Book Your Assessment
Parent Login
020 8287 2282

Parties

  1. Venturous Education Limited of 24 Cheam Common Rd, Worcester Park KT4 8RW(“the Company”) is the data controller for the purposes of the General Data Protection Regulation and applicable local law.
  2. The Company’s registered address is 24 Cheam Common Rd, Worcester Park KT4 8RW. The Company’s contact email for any data subject requests or questions is info@thestudyhut.co.uk

Background

  1. Venturous Education Limited (“the Company”) operates an online tuition and education center at https://thestudyhut.co.uk (the “Website”).
  2. In operating the Website and providing its services, the Company collects and processes personal data about individuals. This privacy policy sets out how personal data is collected and used by the Company, and individuals’ rights in respect of their personal data.
  3. This privacy policy aims to ensure that personal data collected and processed by the Company is done so in accordance with the General Data Protection Regulation and all other relevant data protection laws applicable in England and Wales.
  4. This privacy policy is intended to inform:
    • (1) visitors to and users of the Website;
    • (2) customers who purchase services from the Company;
    • (3) suppliers and other third parties the Company engages with;
    • about how the Company collects and uses personal data.

  1. Definitions
    1. Personal data means any information relating to an identified or identifiable living individual.
    2. Special category data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life or sexual orientation.
    3. Data subject means a living individual who is the subject of personal data.
    4. Processing means any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
    5. Data controller means the natural or legal person, public authority, agency or other body which alone or jointly with others, determines the purposes and means of the processing of personal data. The Company is the data controller.
    6. The Company is committed to protecting the personal data of individuals in accordance with the General Data Protection Regulation and the Data Protection Act 2018.

