PRIVACY POLICY

 Effective date: 25 September 2025

1. WHO WE ARE (CONTROLLER)

The Learning Vault Hub (“TLV Hub”) is a division of The Learning Vault Ltd (company no. 09383151). We determine how and why your personal data is processed and act as data controller for the Website and services.

Contact: admin@thelearningvaulthub.com

2. WHAT THIS POLICY COVERS

This policy explains what personal data we collect, why we collect it, our legal bases, how long we keep it, who we share it with, international transfers (if any), your rights, and how to contact us. It applies to our website, subdomains, and services available via TLV Hub (including the Online Classroom).

3. PERSONAL DATA WE COLLECT

• Account & profile data: name, email, phone, address, role (Parent/Guardian, Student, Tutor), photo, biography, qualifications (Tutors), DBS status, availability.
• Identity & verification (Tutors): ID documents, background-check evidence (e.g., DBS/PVG/Access NI).
• Booking & usage data: subjects, schedules, messages sent via the platform, support requests, attendance logs, recordings metadata.
• Payment data: last 4 digits of card, payment tokens, transaction references (card details are processed by Stripe; we don’t store full card numbers).
• Technical data: IP address, device/browser info, cookies, log data.
• Marketing & preferences: opt-in choices, interests, cookie preferences.

If you provide data about a child (under 18), you confirm you are the parent/guardian or have parental authority.

4. WHY WE PROCESS YOUR DATA AND OUR LEGAL BASES

We process personal data only where we have a lawful basis under UK GDPR:

• To provide and operate the service (create accounts, publish Tutor profiles, enable search, bookings, messaging, Online Classroom, recordings where applicable).
  Legal basis: Contract (Article 6(1)(b)); Legitimate interests (Article 6(1)(f)) for service improvement and safety.
• Payments and fraud prevention (collect fees, issue refunds, detect misuse).
  Legal basis: Contract; Legitimate interests; Legal obligation for accounting/tax records.
• Tutor verification and safeguarding (check identity and background-check evidence; restrict access where checks are missing or expired).
  Legal basis: Legitimate interests (safety of learners); Legal obligation where applicable.
• Customer support and service communications (booking confirmations, reminders, policy changes, incident notices).
  Legal basis: Contract; Legitimate interests (service continuity).
• Marketing (news, offers, features) only with your consent or where soft opt-in applies (existing customer, similar services). You can opt out anytime.
  Legal basis: Consent (Article 6(1)(a)) or Legitimate interests (soft opt-in under PECR).
• Security, abuse prevention, and service analytics (detect spam, ensure system integrity, monitor platform misuse).
  Legal basis: Legitimate interests.

5. COOKIES & SIMILAR TECHNOLOGIES

We use necessary cookies to run the site and optional cookies (e.g., analytics, preferences, marketing) with your consent. You can manage preferences via our cookie banner or browser settings. See our Cookie Policy for details (types, lifespans, vendors).
Examples of functional cookies: login/session, screen options, comment convenience cookies.

6. COMMENTS AND EMBEDDED CONTENT

If you leave a comment, we collect the information you provide in the comment form, along with your IP address and browser details, to help prevent spam. If you use Gravatar, your profile image may be displayed alongside your comment (see Automatic’s Privacy Policy for details).

Some pages on our site may include embedded content (such as videos, images, or articles). Embedded content from other websites functions the same as if you visited those websites directly and may collect data about you in line with their own privacy policies.

7. LESSON RECORDINGS

Where enabled, lessons/classes may be recorded to support safeguarding, quality, and dispute resolution, and to make recordings available to the relevant Student.
Legal basis: Legitimate interests (safety, quality, dispute handling).
Recordings are accessible to TLV Hub administrators and the relevant Student/Tutor. We do not publish them publicly. Retention is limited (see section 10).

8. WHO WE SHARE DATA WITH

We only share what’s necessary to provide the service, comply with law, or protect rights. Typical recipients include:

• Payment processor: Stripe Payments Europe, Ltd (card processing, fraud prevention).
• Hosting & infrastructure providers: secure cloud hosting, email delivery, logging, analytics (e.g., Microsoft/AWS/Google, transactional email).
• Verification & safety tools: ID and background-check validation where applicable.
• Customer support tools: ticketing and live messaging platforms.
• Professional advisors (legal/accounting) and law enforcement/regulators where required.
  We do not sell your personal data.

9. INTERNATIONAL TRANSFERS

Some providers may process data outside the UK. Where that happens, we rely on an ICO-approved transfer mechanism (e.g., UK adequacy regulations, UK IDTA/Standard Contractual Clauses plus supplementary measures).

10. HOW LONG WE KEEP DATA (RETENTION)

We keep data only as long as needed for the purposes set out above, then delete or anonymise it:

• Account & profile: for the life of the account and up to 6 years after closure (to handle disputes/accounting).
• Bookings, invoices, and payment records: 6 years (tax/legal).
• Background-check evidence (Tutors): for the validity period and up to 1 year after expiry or account closure, whichever is later.
• Recordings: typically 90 days unless a dispute/safeguarding review is ongoing.
• Marketing data: until you withdraw consent or object, then we suppress further emails.
• Cookies/analytics: per our Cookie Policy.

11. YOUR RIGHTS

Under UK GDPR you can:

• Access your data (get a copy).
• Rectify inaccurate or incomplete data.
• Erase data (where no longer needed; not where retention is required by law).
• Restrict or object to processing (especially direct marketing).
• Portability (receive your data in a structured, commonly used format, where processing is by consent or contract and automated).
• Withdraw consent at any time where processing is based on consent (e.g., marketing cookies/emails).
  To exercise rights, email admin@thelearningvaulthub.com. We may need to verify your identity.

12. CHILDREN

Where the learner is under 18, the parent/guardian is the registered Student and provides necessary consents and information. We do not allow children to create accounts in their own name for paid services.

13. SECURITY

We use appropriate technical and organisational measures to protect personal data (encryption in transit, access controls, regular backups, least-privilege access, staff confidentiality). No system is 100% secure, but we work to prevent unauthorised access, use, alteration, or disclosure.

14. AUTOMATED DECISION-MAKING

We do not make decisions producing legal or similarly significant effects based solely on automated processing. If this changes, we will let you know and explain your rights.

15. THIRD-PARTY LINKS

Our site may link to third-party websites. Their privacy practices are their own; please review their policies.

16. CHANGES TO THIS POLICY

We may update this policy from time to time. If changes are material, we will notify you (e.g., email or in-product notice). The latest version will always be available on our Website with the “Effective date” shown at the top.