Privacy notice for tutors
How UPrep uses the information of tutors who work with us.
Who we are. UPrep is run by Abdulrehman Shaker as a sole trader. Abdulrehman decides how your information is used (the "controller") and is also our Designated Safeguarding Lead. Contact: uprep.tutors@gmail.com · 07305 601684.
Who this is for. Anyone who tutors for UPrep, applies to, or covers lessons for us.
1. What we collect, and why
| What | Why | Our legal basis |
|---|---|---|
| Your name, contact details, the subjects, levels and times you'd like to teach | To offer you lessons and run our work together | Contract: our Tutor Services Agreement with you |
| The agreement, and the policies you've been given and acknowledged | To show what we agreed and what you were given | Contract, and legitimate interests in keeping a reliable record |
| Lesson records (which pupil, when, how long) and payment details (bank details, amounts paid) | To arrange lessons and pay you | Contract |
| Tax and payment records | Where the law requires us to keep them | Legal obligation |
| Vetting: your identity, two references, the qualifications and work or activity history you enter in the portal (we take your history as you give it; we record which qualifications we've seen evidence for), for any gap of a month or more the months and a broad reason (for example study or travel; never the details), every period you've lived, worked or studied outside the UK (country and months), however many there are, and your confirmation that these lists are complete, our recorded overseas assessment (whether an overseas check is available, whether one was obtained, our reasoning, decision and any follow-up), a yearly self-declaration about cautions or convictions, a record each time we confirm that the person teaching is you (at the first session of each assignment, and if a substitute is used), four details from your DBS certificate (issue date, type, what it was issued for, number), your surname and date of birth as on the certificate (so we can check it on the DBS Update Service), whether we first looked at a copy, how we established the original certificate (we saw it in person, or the employer or recruiting organisation that saw it confirmed it: which one, who, how and when), the date we checked your ID, and a dated record of each check and each yearly declaration, including who checked it | To make sure it's safe for you to work with children, and to keep that check current | Legitimate interests in protecting children (we've written an assessment you can ask to see), with DPA 2018 Sch 1 para 36 + para 10 for criminal-record information |
| DBS Update Service checks, and their result, with your permission: a dated record of each time you give or withdraw it (you can withdraw it in the portal at any time) and which DBS details it related to | To confirm your certificate is still current, yearly. We stop at once if you withdraw permission, and when your tutoring relationship with us ends | As above |
| Right to work in the UK: by the method that applies to you: your share code, date of birth and the Home Office result we save when we check it; or a photo of your passport's photo page that you upload and the copy we make of your original passport when we check it in person; or the copies we make of the documents you show us from the Home Office's list (physical originals, or official digital evidence of your National Insurance number, such as a screenshot or email from HMRC), which document or combination it was, our confirmation that we held the physical originals, how your National Insurance evidence was presented and who issued it, or on whose behalf (with the provider's name as shown), and any Home Office Employer Checking Service response and its date; for each of those files, a record our system makes when it's uploaded (which file, its version, size, type and checksum, when it was uploaded and confirmed, and who confirmed it); the date we checked (recorded at the time we check), how we matched you to the photo or the documents (in person or by video), the outcome, any restrictions, and, if your permission is time-limited, its expiry date and when we'll check again | To check you're allowed to work in the UK before you take any lessons. Since 1 October 2026 the Home Office rules require this for tutors engaged the way we engage you (as individual sub-contractors), and we check everyone the same way | Legal obligation if you started tutoring with us on or after 1 October 2026; if you started earlier, legitimate interests in making sure everyone who teaches our pupils can work in the UK (we've written an assessment you can ask to see) |
| When your tutoring relationship with us ended (the agreement as a whole, not a single assignment), any correction to that date, and any later return to UPrep (a new period), with who recorded it and why | To know when to stop DBS checks, when to delete your right-to-work files, and which checks must be done again if you return | Legitimate interests in an accurate record, including knowing when our two-year retention period for right-to-work files starts |
| Concerns, complaints or allegations about you | To protect children and deal with concerns fairly | Legitimate interests in protecting children (assessment written), with Sch 1 para 18 for any sensitive or criminal information |
What we don't do: we never keep a copy or photo of your DBS certificate, and we don't collect health, religion, ethnicity or similar information about you. For a gap in your history we ask only for a broad reason, never the details, and there's no free-text box for it.
2. Do you have to give it?
Your contact details, the agreement, references, your qualifications and work history, the self-declaration, a suitable DBS check and your permission for Update Service checks are conditions of tutoring for UPrep (contractual). Without them we can't offer you lessons. Right-to-work evidence is a legal requirement if you started tutoring with us on or after 1 October 2026, and a condition of tutoring for UPrep for everyone. Everything else is optional.