  1. Introduction
    1. The Company is committed to protecting the personal data of individuals in accordance with the General Data Protection Regulation and the Data Protection Act 2018.
    2. This privacy policy applies to all personal data collected and processed by the Company relating to:
      1. an individual’s name, contact details, date of birth, education details;
      2. financial information provided for payment processing;
      3. technical and usage data collected through use of the Website.
    3. If you have any questions about this privacy policy or how the Company handles personal data, you can contact the Company at info@thestudyhut.co.uk or by post at Venturous Education Limited, 24 Cheam Common Road, North Cheam, Surrey, KT4 8RW.
  1. Scope
    1. This privacy policy applies to all personal data collected and processed by the Company.
    2. Personal data means any information relating to an identified or identifiable natural person. This includes, but is not limited to name, date of birth, contact details, financial details, employment details and other relevant details (“Personal Data”).
    3. Personal Data may be collected through the Website, over the phone, via email or other correspondence, in person at the Company’s premises or elsewhere, and through other interactions and communications between the data subject and the Company.
    4. Personal Data will be processed for the purposes of:
      1. Providing the services and operating the business of the Company;
      2. Handling payments and collecting debts;
      3. Marketing the Company’s services;
      4. Improving services;
      5. Complying with applicable laws and regulations; and
      6. Any other legitimate business purposes.
    5. This privacy policy covers Personal Data of all categories of data subjects including customers, suppliers, employees, job applicants and other individuals the Company interacts with.
    6. This privacy policy applies to all Personal Data processed by the Company, regardless of where processing takes place.
  1. Personal Data Collection
    1. Types of personal data collected. The Company collects the following types of personal data: name, date of birth, contact details including email address and telephone number, payment details including bank account and credit/debit card details, education history, marketing preferences.
    2. How personal data is collected. Personal data is collected directly from data subjects when they: (i) visit the Website; (ii) contact the Company by telephone, email or post; (iii) create an online account; (iv) purchase services or products from the Company; (v) request marketing to be sent to them; (vi) enter competitions and promotions. The Company may also receive personal data indirectly from third parties such as partners with whom joint marketing activities are conducted.
    3. Purposes of collection. Personal data is collected for the following purposes: (i) to register customers on the Website and administer their accounts; (ii) to provide requested services and products; (iii) to process and fulfil orders and deliver related products and services; (iv) to manage billing and payments; (v) to provide customer and technical support; (vi) to send service related communications including confirmations, renewals, updates, security and legal notices; (vii) to send marketing communications and offer new products, services or discounts where consent has been provided.
    4. Legal basis for collection. The legal basis for collecting and using personal data is: (i) performance of a contract for purposes under clauses 4.3(i) to 4.3(iv); (ii) legitimate interests for purposes under clauses 4.3(v) to 4.3(vi); (iii) consent for marketing purposes under clause 4.3(vii). Consent will be obtained through pre-ticked opt-in boxes on registration and in separate communications, with a clear option to opt out. Consent can be withdrawn at any time.
    5. Data Minimisation. The Company only collects personal data that is necessary for the purposes of collection stated under clause 4.3. Any excess personal data will be deleted.
  1. Use of Personal Data
    1. The Company relies on the following lawful bases to use personal data:
      1. For the performance of a contract between the data subject and the Company;
      2. For compliance with legal obligations to which the Company is subject;
      3. For the purposes of the legitimate interests pursued by the Company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
    2. The Company uses personal data for the following purposes:
      1. To provide tuition and education services to data subjects;
      2. To manage the contractual relationship with data subjects;
      3. To comply with applicable law and regulation;
      4. To backup and secure personal data;
      5. To send marketing communications where consent has been provided. Data subjects have a right to object to such processing at any time.
    3. The Company may share personal data with the following third parties for the purposes described in clause 4.2:
      1. Payment processors to take payments for services;
      2. Cloud computing providers to backup personal data;
      3. Marketing platforms to send emails and communications with consent.
    4. Personal data will be retained for the periods specified in the Company’s data retention policy or for the duration of any statutory limitation period where relevant.
  1. Sharing of Personal Data
    1. The Company may share personal data with third party service providers that assist with operating the Website and providing services to users. This includes companies that provide IT and system administration services, analytics and search engine providers, payment processors and fraud prevention agencies. The Company will ensure any sharing under this clause is subject to contractual restrictions that impose the same or equivalent data protection obligations on the recipient as under this privacy policy.
    2. The Company may disclose personal data if required to do so by law or under any court order. The Company may also share personal data with law enforcement agencies in connection with any investigation to help prevent unlawful activity.
    3. If the Company sells or transfers all or part of its business or assets, including to a buyer or other successor, the Company may transfer users’ personal data as part of the transferred assets. Users’ personal data will remain subject to the terms of this privacy policy.
    4. The Company may share aggregated and anonymised data, which does not identify individual users, publicly and with its partners for purposes such as analysing usage trends and understanding how users use the Website.
    5. Where the Company relies on consent to share personal data with third parties, it will ask for consent and provide details of the recipient and purpose of sharing at the point consent is requested. Consent to sharing can be withdrawn at any time.
    6. The Company will not share contact details with third parties for their own direct marketing without users’ consent. Users can opt-out of marketing at any time by contacting the Company or using the opt-out links in marketing communications.
  1. International Data Transfers
    1. The Company may transfer personal data to countries outside the European Economic Area (EEA).
      1. Personal data may be transferred to countries such as the United States of America
    2. Transfers to countries subject to an adequacy decision by the European Commission, such as Canada and Japan, provide an appropriate level of protection to personal data.
    3. Transfers to countries without an adequacy decision, such as the United States, are protected by standard contractual clauses approved by the European Commission to ensure the transfer complies with the GDPR.
    4. Individuals have the same rights in relation to international transfers as set out elsewhere in this policy, including the right to lodge a complaint with the Information Commissioner’s Office.
    5. Please contact the Company’s data protection officer at info@thestudyhut.co.uk if you have any questions about international transfers of personal data.

.

