1. Overview & Data Controller
LB MATHS TUITION LTD (Company No. 17119191, registered at 38 Macmurdo Road, Leigh-On-Sea, England, SS9 5AQ) is the Data Controller responsible for personal data processed via this website.
For any privacy inquiries or to exercise your statutory rights under UK GDPR, contact Luke Terry Bowdery directly at luke@lbmathstuition.co.uk.
2. Strict Data Minimization: What We Collect
Because lesson bookings and billing are processed externally, personal data held on this platform is strictly minimized:
- Student Name: Provided by parents externally, used solely to identify the student and build their timetable profile.
- Parent / Guardian Contact Email (Optional): Stored solely for lesson coordination, schedule updates, and tutor-parent communication. May be set and updated by the parent, student, or administrator, and is accessible only to the student's assigned tutor and administrators.
- Security Credentials: A random 4-digit PIN and secure Magic Link token for passwordless portal entry. Students do NOT log in with an email address.
- Lesson Records: Scheduled dates, times, attendance confirmation status, topics covered, and optional ratings/feedback.
- We do NOT collect or store children's personal email addresses, phone numbers, home addresses, or financial data on this website.
- Full name, company email address (
@lbmathstuition.co.uk), bcrypt password hash, hourly pay rate, and lesson logs.
- IP addresses, browser user agent, action timestamps, and audit trail logs (e.g. login events, attendance confirmations) to protect portal security.
3. Lawful Bases for Processing (UK GDPR Art. 6)
- Contract Performance (Art. 6(1)(b)): To manage lesson timetables, launch Microsoft Teams calls, and verify attendance.
- Legitimate Interests (Art. 6(1)(f)): To maintain a secure timetable audit log and prevent unauthorized access.
- Parental Consent (Art. 6(1)(a) & Art. 8): Parental authorization obtained during external enrollment to create the student profile.
4. Third-Party Infrastructure & Sub-Processors
Platform data is stored and processed with trusted enterprise infrastructure providers:
- Cloud Database: Turso (ChiselStrike Inc.) hosted on AWS EU-West-1 (Europe/Ireland). All database records remain strictly within the UK/EEA.
- Web Hosting: Deno Deploy (Deno Land Inc.) — Serverless execution and application hosting.
- Video Meetings: Microsoft Ireland Operations Limited (Microsoft Teams) — Live video calling. No audio or video recordings are made or retained on the platform.
5. Data Retention, Deletion & Your Rights
Storage Limitation & Data Retention Policy: In accordance with the storage limitation principle of UK GDPR (Article 5(1)(e)), personal data of minors is retained only for as long as necessary for educational tuition. An Inactive status indicates a temporary break (such as summer holidays, half-term breaks, or a short-term pause in tuition) and does not mark a profile for deletion. However, where a student profile has conducted no lessons for a prolonged period (by default 90 days with no future lessons scheduled), the profile is automatically flagged for deletion on the administrator portal for review and permanent erasure, ensuring minor student credentials, names, and logs are never retained indefinitely.
Permanent Account Deletion: When an administrator deletes a student profile from the portal, the student record, access PIN, magic links, all associated lesson history, and audit log entries are permanently erased from the database.
Under UK GDPR, you have the right to request access to your data, request rectification or erasure ("right to be forgotten"), or object to processing. You may also lodge a complaint with the UK supervisory authority:
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk • Helpline: 0303 123 1113