1 Retention Periods

• Student Data: Marked for deletion after one year from the last tutoring session with the student, retained up until two years due to our annual review method
• Email Communications: Marked for deletion after one year from the last tutoring session with the student, retained up until two years due to our annual review method
• Session Materials: Marked for deletion after one year from the last tutoring session with the student, retained up until two years due to our annual review method
• Financial Records: Retained for 6 years as required by UK tax law

10.2 Data Deletion

Automatic Deletion Process

We conduct data deletion reviews annually during September. When one year has elapsed since your last tutoring session, your personal data is marked for deletion and will be permanently removed during the next September review cycle. This annual review process means data may be retained for up to two years from your last session.

Service Continuity: The annual deletion cycle ensures continuity of service for returning students. Many students take breaks and return months later, and retaining session materials and progress information during this period allows us to provide better educational continuity when they resume tutoring.

Immediate Deletion Requests

You can request immediate deletion of your data at any time. Users who request immediate deletion under their GDPR rights (Section 12.3) do not need to wait for the September deletion cycle. We will process such requests within one month as required by law.

Returning Students

If you book new sessions after your data has been marked for deletion but before it is permanently removed, your data will be retained and the retention period will restart from your most recent session. We securely delete all personal data unless we are legally required to retain it for compliance or legitimate business purposes.

11. International Data Transfers

Some of our service providers may process personal data outside the UK and European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place:

11.1 Current International Transfers

• Google Services: Google Workspace and Google Meet may process data in various Google data centers globally, protected by Google's data processing agreements and adequacy decisions
• Digital Whiteboard Services: Miro or alternative services may have international data processing

11.2 Safeguards for International Transfers

We ensure all international transfers are protected by one or more of the following:

• Adequacy Decisions: Countries recognized by the UK ICO or European Commission as providing adequate protection
• Standard Contractual Clauses (SCCs): EU-approved contract terms ensuring GDPR-level protection
• Data Processing Agreements: Binding contracts with service providers ensuring appropriate security measures
• Certification Schemes: Approved frameworks demonstrating GDPR compliance

11.3 Your Rights Regarding International Transfers

You have the right to obtain information about the safeguards in place for any international transfers of your personal data. Contact us for specific details about the protections applied to your data.

12. Your Rights Under GDPR

You have the following rights regarding your personal data under UK GDPR and EU GDPR:

12.1 Right of Access

You can request a copy of the personal data we hold about you, along with information about how we use it.

12.2 Right to Rectification

You can ask us to correct any inaccurate or incomplete personal data.

12.3 Right to Erasure

You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the original purpose.

12.4 Right to Restrict Processing

You can ask us to limit how we use your data in certain situations.

12.5 Right to Data Portability

You can request a copy of your data in a structured, commonly used format and ask us to transfer it to another organization.

12.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

12.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

12.8 Exercising Your Rights

To exercise any of these rights, please contact us at gdpr@rextutors.com.

12.9 Response Times

We will respond to your GDPR request within one calendar month from receipt. In cases where the request is complex or we receive many requests from the same user, this time may be extended to three calendar months. If an extension is necessary, we will inform you within one month of receiving your request and explain the reasons for the delay.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data appropriately.

13. Cookies and Tracking

13.1 Strictly Necessary Cookies Only

We only use cookies that are strictly necessary for website functionality and security:

• Security Cookies: Protect against malicious attacks and ensure secure form submissions

13.2 No Analytics or Marketing Cookies

We do not use:

• Analytics cookies or tracking technologies
• Marketing or advertising cookies
• Social media tracking pixels
• Any non-essential tracking technologies

13.3 Managing Cookies

Since we only use strictly necessary cookies, you cannot opt out of these without affecting essential website functionality. These cookies are required for security and proper website operation.

14. Children's Privacy

We assume that most of our students are under 18. We take care to protect children's privacy:

• We limit data collection from minors to what's necessary for our services
• We don't use children's data for marketing without parental consent
• Parents/guardians can review and request deletion of their child's data

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will:

• Post the updated policy on our website with a new effective date
• Seek fresh consent where required by law
• Maintain previous versions for our internal records

16. Contact Information

For any questions about this Privacy Policy or our data practices, please contact:

16.1 Supervisory Authorities

UK Residents:

EU Residents:

Contact your local data protection authority. A list of authorities is available at edpb.europa.eu.