Privacy notice
What we do with your own details as a customer.
- 01
Who this notice is for
This notice is for tutors and practices who use Lucy Learn, and for anyone who signs up or writes to us. It explains what we do with your own personal data as our customer.
If you are a parent or carer, your practice holds your family’s information and decides what happens to it; we look after it for them. The privacy notice that applies to you is your practice’s, and you should ask them about it.
- 02
Who we are
Smithies Studio LLP trades as Lucy Learn and is the controller of the personal data this notice describes. We are a limited liability partnership registered in England and Wales with number OC460734, at 27 Finches Close, Chepstow, NP16 5UX, and registered with the Information Commissioner’s Office under number C2029774. Write to us about anything in this notice at [email protected].
- 03
What we hold, why, and on what basis
Your email address and password (stored only as a one-way hash), your authenticator app’s secret and your recovery codes
- Why
- To create your account and keep it secure
- Lawful basis
- Our contract with you
Your practice’s details: its name, your name, contact details, town and outward postcode, VAT details and safeguarding lead
- Why
- To run the service and put your name on what your practice sends
- Lawful basis
- Our contract with you
Your plan, trial, subscription and payment history. Your card is held by Stripe; we see only its brand, last four digits and expiry
- Why
- To bill you and keep the records the law requires
- Lawful basis
- Our contract, then legal obligation
Which version of our terms and agreement you accepted, when, and from which IP address
- Why
- To show what we agreed
- Lawful basis
- Legitimate interests: being able to prove our contract
A record of significant actions on your account, with the IP address they came from, and of sign-up attempts, kept only as a one-way hash
- Why
- To keep the service and your account secure and stop abuse
- Lawful basis
- Legitimate interests: security and preventing fraud
How much email your practice sends, and how much bounces or is marked as spam
- Why
- To keep every practice’s email deliverable, as our Acceptable use policy describes
- Lawful basis
- Legitimate interests: protecting the service and every practice using it
What you write to us, and our replies
- Why
- To help you
- Lawful basis
- Legitimate interests: supporting our customers
- 04
Email we send you
We email you about your account: sign-in and sign-up links, receipts, failed payments, changes to our terms, our sub-processors or our prices, and anything else you need to know to use the service. These are part of the service and you cannot opt out of them while you have an account. We do not send marketing email.
- 05
Who we share it with
We do not sell your data or share it for anyone else’s marketing. We share it only with:
- the services listed on our Sub-processors page, which host the service, store files and send email;
- Stripe, which takes your subscription payments and holds your card;
- Google, which hosts our own email inbox, for anything you write to us;
- our accountants and professional advisers, under a duty of confidentiality; and
- HM Revenue & Customs, the police, a court or a regulator, where the law requires it.
- 06
Outside the UK
Our database is in the Netherlands, which the UK recognises as protecting data adequately. Stripe, Resend and Google may process your data in the United States; each transfer is covered by the UK Extension to the EU–US Data Privacy Framework, or by the UK International Data Transfer Addendum where that does not apply.
- 07
How long we keep it
Your account and your practice’s details
- How long
- While you are a customer, then 90 days, which is when your practice is deleted
Subscription, invoice and payment records
- How long
- Six years from the end of the financial year they belong to, because HMRC requires it
Which terms you accepted, when and from where
- How long
- Six years after our contract ends, the time within which either of us could bring a claim
Security and activity records
- How long
- Six years from when each was made
A sign-up that was never finished
- How long
- Deleted once the link we sent has expired unused
A record of the emails we send you: who to, which email and whether it arrived
- How long
- Twelve months
What you write to us
- How long
- Two years after we last wrote to each other
- 08
Automatic decisions
One decision is made automatically: if a subscription payment fails and has not been made seven days later, your practice is locked until it is paid. Paying unlocks it at once, and you can write to us if you think it has happened in error. Nothing else about you is decided automatically, and we do not profile you.
- 09
Cookies
Our website and the service use only the cookies needed to keep you signed in and protect your forms. We use no advertising or tracking cookies and no third-party analytics, so we do not ask for consent to cookies.
- 10
Your rights
You have the right to see the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable format. Some rights depend on the lawful basis: we cannot erase records the law requires us to keep, and we will tell you when that applies. Ask at the address above; we reply within a month.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.
- 11
Changes to this notice
If we change this notice in a way that matters, we will email you before the change takes effect. The date it last changed is shown on this page.