Privacy and Cookie Policy

Thornwick Education Group · Privacy Notice · Last updated August 2026

Thornwick Education Group is committed to protecting the privacy and security of your personal data. This Privacy Notice explains how we collect, use, share and protect your personal data when you enquire about or use our tutoring services. It is important that you read this notice so you understand how and why we use your personal data.

Contents

  1. Who we are
  2. Data protection contact
  3. What is personal data?
  4. Data protection principles
  5. How we use your personal data
  6. The personal data we collect
  7. When and how we share your data
  8. The security of your personal data
  9. Storage and retention
  10. Your rights as a data subject
  11. Cookies
  12. Changes to this notice

1. Who we are

Thornwick Education Group ("Thornwick", "we", "us", "our") provides GCSE and A-Level Maths tutoring, diagnostic assessments and exam preparation. For the purposes of data protection law, Thornwick is the "data controller" of the personal data described in this notice, meaning we decide how and why your personal data is collected and used.

Thornwick Education Group is a trading name of Sahra Ibrahim, sole trader, of 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

2. Data protection contact

If you have any questions about this Privacy Notice, or want to exercise any of your rights as a data subject, please contact:

Sahra Ibrahim, Founder
Email: contact@thornwickeducationgroup.co.uk

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). We'd appreciate the chance to address your concerns first, so please contact us before approaching the ICO.

As a data controller, Thornwick Education Group complies with UK data protection law, including registration with the Information Commissioner's Office (ICO) where required.

3. What is personal data?

Personal data is any information about an individual from which that individual can be identified, for example a name, address, phone number or email address. It does not include data where identity has been removed (anonymous data).

4. Data protection principles

We comply with data protection law, which requires that personal data we hold about you is:

  • Used lawfully, fairly and in a transparent way.
  • Collected only for valid purposes we've clearly explained, and not used in a way that's incompatible with those purposes.
  • Relevant to the purposes we've told you about and limited to those purposes.
  • Accurate and kept up to date.
  • Kept only as long as necessary for the purposes we've told you about.
  • Kept securely.

5. How we use your personal data

We only use your personal data when the law allows us to. Most commonly, this is because:

  • It's necessary to perform a contract with you (for example, arranging and delivering tutoring sessions you've booked).
  • It's necessary to comply with a legal obligation (for example, safeguarding requirements).
  • It's in our legitimate interests (such as responding to enquiries, running our diagnostic assessments, or improving our services), provided this doesn't override your interests or rights.

Less commonly, we may also use your personal data to protect someone's vital interests, for example in an urgent safeguarding situation where it's necessary to protect a student's welfare.

Where we rely on your consent (for example, to send marketing emails), you can withdraw that consent at any time by contacting us.

6. The personal data we collect

Enquiries

When you contact us or request information about our services, we use the personal data you provide (such as your name, email address and phone number) to respond to your enquiry. This is in our legitimate interest, so that we can give you the information you've asked for.

Bookings and tutoring

If you book a diagnostic assessment, consultation or tutoring sessions, we may collect:

  • Contact details for the parent or guardian, and the student's name, year group and school.
  • Diagnostic assessment results, session notes and progress records.
  • Payment and billing details, in order to invoice for sessions.

This information is used to perform our contract with you and to deliver effective, personalised tutoring.

Special category data (health and learning needs)

If you choose to tell us about a specific learning difficulty, disability or health condition (for example, dyslexia, ADHD or anxiety) so that we can tailor tuition appropriately, this is "special category data" under data protection law. We only collect and use this information with your explicit consent. You're never required to share it, and you can withdraw your consent at any time by contacting us, though this may limit how well we're able to adapt sessions to your child's needs.

Marketing

If you've booked a service with us before, we may occasionally email you about similar programmes we think may interest you, relying on the "soft opt-in" allowed under UK electronic marketing law for existing customers. If you've only enquired and haven't yet booked with us, we'll only send marketing emails with your clear consent. Every marketing email includes a simple way to opt out, and you can also opt out at any time by contacting us; see "Your rights" below.

Website use

As you interact with our website, we may automatically collect technical data about your device and browsing activity using cookies and similar technologies. See the Cookies section below.

If you don't provide certain information

Some information, such as a parent or guardian's contact details and the student's year group, is needed for us to enter into and perform a tutoring contract with you. If you don't provide this, we may not be able to offer or deliver the service you've requested.

7. When and how we share your personal data

We don't sell your personal data. We may share it with:

  • Service providers who support our business, for example our booking platform (Calendly), email provider, or payment processor, solely to provide those services on our behalf.
  • Parents and guardians: if you are under 18, we may share relevant information with your parent or guardian in order to deliver tutoring and meet our safeguarding responsibilities.
  • Regulators or authorities: where we're legally required to, for example in relation to safeguarding concerns.
  • A new owner: if Thornwick Education Group is ever sold or transferred, your personal data may be passed to the new owner, who would continue to use it for the same purposes set out in this notice.

Some of our service providers are based outside the UK: for example, our booking platform, Calendly, is a US company. Where this means your personal data (such as your name and email address, when you book a session) is transferred outside the UK, we rely on the safeguards that provider has in place, such as standard contractual clauses approved for use under UK data protection law, to ensure your data is protected to a UK standard.

8. The security of your personal data

We put in place appropriate measures to prevent your personal data being accidentally lost, used, accessed, altered or disclosed without authorisation. Access is limited to those who have a genuine need for it, and any third party handling data on our behalf is required to keep it confidential and secure.

We have procedures in place to deal with any suspected data breach. Where the law requires it, we'll notify the ICO and, where there's a high risk to you, let you know directly, without undue delay.

9. Storage and retention of your personal data

We only keep personal data for as long as necessary for the purposes it was collected for: for example, tutoring and progress records for the duration of our relationship with you, and financial records for as long as required by law (generally up to six years, for accounting and tax purposes). In working out how long to keep information, we consider its sensitivity, the risk of harm if it were misused, and whether we're required by law to keep it for a set period. Please contact us if you'd like more detail on how long specific information is kept.

10. Your rights as a data subject

Under UK data protection law, you have the right to:

  • Request access to the personal data we hold about you.
  • Request correction of inaccurate or incomplete data.
  • Request erasure of your data, where there's no good reason for us to keep processing it.
  • Object to our processing of your data where we're relying on legitimate interests, including for direct marketing.
  • Request that we restrict processing of your data.
  • Request that we transfer your data to another organisation, where technically feasible.
  • Withdraw consent at any time, where we're relying on consent to process your data.

To exercise any of these rights, contact us using the details in section 2. You won't usually need to pay a fee, though we may ask for information to confirm your identity first, and if a request is clearly unfounded or excessive, we may charge a reasonable fee or decline to act on it.

11. Cookies

Our website uses cookies and similar technologies to help it function properly and to understand how visitors use it: for example, our booking calendar (Calendly) uses cookies to manage scheduling. You can control or disable cookies through your browser settings, though some parts of the site (like booking a consultation) may not work as intended if you do.

12. Changes to this notice

We may update this Privacy Notice from time to time. If we make any substantial changes, we'll make that clear on our website.