The small print.In plain English first.

Who this is between, and what it covers

This agreement is between your practice and Smithies Studio LLP, trading as Lucy Learn, and forms part of the Terms of service. It covers the personal data of your families, students, enquirers and their contacts that we process for you in providing the service (“your data”). It meets Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For your data, you are the controller and we are your processor. You decide what is held and why, and you are responsible for having a lawful basis for it, for any consent it needs, and for giving your families a privacy notice. We hold it and process it for you.

Our own details about you as our customer are not covered here: we are their controller, and the Privacy notice explains what we do with them.

Only on your instructions

We process your data only on your documented instructions, which are the Terms of service, this agreement, and what you do in the service. We do not use it for our own purposes, sell it, or use it to train any system.

If the law requires us to process it in another way, we will tell you before we do, unless the law forbids that. If we believe an instruction of yours breaks data protection law, we will tell you straight away.

Confidentiality

Only the partners of Smithies Studio LLP can reach the systems that hold your data, and each is bound to keep it confidential. Nobody at Lucy Learn can see inside your practice through the application unless you open a support window, which you can close at any time, and everything done while it is open is recorded in your activity log. Outside a window, we reach the database directly only to keep the service running or recover it, and never to read a family’s records.

Security

We take appropriate technical and organisational measures to protect your data, taking account of the fact that it includes children’s data and health information. They are set out in the annex below. We may improve them over time but will not reduce the protection they give.

Sub-processors

You give us general authorisation to use sub-processors. The ones we use today, what each does and where, are on the Sub-processors page.

Before we add or replace one, we will email you at least 30 days in advance. If you object on reasonable data protection grounds, tell us within that time; we will try to address it, and if we cannot, you may end the contract before the change takes effect and we will refund any amount you have paid for the time after it ends.

Each sub-processor is bound by a written contract giving your data the same protection as this agreement, and we remain responsible to you for what it does.

Transfers outside the UK

Your data is stored in London and in the Netherlands. Where a sub-processor processes it outside the UK, we make sure the transfer is covered by UK adequacy regulations, or by the UK International Data Transfer Agreement or Addendum, as the Sub-processors page sets out for each one.

Helping you with requests

The service gives you the tools to answer a request from a family to see, correct, export, restrict or erase their data. If a family writes to us instead of you, we will pass it to you without undue delay and will not answer it ourselves.

We will help you, as far as we reasonably can, to meet your duties on security, breach notification, data protection impact assessments and consulting the Information Commissioner, taking account of the information available to us.

Personal data breaches

If we become aware of a breach affecting your data, we will tell you without undue delay, and in any event within 48 hours, so that you can meet your own 72-hour deadline with the Information Commissioner. We will tell you what happened, the data and the people likely to be affected, the likely consequences, and what we have done and will do about it, giving you more as we learn it.

Deciding whether to notify the Information Commissioner or your families is yours as the controller, and we will not do either on your behalf without your agreement unless the law requires it.

At the end

When the contract ends, you have 90 days to take a copy of your data, and we will provide a full copy in a common machine-readable format if you ask. After 90 days we delete your data, unless the law requires us to keep it. Copies in backups are deleted as those backups expire in their normal cycle, and are kept secure and not used until then.

Showing we comply

We will make available the information you reasonably need to show that we meet Article 28, and answer reasonable written questions about it, at [email protected]. If that is not enough, you, or an auditor bound by confidentiality, may audit us once a year on 30 days’ notice, during working hours, at your cost, and in a way that does not expose other practices’ data. We may ask for more often where the Information Commissioner requires it or after a breach.

Liability and how long this lasts

Each of us is liable for our own breaches of this agreement and of data protection law, subject to the limits in the Terms of service. This agreement lasts as long as we process your data, including the 90 days after the contract ends.

Annex: the details of the processing

• Subject matter

  For your practice

  Providing the practice-management service to your tutoring practice.

• Duration

  For your practice

  The length of the contract, and 90 days after it ends.

• Nature and purpose

  For your practice

  Storing, organising, displaying and sending your data so you can run your practice: families and students, the timetable, attendance, invoicing and payments, documents and consent, email to families, and each family’s portal.

• People it is about

  For your practice

  Your students, who are usually children; their parents, carers and emergency contacts; people who enquire about tuition; and you and anyone you let use your account.

• Personal data

  For your practice

  Names and contact details; children’s dates of birth, year groups and schools; attendance, session notes and learning profiles; invoices and payment records (card and bank details are held by Stripe, never by us); documents, consent records and acceptances, with the time and IP address of each; photographs of sessions; email sent and what happened to it; and an audit trail of changes.

• Special category data

  For your practice

  Health information, including allergies, medical conditions and medication, and information about special educational needs, where you choose to record it.

Annex: security measures

• Every practice’s data is kept apart from every other’s by the database itself (row-level security), which refuses access when no practice is set, and within a practice each family can see only its own records.
• All traffic is encrypted in transit (HTTPS). Files and photographs are stored privately and encrypted in London, and are shown only through the application to someone allowed to see them.
• Your account needs a password and an authenticator app. Families sign in with single-use links, and nobody has a shared password.
• Location data is always removed from photographs before they are stored.
• No photograph of a child, and no health information, is ever sent by email.
• Every change to your data, and every action taken in a support window, is recorded in an audit log that cannot be edited.
• Retention periods are applied automatically, and every deletion is recorded.
• Our own accounts with our providers use multi-factor authentication, and each part of the service has its own credentials with only the access it needs.
• Changes to the software are tested automatically before release, including tests that one practice and one family cannot see another’s data.