How to create a privacy policy

To comply with UK law and build trust with clients, you must create a GDPR-compliant privacy policy. This document explains what personal data you collect, why you need it, and how you protect it. The most straightforward way to get started is by using a reputable online template and customising it carefully to reflect exactly how your business operates.

What is a Privacy Policy and why do I need one?

A privacy policy is a legal document that discloses how you gather, use, manage, and protect the personal data of your clients (in this case, students and their parents). Under the UK General Data Protection Regulation (UK GDPR), having a clear and accessible privacy policy isn't just good practice—it's a legal requirement if you process personal data.

For a tutoring business, personal data is anything that can identify a person, such as:

• Names, addresses, and email addresses of students and parents
• Phone numbers
• Dates of birth
• Information about a student's educational progress or special educational needs
• Bank details for payments

A good policy shows you are professional and transparent, helping parents and students feel confident and secure when sharing their information with you.

What must my Privacy Policy include?

Your policy needs to be comprehensive and easy to understand. Avoid complicated legal jargon. It must clearly state the following information:

1. Your business details: Your name (or company name), address, and contact information (email/phone).
2. The types of personal data you collect: Be specific. List the categories of data, e.g., 'Contact Data (parent's name, email)', 'Student Data (student's name, school year, learning goals)'.
3. How you collect the data: Explain the sources, for example, from a contact form on your website, during a phone consultation, or via email.
4. Your legal basis for processing the data: For each type of data you collect, you need a legal reason. For a tutor, the most common reasons are:
   • To fulfil a contract: You need a student's name and a parent's contact details to provide the tutoring services they've paid for.
   • With consent: You need explicit permission to send marketing emails.
   • Legitimate interests: You might track student progress to improve your teaching methods.
5. How you use the data: Detail what you do with the information. For example, "We use your email address to send lesson reminders and invoices."
6. Data sharing: State if you share data with any third parties. For example, you might share information with accounting software (like Xero) to manage invoices or a scheduling tool (like Calendly) to book sessions.
7. Data security: Briefly explain the measures you take to keep data safe, such as using strong passwords, encryption, and secure software.
8. How long you keep data: Specify your data retention periods. For example, you might keep client data for six years after they cease to be a client, for tax purposes.
9. Their rights: You must inform users of their legal rights under UK GDPR. These include the right to access their data, correct inaccuracies, have their data erased, and object to processing.
10. How to complain: Provide details on how a client can raise a concern with you, and also inform them of their right to complain to the Information Commissioner's Office (ICO), which is the UK's data protection regulator.

How to create your Privacy Policy

Writing a policy from scratch is difficult and risky. Follow these steps for a more reliable approach:

1. Audit your data: Before you start writing, map out all the personal data you handle. Ask yourself: What do I collect? Why do I collect it? Where is it stored? Who has access? How long do I need it for?
2. Use a reputable template: The ICO website offers excellent free resources and guidance. Alternatively, many legal tech companies or professional bodies (like The Tutors' Association) provide GDPR-compliant privacy policy templates, often for a small fee.
3. Customise it thoroughly: A template is just a starting point. You must edit every section to accurately reflect your specific business practices.

Top Tip: Never just copy and paste a privacy policy from another website. It won't be tailored to your business, will likely contain inaccuracies, and could leave you non-compliant with the law.

Where should I display my Privacy Policy?

Your privacy policy must be easy for people to find. The most common places to put it are:

• In the footer of your website.
• As a link on any web forms where you collect data (e.g., a contact or sign-up form).
• Attached to or linked within your client onboarding documents or contract.