  1. Data Retention
    1. The Company will only store personal data for as long as necessary for the purposes for which it was collected, or for longer if required by law.
    2. The criteria used to determine the storage period for personal data will include:
      1. The purposes for which the personal data was collected and whether these purposes can still be achieved;
      2. Any legal or regulatory requirements to retain personal data for a minimum period; and
      3. The legitimate interests of the Company in retaining personal data for a reasonable period.
    3. Customer personal data will be stored for a period of 6 years from the date of the last interaction to comply with accounting requirements.
    4. Personal data processed for marketing purposes will be stored for a maximum period of 3 years from the date of collection.
    5. In limited circumstances, personal data may be stored for longer periods where required for dispute resolution or legal claims.
    6. At the end of the relevant storage period, the Company will securely delete or anonymise the personal data. Deletion involves removing the data from the Company’s active systems. Anonymization involves modifying the personal data such that it can no longer identify an individual.
    7. Records will be kept by the Company of all personal data storage periods in accordance with Article 30 of the General Data Protection Regulation.
  1. Data Subject Rights
    1. Right to access data. An individual has the right to obtain confirmation from the Company as to whether their personal data is being processed, and if so access to their personal data. The Company must provide a copy of the personal data, and give details about the processing – free of charge.
    2. Right to rectification. An individual has the right to have inaccurate or incomplete personal data rectified or completed by the Company without undue delay.
    3. Right to erasure. An individual has the right to have their personal data erased by the Company where: (1) personal data is no longer necessary for the purposes it was collected, (2) consent is withdrawn and there is no other legal ground for processing, (3) the individual objects to processing and there are no overriding legitimate grounds, (4) personal data has been unlawfully processed, or (5) personal data must be erased for compliance with a legal obligation. The Company is not required to comply with the right to erasure if processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
    4. Right to restriction of processing. An individual has the right to restrict processing of their personal data by the Company in certain circumstances, such as while the accuracy of the personal data is contested.
    5. Right to data portability. An individual has the right to receive their personal data that they provided to the Company in a structured, commonly used and machine-readable format, and can request the Company transmit this data to another data controller.
    6. Right to object. An individual has the right to object at any time to the Company processing their personal data for direct marketing purposes. The Company must cease such processing promptly upon receiving an objection. An individual also has the right to object on grounds relating to their particular situation to any other processing which is based on the Company’s legitimate interests. In such cases the Company must stop processing the personal data unless it can demonstrate compelling legitimate grounds for the processing that override the interests of the individual, or if processing is necessary for the establishment, exercise or defense of legal claims.
    7. Rights in relation to automated decision making and profiling. An individual has rights in relation to decisions based solely on automated processing of data, including profiling, which produce legal effects or similarly significantly affect the individual. The Company must implement suitable measures to safeguard the individual’s rights, freedoms and legitimate interests in these circumstances.
  1. Links to Third Party Websites
    1. The Website may contain links to third party websites.
      1. The Company is not responsible for the privacy practices or content of those third party websites.
    2. The Company is not liable or responsible for third parties’ use of personal data.
    3. Users are encouraged to check the privacy policies of third party websites to understand how their data is used before using those sites or providing any personal data to them.
  1. Security
    1. Encryption. The Company shall encrypt all Personal Data held in its systems using industry standard encryption methods including AES-256 encryption for data “at rest” and TLS 1.2 encryption or higher for data “in transit”.
    2. Access controls. The Company shall implement strict access controls and authentication methods including multi-factor authentication to prevent unauthorised access to systems containing Personal Data. Access to Personal Data shall be on a need-to-know basis only.
    3. Staff training. All staff of the Company shall receive regular training in data protection and information security to ensure Personal Data is handled appropriately and securely. Such training shall be provided to staff on joining the Company and no less frequently than annually thereafter.
    4. Risk assessments. The Company shall conduct regular risk assessments to identify and address security risks to systems containing Personal Data. Such risk assessments shall be conducted no less frequently than annually and also following any significant system or organisational changes at the Company.
    5. Breach notification. In the event of a Personal Data breach, the Company shall comply with its obligations to notify the relevant supervisory authority and Data Subjects where applicable under Articles 33 and 34 of the GDPR. The Company shall maintain records of any Personal Data breaches, regardless of whether notification is required.
    6. Audits. The Company shall conduct regular independent audits of its technical and organisational security measures to ensure they are operating effectively and the security of systems and Personal Data is maintained. Audit reports shall be reviewed by the Company’s board of directors.
  1. Changes to this Privacy Policy
    1. The Company may update this Privacy Policy from time to time. The Company will notify users of any substantial changes to this Privacy Policy by placing a prominent notice on the Website.
    2. The Company will maintain a record of previous versions of this Privacy Policy.
    3. By continuing to use the Website following any changes to this Privacy Policy, the user agrees to be bound by the updated Privacy Policy. If the user does not agree with the changes, their only recourse is to stop using the Website.
    4. For any substantial updates to this Privacy Policy, the Company will assess whether a data protection impact assessment is required under its legal obligations.
    5. Where the Company makes any substantial updates to this Privacy Policy it will take reasonable steps to inform data subjects about the nature of the changes in an appropriate manner having regard to the nature of the changes.