3. Where it comes from
Mostly from you. Also from your referees (who we tell about this notice), the DBS (through the certificate you show us and the Update Service), the Home Office (when we check a share code, or ask its Employer Checking Service about a document), an employer or recruiting organisation you name (if it confirms it saw your original DBS certificate), and, if a concern is raised, from parents, pupils or others.
4. Who we share it with
- Parents of the pupils you teach: your name, and your lesson times.
- Children's services (CASS), the LADO, the police or the DBS, only where needed to protect a child or where the law requires it.
- An employer or recruiting organisation you name, only to ask it to confirm it saw your original DBS certificate.
- HMRC, and any accountant we use, for tax.
- Service providers who store or carry information for us (section 5). Some act only on our instructions; others under their own terms.
We never sell your information or use it for marketing.
5. Service providers we use
- Google, through Firebase (our website and tutor portal) handles information only on our instructions.
- Google (Gmail, our email) and WhatsApp (lesson coordination, only if you agree, otherwise email; messages are end-to-end encrypted and generally stored on phones, and WhatsApp may keep undelivered messages and media on its servers, encrypted, for up to 30 days) are services we use under their own terms.
- Our bank (a UK bank), for payments.
- Our records are on an encrypted laptop only Abdulrehman uses.
6. Information outside the UK
- Firebase (Google LLC, USA). Portal sign-in details are processed in the USA. Our database is stored in London, in the UK. Google is signed up to the UK's adequacy regulations for the US (the "UK Extension"), so these transfers are covered by UK law. Google's data processing terms also include standard contractual clauses, at firebase.google.com/terms/data-processing-terms, or ask us for a copy.
- Gmail (Google LLC, USA). Google handles our email under its own privacy policy and relies on the same UK Extension. See policies.google.com/privacy/frameworks.
- WhatsApp (WhatsApp LLC, USA). WhatsApp can't read your messages (they're end-to-end encrypted), but it handles your phone number and group details in the USA. WhatsApp LLC isn't covered by the UK's adequacy regulations for the US, and there's no other UK-approved safeguard for this. So we only use WhatsApp with you if you agree; if you'd rather not, we use email, and that makes no difference to your work with us. You can switch at any time.
- The DBS is a UK government body. Payments: we pay you through a UK bank and don't ourselves send payment information abroad. Our records are on a laptop in the UK.
7. How long we keep it
| Record | How long |
|---|---|
| Vetting (the DBS details and your permission records, references, qualifications and work history, self-declarations, our checks) | While you tutor for us, then up to 6 years after you stop, unless a safeguarding matter about you is open |
| Contract, lesson and payment records | While you tutor for us, then for as long as tax law and possible claims require (usually around 6 years) |
| Right-to-work evidence (our copies of the documents we checked, the Home Office result, any Employer Checking Service response) | While your tutoring relationship with us lasts, then 2 years after it ends (not when a single assignment ends), then deleted automatically. If you started tutoring with us on or after 1 October 2026, that is the period the Home Office rules set; for everyone else it is our own policy |
| Your own passport photo (the one you upload first) | Only until our check is recorded: then our clean-up deletes it, usually within about two hours (it runs every hour on files more than an hour old, and later if it is delayed). If you replace it or change route, the old photo goes the same way. If no check takes place, it is deleted after 90 days. It is never kept for the two years above. Each deletion leaves a short record: which file, why, and when |
| The record of each right-to-work check (date, outcome, who checked) and of each file (above) | With your vetting records (above). A file's record is marked as deleted when the file itself is deleted |
| Concerns or allegations about you | At least 10 years, and possibly longer where the law on child-abuse claims requires it |
These are the criteria in our retention schedule. The right-to-work period is settled. Final periods for the other records are being set, and we'll tell you if they change.
8. Your rights
You can ask to see your information, correct it, have it deleted or restricted, object to how we use it (for anything based on legitimate interests), or ask for a copy to move elsewhere where that applies. Some rights are limited where information is needed to protect children.
Complaints. Tell us first: uprep.tutors@gmail.com, subject "Data protection complaint". We'll acknowledge within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk · 0303 123 1113.
WhatsApp or email. If you agreed to WhatsApp, you can switch to email at any time: just tell us.
Changes. If we plan to use your information for something new, we'll tell you first.
Version 15 · 5 October 2026. Website enquiries are covered by our website privacy notice.